ibmz-mcp-server

The repository contains numerous hardcoded API keys and instance IDs within its demo scripts, which is a significant security risk as it can lead to accidental exposure or misuse if not properly managed. While the main server (`index.js`) correctly uses environment variables for sensitive configuration, the presence of hardcoded secrets in related files is a major concern. The `zos_connect_call_service` tool allows constructing arbitrary requests to a configurable mainframe URL; although path parameters are encoded and payloads are JSON stringified, this tool presents a potential Server-Side Request Forgery (SSRF) risk if `ZOS_CONNECT_URL` can point to internal networks, and a risk of exploiting vulnerabilities in target mainframe applications if Claude is prompted to craft malicious API calls.