3keycompany/mcp-server repository overview

⁠ILM MCP Server

Model Context Protocol⁠ (MCP) server for the ILM⁠ platform. Exposes certificate and key management operations as AI-friendly tools, enabling LLMs and AI agents to interact with ILM through natural language.

Built with Spring AI MCP⁠ and Java 21.

⁠Features

• 22 read-only tools for certificates, cryptographic keys, infrastructure, secrets, and vaults
• Two transport modes: HTTP (Streamable HTTP) and STDIO
• Three authentication methods: client certificate, OAuth pass-through, OAuth client credentials
• AI-optimized responses: formatted text output designed for LLM consumption
• Lightweight Docker image: multi-stage build with custom JRE (jlink)

⁠Available Tools

⁠Search

⁠Certificates

⁠Cryptographic Keys

⁠Infrastructure

⁠Secrets (ILM platform 2.17+)

⁠Vaults (ILM platform 2.17+)

⁠Quick Start

⁠Prerequisites

• Java 21+
• Maven 3.9+
• Running ILM platform instance

⁠Build

mvn clean verify

⁠Run in STDIO Mode

STDIO mode is used for direct integration with MCP clients like Claude Desktop or Claude Code.

java -jar target/mcp-server-0.1.0-SNAPSHOT.jar --spring.profiles.active=stdio

⁠Run in HTTP Mode

HTTP mode exposes a Streamable HTTP endpoint for network-based MCP clients.

java -jar target/mcp-server-0.1.0-SNAPSHOT.jar --spring.profiles.active=http

The server starts on port 8080 by default.

⁠Configuration

⁠Environment Variables

⁠ILM API Connection

⁠Authentication

Client Certificate (ILM_AUTH_METHOD=certificate):

Configure the SSL bundle in application.yml or via Spring Boot SSL bundle properties.

OAuth Pass-through (ILM_AUTH_METHOD=oauth-passthrough):

No additional configuration needed. The server forwards the Bearer token from incoming HTTP requests to the ILM API. Only works in HTTP mode.

OAuth Client Credentials (ILM_AUTH_METHOD=oauth-client-credentials):

⁠Server

⁠Docker

⁠Build

docker build -t ilm-mcp-server .

⁠Run

docker run \
  -e ILM_API_URL=https://my-instance.example.com/api \
  -e ILM_AUTH_METHOD=oauth-client-credentials \
  -e ILM_OAUTH_CLIENT_ID=my-client \
  -e ILM_OAUTH_CLIENT_SECRET=my-secret \
  -e ILM_OAUTH_TOKEN_URL=https://auth.example.com/token \
  -p 8080:8080 \
  ilm-mcp-server

The Docker image runs in HTTP mode by default.

⁠MCP Client Configuration

⁠Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "ilm": {
      "command": "java",
      "args": [
        "-jar",
        "/path/to/mcp-server-0.1.0-SNAPSHOT.jar",
        "--spring.profiles.active=stdio"
      ],
      "env": {
        "ILM_API_URL": "https://my-instance.example.com/api",
        "ILM_AUTH_METHOD": "certificate"
      }
    }
  }
}

⁠Claude Code

Add to your .mcp.json:

{
  "mcpServers": {
    "ilm": {
      "command": "java",
      "args": [
        "-jar",
        "/path/to/mcp-server-0.1.0-SNAPSHOT.jar",
        "--spring.profiles.active=stdio"
      ],
      "env": {
        "ILM_API_URL": "https://my-instance.example.com/api",
        "ILM_AUTH_METHOD": "certificate"
      }
    }
  }
}

⁠Architecture

MCP Client (LLM) ──MCP──▶ MCP Tool (@Tool) ──▶ Service (formatting) ──▶ IlmApiClient (RestClient) ──▶ ILM API

• Tools (com.otilm.mcp.tool) — MCP tool definitions with @Tool annotations
• Services (com.otilm.mcp.service) — business logic and AI-friendly response formatting
• Client (com.otilm.mcp.client) — ILM API HTTP client using Spring RestClient
• Config (com.otilm.mcp.config) — Spring configuration and properties
• Security (com.otilm.mcp.security) — authentication token handling

⁠Development

⁠Run Tests

mvn test

Integration tests use WireMock⁠ to stub ILM API responses.

⁠Code Coverage

mvn verify
# Report at target/site/jacoco/index.html

⁠Tech Stack

• Java 21
• Spring Boot 3.5.13
• Spring AI 1.1.4
• CZERTAINLY Interfaces 2.17.0
• WireMock (testing)
• JaCoCo (coverage)

⁠License

This project is licensed under the MIT License - see the LICENSE.md⁠ file for details.