IBM Code Engine MCP Server
NPM · CODE-ENGINE-MCP-SERVER
Deploy to IBM Code Engine from Cursor, Copilot, Claude & Cline. Build, push, deploy via MCP.
Available components
Last scanned (12 hours ago)
Scores higher than 68% of npm servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 33 of 106 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 35 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability74
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 4603 tokens (~70/item across 65 items; 65 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage85
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 56% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 11 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "icr_delete_image" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 65 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (16)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 6 Nov 26 0
- Stability: 0.97 → pass security
- Security disclosure: unverified → fail ▼ functional
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 4 Nov 26 −1
- Stability: pass → 0.93 functional
- 2 Nov 26 0
- Security disclosure: fail → unverified ▼ functional
- 29 Oct 26 0
- Stability: 0.97 → pass security
- 28 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Oct 26 −1
- Stability: pass → 0.93 functional
- 17 Oct 26 +2
- Stability: 0.83 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 6 Nov 2026 · Analysed npm/code-engine-mcp-server@1.4.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 106 packages
| Packages resolved | 106 |
|---|---|
| Stale | 33 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
build_container_image ~64
Build a container image using Docker or Podman
| Name | Type | Req | Description |
|---|---|---|---|
| context_path | string | yes | Build context path |
| dockerfile_path | string | yes | Path to Dockerfile |
| image_name | string | yes | Image name with tag |
| runtime | string | – | Container runtime |
No output schema declared.
No examples provided.
ce_create_application ~240
Create a Code Engine application from a container image
| Name | Type | Req | Description |
|---|---|---|---|
| env_vars | object | – | Key/value environment variables |
| image | string | yes | Container image reference |
| image_secret | string | – | Registry secret name for pulling the image (e.g. icr-pull-secret) |
| name | string | yes | – |
| port | number | – | Container port (default 8080) |
| project_id | string | yes | – |
| run_args | array | – | Arguments passed to the container entrypoint (run_arguments). Required for supergateway: ["--stdio", "npx -y <mcp-server>", "--outputTransport", "sse"] |
| run_commands | array | – | Override the container entrypoint (run_commands). Rarely needed — use run_args for passing flags. |
| scale_cpu_limit | string | – | CPU limit (e.g. 1, 0.5) |
| scale_max_instances | number | – | Max instances (default 10) |
| scale_memory_limit | string | – | Memory limit (e.g. 4G, 2G) |
| scale_min_instances | number | – | Min instances (default 0) |
No output schema declared.
No examples provided.
ce_create_binding ~105
Create a service binding to connect an IBM Cloud service instance to a Code Engine component
| Name | Type | Req | Description |
|---|---|---|---|
| component_name | string | yes | Name of the CE app or job to bind the service to |
| component_resource_type | string | yes | Resource type of the component |
| prefix | string | – | Prefix for environment variable names injected into the component (optional) |
| project_id | string | yes | – |
| secret_name | string | yes | Name of the operator secret referencing the IBM Cloud service instance |
No output schema declared.
No examples provided.
ce_create_config_map ~46
Create a configmap in a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | Key/value configuration data |
| name | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_create_domain_mapping ~122
Map a custom domain to a Code Engine application. Requires a TLS secret created with ce_create_tls_secret_from_pem. The domain CNAME must point to custom.<subdomain>.us-south.codeengine.appdomain.cloud (returned by this call).
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | Code Engine application to route traffic to |
| domain_name | string | yes | Custom domain (e.g. starwars.cranfordpub.ca) |
| project_id | string | yes | – |
| tls_secret | string | yes | Name of the TLS secret containing the certificate and key |
No output schema declared.
No examples provided.
ce_create_job ~91
Create a job definition in Code Engine
| Name | Type | Req | Description |
|---|---|---|---|
| env_vars | object | – | – |
| image | string | yes | Container image reference |
| name | string | yes | – |
| project_id | string | yes | – |
| scale_array_spec | string | – | Array indices (e.g. 0-9 for 10 instances) |
| scale_cpu_limit | string | – | – |
| scale_memory_limit | string | – | – |
No output schema declared.
No examples provided.
ce_create_job_run ~54
Submit a job run from an existing job definition
| Name | Type | Req | Description |
|---|---|---|---|
| job_name | string | yes | Job definition name to run |
| name | string | – | Optional name for this job run |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_create_project ~60
Create a new Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Project name |
| region | string | yes | IBM Cloud region (e.g. us-south, ca-tor) |
| resource_group_id | string | – | Resource group ID (optional) |
No output schema declared.
No examples provided.
ce_create_secret ~71
Create a secret in a Code Engine project (generic, registry, ssh_auth, etc.)
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | Key/value pairs (values must be base64 encoded for binary formats) |
| format | string | yes | Secret type |
| name | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_create_tls_secret_from_pem ~157
Create a TLS secret in Code Engine by reading certificate and key PEM files from disk. Use this after obtaining a cert with certbot. The cert and key are read from the given file paths and stored as a Code Engine secret of format "tls".
| Name | Type | Req | Description |
|---|---|---|---|
| cert_pem_path | string | yes | Absolute path to the certificate PEM file (e.g. ~/certbot/config/live/<domain>/fullchain.pem) |
| key_pem_path | string | yes | Absolute path to the private key PEM file (e.g. ~/certbot/config/live/<domain>/privkey.pem) |
| project_id | string | yes | – |
| secret_name | string | yes | Name for the TLS secret (e.g. my-domain-tls) |
No output schema declared.
No examples provided.
ce_delete_application ~31
Delete a Code Engine application
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_delete_binding ~35
Delete a service binding from a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| binding_id | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_delete_config_map ~37
Delete a configmap from a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| config_map_name | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_delete_domain_mapping ~43
Delete a custom domain mapping from a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| domain_name | string | yes | The custom domain name to remove |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_delete_job ~32
Delete a Code Engine job definition
| Name | Type | Req | Description |
|---|---|---|---|
| job_name | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_delete_project ~23
Delete a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_delete_secret ~34
Delete a secret from a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | – |
| secret_name | string | yes | – |
No output schema declared.
No examples provided.
ce_get_app_instance ~56
Get status details for a specific running instance of a Code Engine application
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | – |
| instance_name | string | yes | Instance name (from ce_list_app_instances) |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_get_app_logs ~123
Get logs for a Code Engine application. Retrieves logs from all running pods (or a specific instance) via the Code Engine Kubernetes API proxy.
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | Application name |
| instance_name | string | – | Optional: specific pod/instance name to filter to (e.g. my-app-00001-deployment-abcde). If omitted, logs from all pods are returned. |
| project_id | string | yes | Project ID or name |
| tail_lines | number | – | Number of log lines to return per pod (default: 100) |
No output schema declared.
No examples provided.
ce_get_app_revision ~46
Get details of a specific revision of a Code Engine application
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | – |
| project_id | string | yes | – |
| revision_name | string | yes | – |
No output schema declared.
No examples provided.
ce_get_application ~33
Get details of a Code Engine application
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_get_binding ~50
Get details of a specific service binding in a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| binding_id | string | yes | The binding ID (use ce_list_bindings to find it) |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_get_config_map ~40
Get details of a specific configmap in a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| config_map_name | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_get_domain_mapping ~50
Get details of a specific custom domain mapping
| Name | Type | Req | Description |
|---|---|---|---|
| domain_name | string | yes | The custom domain name (e.g. starwars.cranfordpub.ca) |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_get_job ~35
Get details of a specific Code Engine job definition
| Name | Type | Req | Description |
|---|---|---|---|
| job_name | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_get_job_run ~36
Get status and details of a job run
| Name | Type | Req | Description |
|---|---|---|---|
| job_run_name | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_get_project ~30
Get details of a specific Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project ID (UUID) |
No output schema declared.
No examples provided.
ce_get_project_status ~36
Get the status details of a Code Engine project (readiness, enabled components, etc.)
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_get_secret ~38
Get metadata for a specific secret (keys only, no values)
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | – |
| secret_name | string | yes | – |
No output schema declared.
No examples provided.
ce_list_app_instances ~39
List all running instances (pods) of a Code Engine application
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_list_app_revisions ~41
List all revisions (deployed versions) of a Code Engine application
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | – |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_list_applications ~26
List applications in a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_list_bindings ~37
List all service bindings in a Code Engine project (bindings connect IBM Cloud services to apps/jobs)
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_list_config_maps ~27
List configmaps in a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_list_domain_mappings ~30
List all custom domain mappings in a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_list_egress_ips ~43
List the public egress IP addresses used by a Code Engine project (useful for allowlisting in firewalls)
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_list_job_runs ~62
List job runs in a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| job_name | string | – | Filter by job definition name (optional) |
| limit | number | – | Maximum results to return |
| project_id | string | yes | – |
| start | string | – | Pagination token |
No output schema declared.
No examples provided.
ce_list_jobs ~26
List job definitions in a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_list_projects ~37
List all Code Engine projects across all or a specific region
| Name | Type | Req | Description |
|---|---|---|---|
| region | string | – | IBM Cloud region (omit to search all regions) |
No output schema declared.
No examples provided.
ce_list_secrets ~26
List secrets in a Code Engine project
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_refresh_icr_pull_secret ~148
Refresh a Code Engine registry pull secret for IBM Container Registry (ICR) using the server's own IBM Cloud API key. Automatically deletes the existing secret and recreates it with fresh credentials. Use this when deployments fail with "no_revision_ready" or "unknown" status — a common cause is a stale or expired ICR pull secret. No API key input required — the server uses its own IBMCLOUD_API_KEY.
| Name | Type | Req | Description |
|---|---|---|---|
| icr_host | string | – | ICR registry hostname (default: us.icr.io) |
| project_id | string | yes | – |
| secret_name | string | – | Name of the registry secret to refresh (default: icr-pull-secret) |
No output schema declared.
No examples provided.
ce_renew_tls_secret_from_pem ~125
Renew an existing TLS secret in Code Engine by reading updated PEM files from disk. Use this when a Let's Encrypt cert has been renewed (every 90 days). Updates the secret in-place — no need to delete and recreate or update domain mappings.
| Name | Type | Req | Description |
|---|---|---|---|
| cert_pem_path | string | yes | Path to the renewed fullchain.pem (~ supported) |
| key_pem_path | string | yes | Path to the renewed privkey.pem (~ supported) |
| project_id | string | yes | – |
| secret_name | string | yes | Name of the existing TLS secret to renew |
No output schema declared.
No examples provided.
ce_update_application ~134
Update an existing Code Engine application (image, scaling, etc.)
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | – |
| image | string | – | New container image reference |
| image_secret | string | – | Registry secret name for pulling the image |
| project_id | string | yes | – |
| run_args | array | – | Arguments passed to the container entrypoint (run_arguments) |
| run_commands | array | – | Override the container entrypoint (run_commands) |
| scale_cpu_limit | string | – | – |
| scale_max_instances | number | – | – |
| scale_memory_limit | string | – | – |
| scale_min_instances | number | – | – |
No output schema declared.
No examples provided.
ce_update_config_map ~53
Update an existing Code Engine configmap (PATCH)
| Name | Type | Req | Description |
|---|---|---|---|
| config_map_name | string | yes | – |
| data | object | yes | New key/value data to replace configmap contents |
| project_id | string | yes | – |
No output schema declared.
No examples provided.
ce_update_domain_mapping ~74
Update an existing Code Engine custom domain mapping (PATCH) — e.g. change the target app
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | – | New application to route traffic to |
| domain_name | string | yes | – |
| project_id | string | yes | – |
| tls_secret | string | – | New TLS secret name (optional) |
No output schema declared.
No examples provided.
ce_update_job ~105
Update an existing Code Engine job definition (PATCH)
| Name | Type | Req | Description |
|---|---|---|---|
| env_vars | object | – | Key/value environment variables |
| image | string | – | New container image reference |
| image_secret | string | – | – |
| job_name | string | yes | – |
| project_id | string | yes | – |
| scale_array_spec | string | – | Array indices to run (e.g. "0-9") |
| scale_cpu_limit | string | – | – |
| scale_memory_limit | string | – | – |
No output schema declared.
No examples provided.
ce_update_secret ~109
Update an existing Code Engine secret in-place (PATCH). Use ce_renew_tls_secret_from_pem for TLS cert renewal. For generic secrets supply a data object with the new key/value pairs.
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | New key/value data to replace the secret contents |
| format | string | – | Secret format if changing: generic, registry, tls, ssh_auth, basic_auth |
| project_id | string | yes | – |
| secret_name | string | yes | Name of the secret to update |
No output schema declared.
No examples provided.
ce_wait_for_app_ready ~83
Poll a Code Engine application until its status becomes "ready" or a timeout is reached. Returns immediately when ready. Useful after ce_create_application or ce_update_application to confirm the new revision is live.
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | – |
| project_id | string | yes | – |
| timeout_seconds | number | – | Max seconds to wait (default 120) |
No output schema declared.
No examples provided.
detect_container_runtime ~19
Detect available container runtime (Docker or Podman)
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
iam_get_token_info ~43
Get information about the current IBM Cloud IAM token — account ID, subject, expiry time, and remaining validity. Useful for diagnosing authentication failures without exposing the token itself.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the IBM Code Engine MCP Server server?
IBM Code Engine MCP Server runs locally as an npm package, launched with npx -y code-engine-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · code-engine-mcp-server
claude mcp add markusvankempen-code-engine-mcp-server -- npx -y code-engine-mcp-server
What is the IBM Code Engine MCP Server server?
IBM Code Engine MCP Server is listed in the public MCP registry as io.github.markusvankempen/code-engine-mcp-server. Deploy to IBM Code Engine from Cursor, Copilot, Claude & Cline. Build, push, deploy via MCP. This page covers its npm package (code-engine-mcp-server).
Is the IBM Code Engine MCP Server server safe to use?
IBM Code Engine MCP Server scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 6 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the IBM Code Engine MCP Server server expose?
IBM Code Engine MCP Server exposes 65 tools: detect_container_runtime, build_container_image, push_container_image, list_local_images, test_container_locally, and 60 more. Their descriptions and schemas cost roughly 4,603 tokens of context every time the server is loaded.
Is the IBM Code Engine MCP Server server still maintained?
IBM Code Engine MCP Server is still listed as active in the MCP registry. We last reached this channel on 6 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the IBM Code Engine MCP Server server under?
IBM Code Engine MCP Server declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the IBM Code Engine MCP Server server?
VerifyMCP ran 16 checks on IBM Code Engine MCP Server, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.