MetaEngine
NPM · @METAENGINE/MCP-SERVER · SCANNED SEP 22
Code generation from JSON recipes, linked type graphs, and API schemas across 11 languages.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 6 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability73
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 4230 tokens (~384/item across 11 items; 8 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the MetaEngine MCP server?
MetaEngine runs locally as an npm package, launched with npx -y @metaengine/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @metaengine/mcp-server
claude mcp add eu-metaengine-mcp-server -- npx -y @metaengine/mcp-server
{
"mcpServers": {
"eu-metaengine-mcp-server": {
"command": "npx",
"args": [
"-y",
"@metaengine/mcp-server"
]
}
}
} {
"servers": {
"eu-metaengine-mcp-server": {
"command": "npx",
"args": [
"-y",
"@metaengine/mcp-server"
]
}
}
} codex mcp add eu-metaengine-mcp-server -- npx -y @metaengine/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"eu-metaengine-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@metaengine/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add eu-metaengine-mcp-server --command npx --arg -y --arg @metaengine/mcp-server
mcp_servers:
eu-metaengine-mcp-server:
command: "npx"
args: ["-y", "@metaengine/mcp-server"] {
"McpServers": {
"eu-metaengine-mcp-server": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@metaengine/mcp-server"
]
}
}
} assistant mcp add eu-metaengine-mcp-server -t stdio -c npx -a -y @metaengine/mcp-server
{
"mcpServers": {
"eu-metaengine-mcp-server": {
"command": "npx",
"args": [
"-y",
"@metaengine/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 22 Sept 26 +1
- Stability: 0.97 → pass security
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +12
- Malware scan: unverified → pass ▲ security
- Stability: pass → 0.80 functional
- 15 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- Stability: 0.97 → pass security
- Schema quality: 678 → 384 ▲ functional
- Package version: 1.4.1 → 1.5.0 functional
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 22 Sept 2026 · Analysed npm/@metaengine/mcp-server@1.5.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
generate_code Generate Multi-Language Code ~1,818
Generate source files from a structured type graph for TypeScript, Python, Go, C#, Java, Kotlin, Groovy, Scala, Swift, PHP, and Rust. Use explicit templateRefs to link target-language customCode to generated types and imports. For compact field maps and repeated patterns, use generate_from_recipe. # MetaEngine MCP — generation guide MetaEngine generates source files from structured type definitions and target-language code. Type and model generation supports TypeScript, Python, Go, C#, Java, Kotlin, Groovy, Scala, Swift, PHP, and Rust. ## Choose a tool - `generate_from_recipe`: compact property maps, explicit references, reusable parameter templates, and local JSON data rows. Start with [RECIPES.md](./RECIPES.md), also available as `metaengine://guide/recipes`. - `generate_code`: the existing complete native JSON payload. - `load_spec_from_file`: the same native payload read from a local file. - `generate_openapi`, `generate_graphql`, `generate_protobuf`, `generate_sql`: convert an existing schema using their tool-specific options. The three type-graph tools share the hosted generation API and local file writer. `dryRun` previews source without writing it; `skipExisting` defaults to true. The hosted request limit is 250 counted types, with the existing counting rule documented in the recipe guide. ## References and batch boundaries Generate related types together. IDs resolve within a single request. A class or interface declares `typeIdentifier`; a property refers to it with the same field. Recipes also accept the compact aliases `id` on definitions and `ref` on map properties. Use `templateRefs` wherever target-language text refers to an internal type: ```json { "code": "read(): Promise<$item>;", "templateRefs": [{ "placeholder": "$item", "typeIdentifier": "item" }] } ``` The reference resolves the type name and supports import generation. Merely writing an internal type's name in a raw code string does not create a graph reference. `templateRefs` a…
| Name | Type | Req | Description |
|---|---|---|---|
| arrayTypes | array | – | Array type definitions - creates IArrayType references (NO files generated). Use for reusable array definitions. |
| classes | array | – | Class definitions (regular and generic class templates) |
| concreteGenericClasses | array | – | Concrete generic implementations (Repository<User>) - creates inline type references, NO files generated |
| concreteGenericInterfaces | array | – | Concrete generic interface implementations (IRepository<User>) - creates inline type references, NO files generated |
| customFiles | array | – | Custom files (utility files, type aliases, barrel exports) - generates files WITHOUT class wrapper. Perfect for type aliases and utility functions. |
| dictionaryTypes | array | – | Dictionary type definitions - creates IDictionaryType references (NO files generated). Supports all 4 combinations of primitive/custom for key/value. |
| dryRun | boolean | – | Preview mode - returns generated code without writing files to disk. When true, file contents are returned in the response for review. |
| enums | array | – | Enum definitions |
| initialize | boolean | – | Whether to initialize properties with default values |
| interfaces | array | – | Interface definitions (regular and generic interface templates) |
| language | string | yes | Target programming language |
| outputPath | string | – | Output directory path where files will be written. Defaults to current directory. |
| packageName | string | – | Package/module/namespace name for generated code. Defaults depend on language: Go='github.com/metaengine/demo', Java/Kotlin/Groovy='com.metaengine.generated'. For C#: when omitted or empty, no namesp… |
| skipEnumMembersValidation | boolean | – | Skip enum member validation in the generation engine. |
| skipExisting | boolean | – | Skip writing files that already exist (useful for stub pattern). When true, only new files are created. |
| typeScriptOptions | object | – | TypeScript-only rendering options. Omit for legacy extensionless relative imports. |
No output schema declared.
No examples provided.
generate_from_recipe Generate from a JSON Recipe ~328
Expand a compact, versioned JSON recipe locally into the existing generation payload, then generate through the MetaEngine API. Use field maps, explicit type references, and named templates with parameter rows to describe repeated structures. Target-language customCode and templateRefs retain the existing type graph and import resolution. Recipe expansion executes no scripts. Supply exactly one of recipe or recipeFilePath. Validation and expansion finish before any API request or generated-file write.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | – | Return generated source without writing files; hosted generation still occurs. |
| outputPath | string | – | Output directory override, relative to the MCP server working directory. |
| recipe | object | – | Version 1 recipe. Compact properties: {id: 'string', 'note?': 'string', owner: {ref: 'user'}}. Definitions use id (defaults to name) or native typeIdentifier. Other native spec fields, including cust… |
| recipeFilePath | string | – | Local recipe JSON file. Relative input paths resolve against this file's directory. |
| skipExisting | boolean | – | Skip existing files; defaults to true. |
No output schema declared.
No examples provided.
generate_graphql Generate HTTP Client from GraphQL ~438
Generates a fully typed HTTP client from a GraphQL SDL schema. Supports Angular, React, TypeScript Fetch, Go, Java Spring, C#, Kotlin, Python, Rust, and Swift. Enable `fragments` to emit reusable named GraphQL fragments for object-type selections.
| Name | Type | Req | Description |
|---|---|---|---|
| angularOptions | object | – | Angular-specific options |
| basicAuth | object | – | Basic authentication configuration |
| bearerAuth | object | – | Bearer authentication configuration |
| csharpOptions | object | – | C#-specific options |
| customHeaders | array | – | Custom HTTP headers |
| customScalars | object | – | Map GraphQL custom scalars to target-language types (e.g. {DateTime: 'Date', UUID: 'string'}). Keys are scalar names, values are target-language type names. |
| documentation | boolean | – | Generate documentation comments from schema descriptions |
| dryRun | boolean | – | Preview mode - returns generated code without writing files to disk |
| errorHandling | object | – | Error handling configuration |
| fetchOptions | object | – | TypeScript Fetch-specific options |
| fragments | boolean | – | Emit reusable named GraphQL fragments for object-type selections. Selections reference fragment spreads (`...TypeFields`) and fragment definitions are hoisted into a separate fragments file. Off by d… |
| framework | string | yes | Target framework for code generation |
| goOptions | object | – | Go-specific options |
| graphQLSchema | string | yes | GraphQL SDL schema content |
| javaSpringOptions | object | – | Java Spring-specific options |
| kotlinOptions | object | – | Kotlin-specific options |
| optionsObjectThreshold | number | – | Min params before grouping into options object |
| outputPath | string | – | Output directory path where files will be written |
| pythonOptions | object | – | Python-specific options |
| reactOptions | object | – | React-specific options |
| retries | object | – | Retry configuration |
| rustOptions | object | – | Rust-specific options |
| skipExisting | boolean | – | Skip writing files that already exist |
| swiftOptions | object | – | Swift-specific options |
| timeout | object | – | Timeout configuration |
No output schema declared.
No examples provided.
generate_openapi Generate HTTP Client from OpenAPI ~541
Generate HTTP clients from OpenAPI specifications for 10 frameworks: Angular, React, TypeScript Fetch, Go net/http, Java Spring, Python httpx, C# HttpClient, Kotlin Ktor, Rust Reqwest, Swift URLSession. Provide an inline OpenAPI spec (YAML/JSON) or a URL, choose a framework, and get fully typed, production-ready HTTP client code with models, services, and error handling.
| Name | Type | Req | Description |
|---|---|---|---|
| angularOptions | object | – | Options for Angular framework (only when framework=angular) |
| basicAuth | object | – | Basic authentication configuration |
| bearerAuth | object | – | Bearer authentication configuration |
| csharpOptions | object | – | Options for C# HttpClient (namespaceName required) |
| customHeaders | array | – | Custom HTTP headers |
| documentation | boolean | – | Generate JSDoc/XML doc comments |
| dryRun | boolean | – | Preview mode - returns generated code without writing files |
| errorHandling | object | – | Error handling configuration |
| fetchOptions | object | – | Options for TypeScript Fetch |
| framework | string | yes | Target framework for HTTP client generation |
| goOptions | object | – | Options for Go net/http (moduleName and packageName required) |
| includeTags | array | – | Only generate operations whose service tag matches one of these values (case-insensitive). |
| javaSpringOptions | object | – | Options for Java Spring (packageName required) |
| kotlinOptions | object | – | Options for Kotlin Ktor (packageName required) |
| openApiSpec | string | – | Inline OpenAPI spec content (YAML or JSON). Either this or openApiSpecUrl is required. |
| openApiSpecUrl | string | – | URL to fetch the OpenAPI spec from. Either this or openApiSpec is required. |
| optionsObjectThreshold | number | – | Min params before grouping into options object |
| outputPath | string | – | Output directory path where files will be written |
| pythonOptions | object | – | Options for Python httpx |
| reactOptions | object | – | Options for React framework |
| retries | object | – | Retry configuration |
| rustOptions | object | – | Options for Rust Reqwest |
| skipExisting | boolean | – | Skip writing files that already exist |
| strictValidation | boolean | – | Enable strict OpenAPI spec validation |
| swiftOptions | object | – | Options for Swift URLSession |
| timeout | object | – | Timeout configuration |
| typeMappings | object | – | Override how spec types are emitted in code (e.g. {decimal: 'string'} to keep precision in JS). Keys are spec type names, values are target-language type names. |
No output schema declared.
No examples provided.
generate_protobuf Generate HTTP Client from Protobuf ~337
Generates a fully typed HTTP client from Protocol Buffers (.proto) definitions. Supports Angular, React, TypeScript Fetch, Go, Java Spring, C#, Kotlin, Python, Rust, and Swift.
| Name | Type | Req | Description |
|---|---|---|---|
| angularOptions | object | – | Angular-specific options |
| basicAuth | object | – | Basic authentication configuration |
| bearerAuth | object | – | Bearer authentication configuration |
| csharpOptions | object | – | C#-specific options |
| customHeaders | array | – | Custom HTTP headers |
| documentation | boolean | – | Generate documentation comments from proto comments |
| dryRun | boolean | – | Preview mode - returns generated code without writing files to disk |
| errorHandling | object | – | Error handling configuration |
| fetchOptions | object | – | TypeScript Fetch-specific options |
| framework | string | yes | Target framework for code generation |
| goOptions | object | – | Go-specific options |
| javaSpringOptions | object | – | Java Spring-specific options |
| kotlinOptions | object | – | Kotlin-specific options |
| optionsObjectThreshold | number | – | Min params before grouping into options object |
| outputPath | string | – | Output directory path where files will be written |
| protoSource | string | yes | Protocol Buffers (.proto) definition content |
| pythonOptions | object | – | Python httpx-specific options |
| reactOptions | object | – | React-specific options |
| retries | object | – | Retry configuration |
| rustOptions | object | – | Rust-specific options |
| skipExisting | boolean | – | Skip writing files that already exist |
| swiftOptions | object | – | Swift-specific options |
| timeout | object | – | Timeout configuration |
No output schema declared.
No examples provided.
generate_sql Generate Models from SQL DDL ~438
Generates typed model classes from SQL DDL (CREATE TABLE statements). Supports TypeScript, C#, Go, Python, Java, Kotlin, Groovy, Scala, Swift, PHP, and Rust.
| Name | Type | Req | Description |
|---|---|---|---|
| csharpOptions | object | – | C#-specific options |
| ddlSource | string | yes | SQL DDL source code (CREATE TABLE statements) |
| dryRun | boolean | – | Preview mode - returns generated code without writing files to disk |
| generateInterfaces | boolean | – | Emit interface-style output (interface/protocol/trait) instead of the default modern-idiomatic concrete shape (record/data class/case class/struct). |
| generateNavigationProperties | boolean | – | Generate navigation properties for foreign key relationships |
| generateValidationAnnotations | boolean | – | Generate validation annotations from column constraints |
| goOptions | object | – | Go-specific options |
| groovyOptions | object | – | Groovy-specific options |
| initializeProperties | boolean | – | Initialize model properties with default values |
| javaOptions | object | – | Java-specific options |
| jsonAs | string | – | How JSON columns are typed: e.g. 'string' (raw), 'object' (parsed). Language-specific defaults apply if omitted. |
| kotlinOptions | object | – | Kotlin-specific options |
| language | string | yes | Target programming language |
| outputPath | string | – | Output directory path where files will be written |
| phpOptions | object | – | PHP-specific options |
| precisionSafeDecimals | boolean | – | Emit decimal/numeric columns as precision-safe types (e.g. string in JS) instead of float, preserving full precision. |
| pythonOptions | object | – | Python-specific options |
| rustOptions | object | – | Rust-specific options |
| scalaOptions | object | – | Scala-specific options |
| schemaPrefix | string | – | Prepend the SQL schema name to generated type names (e.g. 'Auth_User' instead of 'User'). |
| singularTypeNames | boolean | – | Singularize plural table names when emitting type names (e.g. table 'users' becomes type 'User'). |
| skipExisting | boolean | – | Skip writing files that already exist |
No output schema declared.
No examples provided.
load_spec_from_file Load Code Spec from File ~153
Read an existing generate_code JSON payload from a local file and run the same generation flow. Use generate_from_recipe for compact field maps and reusable JSON templates. outputPath, skipExisting, and dryRun arguments override values in the file.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | – | Preview mode - returns generated code without writing files. Overrides dryRun in spec file if provided. |
| outputPath | string | – | Output directory path where files will be written. Overrides outputPath in spec file if provided. |
| skipExisting | boolean | – | Skip writing files that already exist. Overrides skipExisting in spec file if provided. |
| specFilePath | string | yes | Path to the JSON spec file (absolute or relative to current directory) |
No output schema declared.
No examples provided.
metaengine_initialize Get Documentation & Patterns ~113
Returns essential MetaEngine patterns and documentation resources. This helper tool provides AI assistants with critical MetaEngine concepts: - The fundamental principle of generating related types in ONE call - Properties vs customCode distinction - Template references and type referencing patterns - Language-specific best practices Returns links to comprehensive documentation with patterns and examples. Call this when you need guidance or are generating code for the first time.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | – | Optional: The primary language you'll be generating code for. If specified, returns language-specific patterns. |
No output schema declared.
No examples provided.
What is the MetaEngine MCP server?
MetaEngine is an MCP server listed in the public MCP registry as eu.metaengine/mcp-server. Code generation from JSON recipes, linked type graphs, and API schemas across 11 languages. This page covers its npm package (@metaengine/mcp-server).
Is the MetaEngine MCP server safe to use?
MetaEngine scores 84 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 22 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the MetaEngine MCP server expose?
MetaEngine exposes 8 tools: generate_code, load_spec_from_file, generate_from_recipe, metaengine_initialize, generate_openapi, and 3 more. Their descriptions and schemas cost roughly 4,166 tokens of context every time the server is loaded.
Is the MetaEngine MCP server still maintained?
MetaEngine is still listed as active in the MCP registry. We last reached this channel on 22 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the MetaEngine MCP server under?
MetaEngine declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.