# AI Agents for Mainframe and IBM i Screens (MCP)

Source: https://wndsoftware.com/ai-agents

### AI agents that work mainframe screens under IT’s rules

WND Terminal gives Claude, Copilot Studio, n8n and other MCP clients the tools to read 3270 and 5250 screens, type, press keys and run your tested procedures. Agents are read-only until IT says otherwise.

Model Context Protocol
wnd-mcp on the desktop
/mcp on your gateway
Read-only by default
Every action audited
WND Terminal has an MCP server that lets an AI agent work mainframe (3270) and IBM i (5250) sessions the way a person does. On the desktop it’s `wnd-mcp`, installed with the app, and it works the sessions open in WND Terminal on the same computer. In WND Terminal in a browser it’s `/mcp` on your gateway, for agents that run in the cloud. Agents are read-only by default, sensitive values are masked before the agent sees them, and every action is in the audit log.


### The same screens your people use, as tools


#### Read the screen

Numbered rows, the cursor, and each input field with its label.


#### Type and press keys

Typing is held until the agent presses a key. Then the key and everything typed for it are judged by IT’s rules.


#### Run your flows

Procedures someone who knows the screen wrote and tested, with typed inputs and named outputs.


#### Look up codes

What an abend, CICS abend, TSO message, SQLCODE or IBM i message means, from the reference built into WND Terminal.


#### Open and close sessions

Only the saved connections IT lists, and only two at once unless IT allows more.


#### Wait for the host

For a piece of text, or for the host to free the keyboard.


### Your rules hold whatever the agent decides

These apply in every mode, on the desktop and on the gateway.

On a small screen, swipe the table to read all columns.


| Guardrail | What it does |
| --- | --- |
| Read-only by default | A change is refused and the agent is told why. A command counts as read-only only if it’s on the list of known read-only commands, such as LISTCAT, SDSF ST or DSPJOBLOG. Typing into a data field is a change. |
| A person approves changes | In `ask` mode the desktop shows the person at the computer what the agent wants to type and press, with Allow once  and Don’t allow . On the gateway, people in the approvers group decide on the Approvals  page. No answer in five minutes is no. |
| Password fields | Never typed into. Their contents are blank to the agent. |
| Masking | Card numbers, Social Security numbers, e-mail addresses, long account numbers, passwords in commands and your MaskPatterns  become tokens such as `[CARD 1]`. The agent can’t type a token back. |
| Connections | Only those IT lists in AgentConnections . A service account on the gateway opens only its own list. |
| Limits | Two sessions at once and 60 keys a minute, unless IT sets AgentMaxSessions  and AgentKeysPerMinute . |
| Audit log | Every tool call, refusal, approval, denial and flow is an event. The screen’s text never is. |
| Recording | Every session an agent opens through the gateway is recorded, whatever the recording policy says, and shows in the person’s Your open sessions  with an AI agent  badge. |
| Off switch | AllowAgents  = false turns agents off. So does AllowAutomation  = false. |


### A few lines of configuration


#### On the desktop

Add `wnd-mcp` to Claude Desktop’s configuration (Settings, Developer, Edit Config). Claude Code, Cursor and VS Code take the same entry in their own MCP settings. Keep WND Terminal open, since `wnd-mcp` works its sessions.


```text
{
  "mcpServers": {
    "wnd-terminal": { "command": "C:\\Program Files\\WND Terminal\\wnd-mcp.exe" }
  }
}
```


#### On the gateway

Turn the server on in the gateway’s configuration. Agents connect to `https://<gateway>/mcp` with a person’s sign-in token or a service account’s token. With `mode = "ask"`, changes wait on the Approvals page.


```text
[mcp]
enabled = true
mode = "ask"
approvers_group = "WND Approvers"
```

Every setting is in the [AI agents docs](https://wndsoftware.com/docs/mcp).


### Your tested procedures, as tools

Read-only rules stop an agent typing a customer number into an inquiry screen, because it can’t know that field only searches. A flow says so, once, written by someone who knows the screen.

- A flow is a WND Terminal macro with a header. The agent sees it as a tool with checked inputs, such as an 8-digit customer number.
- Flows marked `writes: no` run in every mode, and each key in them is still checked.
- Flows that write follow the same approval rules as any other change.
- What a flow reads back is masked like everything else.


```text
#! name: customer-lookup
#! description: Looks up a customer by their 8-digit number.
#! input customer "The 8-digit customer number" pattern [0-9]{8}
#! output status "ACTIVE, CLOSED or HOLD"
#! writes: no
wait "CUSTOMER INQUIRY"
move 6 18
type {customer}
press Enter
wait "STATUS:"
read status 9 10 10
```


### Agents on a PC or in the cloud


#### wnd-mcp on the desktop

- Installed with WND Terminal on Windows, Mac and Linux
- Works the sessions open in WND Terminal on the same computer
- The person at the computer approves changes in `ask` mode
- Sessions are recorded as your RecordSessions policy says


#### /mcp on the gateway

- For Claude, Copilot Studio, UiPath, n8n and other agents in the cloud
- Works as the signed-in person, or as a service account with its own connections
- Approvers decide on the Approvals page
- Every agent session is recorded, and a person can attach to watch or take over


### Try an agent on a recording first

Record a person doing the task once. In sandbox mode every session the agent opens plays that recording, and nothing reaches a real host.

[How the replay host works →](https://wndsoftware.com/docs/replay-host)
- The right keys move through the recording.
- A wrong key shows the same screen with a line such as `REPLAY: expected PF3, got Enter`.
- On the gateway, `sandbox_only` keeps every agent, or only some service accounts, in the sandbox.


### Questions about AI agents


#### Which AI agents work with WND Terminal?

Any MCP client. On the desktop that includes Claude Desktop, Claude Code, Cursor, VS Code and LangChain. Agents that run in the cloud, such as Claude, Copilot Studio, UiPath and n8n, connect to /mcp on your gateway over HTTP.


#### Can an agent change data on the host?

Not by default. Agents are read-only unless IT sets AgentActionsMode to ask or allow. In ask mode a person approves each change, and no answer in five minutes is no.


#### Does the agent see card numbers or passwords?

No. Card numbers, Social Security numbers, e-mail addresses, long account numbers and your MaskPatterns become tokens such as [CARD 1] before the agent sees the screen. Password fields are never typed into, and their contents are blank to the agent.


#### Who does an agent on the gateway work for?

Either a person or a service account. With a person’s token the agent works as that person, sees their sessions and is in the audit log under their name. A service account opens only the connections IT gives it.


#### How is this different from Ask WND?

Ask WND is the AI built into WND Terminal, for the person at the keyboard. The MCP server lets your own agents work sessions, judged by the same rules as Ask WND.


### Works well with

[Ask WND AI works your session to find the answer Learn more →](https://wndsoftware.com/ask-wnd)
[AI agents docs Every tool, rule and setting Learn more →](https://wndsoftware.com/docs/mcp)
[Session recording Tamper-evident recordings in your storage Learn more →](https://wndsoftware.com/session-recording)

### Where the MCP server runs

wndsoftware.com is the marketing and documentation site. It does not host a public MCP endpoint. Install the local `wnd-mcp` server with WND Terminal, or connect to the MCP endpoint on the gateway your organization operates. Your administrator supplies that gateway address and access settings.

[MCP setup and transport details](https://wndsoftware.com/docs/mcp)