What the IBM i MCP server is: An agent that queries Db2

The Model Context Protocol is the standard by which a language model calls external tools: instead of merely producing text, the agent can query a database, read a file, perform an operation. IBM has published an MCP server for IBM i, open source under the Apache 2.0 licence, exposing Db2 for i as a set of SQL tools.

The repository declares it stable. The project was announced in beta in October 2025.

What it actually does

Not "give artificial intelligence to the AS/400". It does something narrower and more useful to understand: it lets an agent run queries that you defined.

Tools are declared in YAML files — the source to connect to, the SQL statement, a description, the parameters. The agent does not write arbitrary SQL against your database: it calls one of the tools you made available, with the parameters that tool accepts.

That is the part that counts when weighing the risk. The surface is not "the whole database": it is the list of queries you wrote in YAML.

What it takes to run

• Mapepire on the IBM i, listening on port 8076. Not optional: it is the channel through which the server talks to the database. Installed with yum install mapepire-server.
• Node.js 18 or later, where the MCP server runs.
• An IBM i system with Db2 for i.

Mapepire deserves an extra line: it is a modern database server for IBM i exposing SQL query execution over WebSocket. It exists because ODBC is not designed for this kind of load — light connections, fast responses, many short calls.

Alongside the server there is also a command line tool, ibmi, using the same YAML-driven engine: handy for trying a tool out without involving an agent.

The question to ask before installing it

Which profile does it connect with?

Credentials sit in environment variables (DB2i_USER, DB2i_PASS) in a .env file. Which means the agent works with that profile's authority, and sees what that profile sees.

This is exactly the decision to take slowly, and the right answer is almost never "a profile with *ALLOBJ". A dedicated profile, with rights only on the files the YAML tools query, turns a potentially invasive component into something whose perimeter can be described in one line.

For a production installation the project provides for TLS, and authentication and rate limiting need considering.

A .env file is a file with a password in it. Everything that applies to any other place where a password is written in clear applies here: tight permissions, out of the backups that circulate, out of version control.

What you can realistically do with it

The things that work well are those where the effort lies in remembering the query, not in understanding it: how many orders yesterday, which jobs used most CPU overnight, how much space that library takes. Questions with a flat answer, asked by somebody who does not remember the query or cannot write it.

The things that work badly are those needing judgement. An agent summarising the state of the system produces convincing text even when it has misunderstood, and on a production system convincing wrong text is worse than no text.

Is it worth it now?

Depends what you are after. If the aim is to let people query the database who today open a ticket to have a query written for them, the technical piece is ready and the road is walkable. If the aim is to put an agent in charge of deciding something in production, the technical piece is ready just the same, but the question is no longer technical.

The sensible thing to do today is try it on a copy, with a profile that cannot do damage, and watch what happens when you ask it an ambiguous question.

Which versions this works on

The project does not declare a minimum IBM i release; the practical constraint is Mapepire, installed from the IBM i open source repositories. The MCP server requires Node.js 18 or later and can run on the IBM i itself or on another machine.

Sources

• IBM/ibmi-mcp-server — repository, Apache 2.0 licence
• IBM — Agentic AI on IBM i — official guide
• IBM — IBM i MCP Server