-
Notifications
You must be signed in to change notification settings - Fork 0
Home
erwinfr edited this page Apr 22, 2026
·
1 revision
This guide explains how to configure and connect to the GCM MCP Server.
The GCM MCP Server supports two transport modes:
- Runs as an HTTP server with SSE transport
- Requires API key authentication
- Default port: 8002
- Suitable for remote connections and multiple clients
- Runs via standard input/output
- No authentication required
- Suitable for local development and testing
Use the provided mcp-config.json:
{
"mcpServers": {
"gcm-mcp-server": {
"url": "http://localhost:8002/sse",
"transport": "sse",
"headers": {
"Authorization": "Bearer YOUR_API_KEY_HERE"
}
}
}
}Steps to use:
-
Start the server in SSE mode:
python -m src.server --transport sse --host 0.0.0.0 --port 8002
-
Generate an API key (from localhost only):
curl -X POST http://localhost:8002/admin/keys \ -H "Content-Type: application/json" \ -d '{"user": "your-username"}'
This will return a response like:
{ "key": "abc123def456...", "user": "your-username", "created": "2024-01-01T12:00:00Z", "key_prefix": "abc123de" } -
Update mcp-config.json with your API key: Replace
YOUR_API_KEY_HEREwith thekeyvalue from step 2. -
Add to your MCP client configuration:
- For Claude Desktop: Add the config to
~/Library/Application Support/Claude/claude_desktop_config.json(macOS) - For other MCP clients: Follow their specific configuration instructions
- For Claude Desktop: Add the config to
Add this to your MCP client configuration:
{
"mcpServers": {
"gcm-mcp-server": {
"command": "python",
"args": ["-m", "src.server"],
"cwd": "/path/to/gcm-mcp-server",
"env": {
"GCM_HOST": "your-gcm-host",
"GCM_USERNAME": "your-username",
"GCM_PASSWORD": "your-password",
"GCM_CLIENT_SECRET": "your-client-secret"
}
}
}
}Note: Replace /path/to/gcm-mcp-server with the actual path to this project directory.
Before starting the server, ensure your .env file is configured with the required variables:
# Required
GCM_HOST=your-gcm-hostname
GCM_USERNAME=your-username
GCM_PASSWORD=your-password
GCM_CLIENT_SECRET=your-client-secret
# Optional (with defaults)
GCM_API_PORT=31443
GCM_KEYCLOAK_PORT=30443
GCM_CLIENT_ID=gcmclient
GCM_AUTH_MODE=auto
GCM_VERIFY_SSL=false
GCM_REQUEST_TIMEOUT=30
GCM_MCP_KEY_STORE_PATH=/data/keys.json
GCM_LOG_LEVEL=INFOcurl http://localhost:8002/admin/keyscurl -X DELETE http://localhost:8002/admin/keys/{key_prefix}Note: Admin endpoints are only accessible from localhost for security.
Check if the server is running:
curl http://localhost:8002/healthExpected response:
{
"status": "ok",
"server": "GCM MCP Server",
"version": "1.0.0",
"transport": "sse",
"auth_required": true,
"active_keys": 1,
"services": ["usermanagement", "tde", "assetinventory", ...]
}The GCM MCP Server provides three main tools:
- gcm_auth - Authentication and session management
- gcm_api - Execute any GCM API operation
- gcm_discover - Discover available services and endpoints
- Verify the server is running:
curl http://localhost:8002/health - Check firewall settings if connecting remotely
- Ensure the API key is valid and properly formatted in the Authorization header
- Verify environment variables are set correctly in
.env - Check GCM server connectivity:
curl -k https://{GCM_HOST}:{GCM_API_PORT}/health - Review server logs for authentication errors
- Ensure you're generating keys from localhost
- Verify the key hasn't been revoked:
curl http://localhost:8002/admin/keys - Check that the Authorization header format is correct:
Bearer {your-key}
- API keys are stored as SHA-256 hashes in the key store
- Admin endpoints (key generation/revocation) are restricted to localhost
- The
.envfile is git-ignored to prevent credential leakage - Use
GCM_VERIFY_SSL=truein production environments
/gcmapp in the prompts, that I use in IBM Bob as a preconfigured command
/gcmmcp authenticate to GCM
/gcmmcp check authentication status
/gcmmcp logout from GCM
/gcmmcp discover available services
/gcmmcp show all endpoints for usermanagement service
/gcmmcp search for endpoints related to "certificate"
/gcmmcp get the complete API schema
/gcmmcp list all users
/gcmmcp get details for user with ID {userId}
/gcmmcp create a new user with username "testuser"
/gcmmcp update user {userId} with new email
/gcmmcp delete user {userId}
/gcmmcp list user roles
/gcmmcp get system version information
/gcmmcp list all certificates
/gcmmcp get certificate details for asset {assetId}
/gcmmcp list certificates expiring in the next 30 days
/gcmmcp show certificates with RSA keys smaller than 2048 bits
/gcmmcp list certificates using weak signature algorithms
/gcmmcp get certificate inventory with all columns
/gcmmcp list all cryptographic keys
/gcmmcp get key details for asset {assetId}
/gcmmcp list symmetric keys
/gcmmcp list asymmetric keys
/gcmmcp show keys that are not quantum-safe
/gcmmcp list RSA keys with length less than 2048 bits
/gcmmcp get crypto posture dashboard
/gcmmcp show cryptographic asset inventory
/gcmmcp get certificate statistics
/gcmmcp show key usage statistics
/gcmmcp analyze protocol usage across assets
/gcmmcp get compliance posture management dashboard
/gcmmcp show policy violations dashboard
/gcmmcp list all policy violations
/gcmmcp get compliance controls
/gcmmcp show NIST compliance status
/gcmmcp list high-severity violations
/gcmmcp list all policies
/gcmmcp get policy details for {policyId}
/gcmmcp show active policies
/gcmmcp list policies by severity
/gcmmcp get PQC-related policies
/gcmmcp show policies with violations
/gcmmcp list OOTB (out-of-the-box) policies
/gcmmcp create a new policy for expired certificates
/gcmmcp update policy {policyId} with new threshold
/gcmmcp enable policy {policyId}
/gcmmcp disable policy {policyId}
/gcmmcp delete policy {policyId}
/gcmmcp list all violations
/gcmmcp get violations for entity {entityId}
/gcmmcp show violations by policy name
/gcmmcp list violations sorted by severity
/gcmmcp get violation details with ticket information
/gcmmcp show violations for expired certificates
/gcmmcp create a ticket for violation {violationId}
/gcmmcp update ticket status to "resolved"
/gcmmcp list open tickets
/gcmmcp get ticket history for {ticketId}
/gcmmcp discover assets in the environment
/gcmmcp scan for new certificates
/gcmmcp list discovered assets
/gcmmcp get discovery job status
/gcmmcp show asset discovery history
/gcmmcp get TDE client inventory
/gcmmcp list TDE clients
/gcmmcp get TDE client details for {clientId}
/gcmmcp show TDE key usage
/gcmmcp list TDE policies
/gcmmcp list notification configurations
/gcmmcp get notification settings
/gcmmcp create email notification for policy violations
/gcmmcp update notification preferences
/gcmmcp list configured integrations
/gcmmcp get SIEM integration status
/gcmmcp configure webhook for alerts
/gcmmcp get audit logs
/gcmmcp list audit events for user {userId}
/gcmmcp show audit trail for policy changes
/gcmmcp get compliance audit report
/gcmmcp list security events
/gcmmcp get system configuration
/gcmmcp show all configuration settings
/gcmmcp update configuration parameter
/gcmmcp get system health status
/gcmmcp list system components
/gcmmcp get CLM configuration
/gcmmcp list certificate lifecycle policies
/gcmmcp show certificate renewal settings
/gcmmcp get certificate expiration alerts
/gcmmcp analyze post-quantum cryptography readiness
/gcmmcp identify all assets using deprecated protocols
/gcmmcp show compliance gaps by NIST control
/gcmmcp generate risk assessment report
/gcmmcp list all non-compliant assets with remediation steps
/gcmmcp get all certificates, keys, and protocols for domain example.com
/gcmmcp show complete security posture for business unit "Finance"
/gcmmcp generate comprehensive compliance report
/gcmmcp list all high-severity issues across all categories
/gcmmcp identify expired certificates and their impact
/gcmmcp list all assets using SSL 2.0, SSL 3.0, or TLS 1.0
/gcmmcp show certificates with weak signature algorithms (MD5, SHA-1)
/gcmmcp find keys smaller than recommended size
/gcmmcp analyze cipher suite compliance
/gcmmcp generate NIST compliance report
/gcmmcp show PCI-DSS compliance status
/gcmmcp list all policy violations by severity
/gcmmcp get compliance score by control category
/gcmmcp show remediation timeline for all violations
/gcmmcp list certificates expiring in next 7 days
/gcmmcp show recently created policies
/gcmmcp get violation trends over last 30 days
/gcmmcp list assets requiring immediate attention
/gcmmcp show certificate renewal queue
# Start with discovery
/gcmmcp discover available services
# Check authentication
/gcmmcp check authentication status
# Get overview
/gcmmcp get crypto posture dashboard
# Deep dive into issues
/gcmmcp list all violations
/gcmmcp get policy details for violated policies
# Generate reports
/gcmmcp get compliance posture management dashboard
/gcmmcp list certificates with page size 50 sorted by expiration date
/gcmmcp get violations filtered by severity "HIGH"
/gcmmcp show policies where type is "CERTIFICATE_CERTIFICATE"
/gcmmcp list keys filtered by algorithm "RSA"
# Multi-step analysis
1. /gcmmcp get crypto posture dashboard
2. /gcmmcp list all violations
3. /gcmmcp get policy details for top violated policies
4. /gcmmcp generate remediation plan
# Compliance workflow
1. /gcmmcp get compliance controls
2. /gcmmcp show policy violations dashboard
3. /gcmmcp list violations by NIST control
4. /gcmmcp create tickets for high-severity violations
/gcmmcp get crypto posture dashboard
/gcmmcp list all violations
/gcmmcp show high-severity policy violations
/gcmmcp identify expired certificates
/gcmmcp get compliance posture management dashboard
/gcmmcp list all policies
/gcmmcp show NIST compliance controls
/gcmmcp generate compliance report
/gcmmcp list all certificates
/gcmmcp show certificates expiring soon
/gcmmcp get TDE client inventory
/gcmmcp list system configuration
/gcmmcp get audit logs
/gcmmcp show policy compliance status
/gcmmcp list all violations with tickets
/gcmmcp generate comprehensive audit report
service: "usermanagement", operation: "users.list"
service: "assetinventory", operation: "assets.list_certificates"
service: "policyrisk", operation: "violations.dashboard"
service: "policy", operation: "policies.list"
service: "tde", operation: "clients.inventory"
method: "GET", endpoint: "/ibm/usermanagement/api/v1/users"
method: "POST", endpoint: "/ibm/gemassetinventory/api/v1/assets/list-certificates"
method: "GET", endpoint: "/ibm/gempolicyengine/api/v1/violations/dashboards/policy-violations"
- Authenticate to GCM
- Discover available services
- List certificates and keys
- View crypto posture dashboard
- List and analyze policy violations
- Get compliance controls
- Create and manage policies
- Generate compliance reports
- Perform complex security assessments
- Automate compliance workflows
- Integrate with external systems
- Build custom dashboards and reports
Note: Replace {userId}, {assetId}, {policyId}, etc. with actual IDs from your GCM environment.