@Ztechlab/ Server Yubikey

MCP server that exposes YubiKey management tools to AI agents via the ykman CLI.

Read-only. No writes, no resets, no destructive operations.

Prerequisites

• YubiKey Manager CLI (ykman) installed and on PATH
• A YubiKey connected via USB
• Node.js 18+

Install

npm install -g @ztechlab/mcp-server-yubikey

Configuration

Claude Code

Add to your .mcp.json:

{
  "mcpServers": {
    "yubikey": {
      "command": "mcp-server-yubikey"
    }
  }
}

Claude Desktop

Add to your Claude Desktop config (claude_desktop_config.json):

{
  "mcpServers": {
    "yubikey": {
      "command": "npx",
      "args": ["-y", "@ztechlab/mcp-server-yubikey"]
    }
  }
}

Custom ykman path

If ykman is not on PATH, set the YKMAN_PATH environment variable:

{
  "mcpServers": {
    "yubikey": {
      "command": "mcp-server-yubikey",
      "env": {
        "YKMAN_PATH": "C:/Program Files/Yubico/YubiKey Manager CLI/ykman.exe"
      }
    }
  }
}

Tools

All tools are read-only. Tools that accept a serial parameter will use the only connected key if omitted.

Tool	Description
yubikey-list	List all connected YubiKeys with serial numbers
yubikey-info	Device details: serial, firmware, model, interfaces, enabled applications
yubikey-otp-info	OTP slot configuration (Slot 1 and Slot 2 status)
yubikey-fido-info	FIDO2 applet status: PIN set, credentials stored, remaining retries
yubikey-fido-credentials	List FIDO2 resident credentials (passkeys). Requires PIN.
yubikey-fido-fingerprints	List enrolled fingerprints (YubiKey Bio). Requires PIN.
yubikey-piv-info	PIV application status: management key type, PIN/PUK retries, certificate slots
yubikey-piv-keys-info	PIV key metadata for a specific slot (9a, 9c, 9d, 9e)
yubikey-openpgp-info	OpenPGP application status: key slots, touch policies, signature count
yubikey-openpgp-keys-info	OpenPGP key slot metadata (sig, enc, aut, att)

Examples

Once configured, ask your AI agent:

• "What YubiKey is plugged in?"
• "Show me the FIDO2 status on my YubiKey"
• "What PIV certificates are on this key?"
• "List the OTP slot configuration"

License

MIT