@ztechlab/mcp-server-yubikey

MCP server that exposes YubiKey management tools to AI agents via the ykman CLI.

Read-only. No writes, no resets, no destructive operations.

Prerequisites

• YubiKey Manager CLI (ykman) installed and on PATH
• A YubiKey connected via USB
• Node.js 18+

Install

npm install -g @ztechlab/mcp-server-yubikey

Configuration

Claude Code

Add to your .mcp.json:

{
  "mcpServers": {
    "yubikey": {
      "command": "mcp-server-yubikey"
    }
  }
}

Claude Desktop

Add to your Claude Desktop config (claude_desktop_config.json):

{
  "mcpServers": {
    "yubikey": {
      "command": "npx",
      "args": ["-y", "@ztechlab/mcp-server-yubikey"]
    }
  }
}

Custom ykman path

If ykman is not on PATH, set the YKMAN_PATH environment variable:

{
  "mcpServers": {
    "yubikey": {
      "command": "mcp-server-yubikey",
      "env": {
        "YKMAN_PATH": "C:/Program Files/Yubico/YubiKey Manager CLI/ykman.exe"
      }
    }
  }
}

Tools

All tools are read-only. Tools that accept a serial parameter will use the only connected key if omitted.

Examples

Once configured, ask your AI agent:

• "What YubiKey is plugged in?"
• "Show me the FIDO2 status on my YubiKey"
• "What PIV certificates are on this key?"
• "List the OTP slot configuration"

License

MIT