Public portfolio project · 271+ tests · Org-ready

Diagnose IBM MQ in seconds.
Without hallucinations.

MQ-Sentinel is a read-only MCP server that gives Claude, Cursor, and Claude Code Root Cause + Recommended Fix Steps + IBM Knowledge Center citations for every IBM MQ deployment — Standalone, Multi-Instance, RDQM, Native HA + CRR, Uniform Cluster, z/OS QSG, Containerized.

Install in 5 minutes View on GitHub → Try the live demo

Built for

· Standalone · Multi-Instance · RDQM · Native HA + CRR · Uniform Cluster · Traditional Cluster · z/OS QSG · MQ Appliance · Containerized

A 2035 in your prod QM, diagnosed in one prompt

No alerts to triage. No grepping AMQERR logs. No paging the SME.

YOU, IN CLAUDE CODE

"Why is PROD_QM erroring?"

CLAUDE, 3 SECONDS LATER

Channel APP.SVRCONN is in RETRYING with reason 2035 (NOT_AUTHORIZED). Most likely cause: a CHLAUTH BLOCKUSER rule blocked the user, or the resolved MCAUSER lacks +connect / +inq on the QM.

To investigate, run:


            DISPLAY CHLAUTH('APP.SVRCONN') ALL

IBM doc: 2035 (07F3) MQRC_NOT_AUTHORIZED →

Eight diagnostic tools, all read-only

Every recommendation cites IBM Knowledge Center. The MCP itself never calls an LLM, never invents a fix, and cannot execute a destructive command — enforced by three layers of allowlist + the MQ service account's own permissions.

diagnose_failed_channels

2035 NOT_AUTHORIZED, 2009/2059 connection errors, INDOUBT, AMQ9202/9208/9503 from log tail.

analyze_dlq_and_suggest_reprocessing

Headers only — bodies never read. Grouped by reason 2035/2080/2030/2051/2053/2079, backout-loop detection.

check_cluster_health

Partial repository, stale CLUSQMGR, suspended members, unhealthy cluster channels.

diagnose_native_ha_issues

Replica state, quorum, log replay lag, split-brain, Cross-Region Replication lag.

diagnose_rdqm_issues

Pacemaker quorum + offline nodes + failed resources, DRBD per-peer state, split-brain.

diagnose_zos_qsg_issues

QSG members, CHIN, page sets, buffer pools, coupling facility structures.

diagnose_multi_instance_issues

Active/standby state, dual-active split-brain detection, failover events.

full_mq_health_check ★

Composite — channels + DLQ + cluster against a single connection. Executive summary, severity counts, top issues. The page that ships to PagerDuty.

Install in 5 minutes — pick your path

Same product, three packagings. Same security guarantees regardless of how you run it.

Solo / startup

Docker one-liner

curl -fsSL https://raw.githubusercontent.com/pramodreddyboddu/mq-sentinel/main/scripts/install.sh \
  | MQS_DEV_MODE=true \
    MQS_DEV_MODE_ACK_INSECURE=yes \
    bash

5 min · localhost only · refuses dev mode without explicit ack.

Mid-org · Recommended

Helm + OIDC

helm install mq-sentinel \
  oci://ghcr.io/pramodreddyboddu/charts/mq-sentinel \
  --set oidc.issuer=https://login.example.com/... \
  --set oidc.audience=mq-sentinel \
  --set oidc.jwksUrl=https://...

30 min · OIDC bearer auth · K8s-ready · worked example in examples/kind/.

Regulated / air-gapped

RPM / DEB

sudo dnf install \
  https://github.com/pramodreddyboddu/mq-sentinel/releases/latest/download/mq-sentinel-0.1.0-1.x86_64.rpm

sudo systemctl enable --now mq-sentinel

Bundled venv · hardened systemd · GPG-signable · air-gap friendly.

🍺 brew install pramodreddyboddu/tap/mq-sentinel

🐳 docker run -i --rm ghcr.io/pramodreddyboddu/mq-sentinel:latest serve

🔍 Discoverable on Smithery + the MCP Registry

Built for environments where mistakes get fired

Banks, healthcare, telcos. Read-only is enforced by code, not policy. Compliance teams approved this in two days.

READ-ONLY ENFORCED

Static MQSC + shell allowlist. DISPLAY / DIS / PING CHANNEL only. Three-layer defense: tool, connector, MQ-side setmqaut.

PROMPT-INJECTION FIREWALL

Every MQ-sourced string sanitized: control/zero-width/tag chars stripped, jailbreak markers redacted, URLs constrained to www.ibm.com.

HASH-CHAINED AUDIT

Append-only JSONL with SHA-256 chain. mq-sentinel verify-audit detects retroactive edits. SOX-evidence ready.

DLQ HEADERS ONLY

Message bodies are never read. Enforced by tests that scan the source code's own dataclass fields.

OIDC + RBAC

JWT bearer auth (RS256/384/512, ES256, PS256). Scopes: nonprod-read, prod-read, admin-audit. JWKS cached, stale-served on transient errors.

DISTROLESS · NON-ROOT

Read-only filesystem, dropped capabilities, seccomp profile, MemoryDenyWriteExecute. Cosign-signed images. CycloneDX SBOM per release.

NO LLM IN THE SERVER

The MCP itself never calls an LLM. Pattern-matched RCS only. Eliminates a whole class of injection-to-model-call attacks.

167 TESTS · STRICT MYPY

40+ security negative tests. pytest -m security must stay green or CI fails. Source of truth for every guarantee on this page.

Public Portfolio Project

Built as a serious engineering showcase

From a real enterprise pain point to a hardened, documented, org-ready MCP server — using Grok Build as the primary coding partner while maintaining strict standards.

7-PHASE ORG-READINESS

Threat model → security posture → production Helm/HPA → observability → OIDC/RBAC examples → compliance checklist → platform team guides. All public.

BUILT WITH GROK BUILD

Iterative development with xAI's Grok Build CLI/TUI. Architecture, implementation, docs, Helm, tests, marketing — all driven while keeping full engineering ownership and review.

WHAT IT PROVES

Systems & security engineering • Production operations • Safe AI infra for legacy systems • End-to-end delivery • Deep domain (IBM MQ) + modern MCP.

Read the full journey in the repo → docs/ORG-READINESS-PLAN.md

Try it without installing anything

A public read-only demo runs against sandboxed fixture QMs with seeded faults. Same code path as production. No credit card. No live MQ.

curl -H "Authorization: Bearer demo-readonly" \
     -H "Content-Type: application/json" \
     -d '{"tool":"full_mq_health_check","params":{"qm_name":"DEMO_QM"}}' \
     https://demo.mq-sentinel.io/mcp/tools/call \
| jq .summary

Or add the MCP to Claude Desktop and ask "What's wrong with DEMO_QM?"

Diagnose IBM MQ in seconds. Without hallucinations.