# microservices.sh (npm · @microservices-sh/mcp)

MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.

- Trust score: 81/100 (high trust)
- Change this week: −14
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `api.microservices.sh`: 36/100, [markdown](https://verifymcp.io/servers/sh-microservices-mcp/api.md), [page](https://verifymcp.io/servers/sh-microservices-mcp/api)
- npm · `@microservices-sh/mcp`: 81/100 (this document), [markdown](https://verifymcp.io/servers/sh-microservices-mcp/microservices-sh-mcp.md), [page](https://verifymcp.io/servers/sh-microservices-mcp/microservices-sh-mcp)

## Channel facts

- Registry: `npm`
- Package: `@microservices-sh/mcp`
- Version: `0.1.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to microservices-sh/mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 46 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 81/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1706 tokens (~100/item across 17 items; 17 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add sh-microservices-mcp -- npx -y @microservices-sh/mcp
```

### Codex

```bash
codex mcp add sh-microservices-mcp -- npx -y @microservices-sh/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sh-microservices-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@microservices-sh/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add sh-microservices-mcp --command npx --arg -y --arg @microservices-sh/mcp
```

### Hermes

```yaml
mcp_servers:
  sh-microservices-mcp:
    command: "npx"
    args: ["-y", "@microservices-sh/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "sh-microservices-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@microservices-sh/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 81, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 66, −11)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 77, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 95, +36)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: pass
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail

### 2026-07-26 (score 59)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (17)

### `list_templates` (~48 tokens)

List Templates

List available microservices.sh app templates, including template ids and summaries. Use this before inspect_template, compose_app, generate_project, or run_checks when choosing a foundation for a new Cloudflare app.

### `inspect_template` (~63 tokens)

Inspect Template

Inspect one app template contract, including supported modules, default configuration, runtime metadata, and generation behavior. Use this before composing or generating a project from a specific template id.

Input parameters:

- `templateId` (string, required): Template id returned by list_templates, for example booking-sveltekit.

### `list_modules` (~47 tokens)

List Modules

List available verified microservices.sh modules with ids, categories, summaries, versions, and maturity status. Use this to discover production building blocks before inspect_module, compose_app, or plan_add_module.

### `inspect_module` (~77 tokens)

Inspect Module

Inspect one module contract in detail, including permissions, hooks, events, resources, storage needs, and customization points. Use this before editing or adding a module so the agent understands the module boundaries.

Input parameters:

- `moduleId` (string, required): Module id returned by list_modules, for example auth, booking, customer, payment, files, or audit-log.

### `list_module_docs` (~37 tokens)

List Module Docs

List LLM-readable documentation pages available for module implementation guidance. Use this to discover local docs before get_module_doc or before changing generated source.

### `get_module_doc` (~60 tokens)

Get Module Doc

Return an LLM-readable documentation page for a module, including rules, implementation notes, and agent guidance. Use this before coding against a module contract.

Input parameters:

- `moduleId` (string, required): Module id whose documentation should be returned, for example booking or payment.

### `compose_app` (~118 tokens)

Compose App

Compose a template and selected modules into a checked app contract and lockfile plan without writing files. Use this to preview the exact app composition before generate_project or deployment planning.

Input parameters:

- `config` (object): Template configuration overrides for generated source, runtime bindings, or module-specific settings.
- `modules` (array): Optional microservices.sh module ids to include, such as auth, booking, customer, payment, files, or audit-log.
- `templateId` (string): Template id to use for app composition. Omit to use the registry default template.

### `validate_config` (~116 tokens)

Validate Config

Validate a template, module list, and configuration object before generation or deployment. Use this to catch unsupported modules, missing settings, and invalid config before side effects.

Input parameters:

- `config` (object): Template configuration overrides for generated source, runtime bindings, or module-specific settings.
- `modules` (array): Optional microservices.sh module ids to include, such as auth, booking, customer, payment, files, or audit-log.
- `templateId` (string): Template id to use for app composition. Omit to use the registry default template.

### `generate_project` (~122 tokens)

Generate Project

Generate project source files in memory for agent inspection. This tool does not write files; use it to review planned source, docs, migrations, and config before creating or editing a local project.

Input parameters:

- `config` (object): Template configuration overrides for generated source, runtime bindings, or module-specific settings.
- `modules` (array): Optional microservices.sh module ids to include, such as auth, booking, customer, payment, files, or audit-log.
- `templateId` (string): Template id to use for app composition. Omit to use the registry default template.

### `run_checks` (~114 tokens)

Run Checks

Run local contract and readiness checks for a template/module composition. Use this before deployment planning to verify module compatibility, generated artifacts, and operational guardrails.

Input parameters:

- `config` (object): Template configuration overrides for generated source, runtime bindings, or module-specific settings.
- `modules` (array): Optional microservices.sh module ids to include, such as auth, booking, customer, payment, files, or audit-log.
- `templateId` (string): Template id to use for app composition. Omit to use the registry default template.

### `plan_add_module` (~109 tokens)

Plan Add Module

Plan an approval-gated module addition against an optional existing microservices.lock.json. This tool reports intended lockfile changes and required review gates without writing files.

Input parameters:

- `lock` (object): Optional existing microservices.lock.json content used to calculate a safe add plan.
- `moduleId` (string): Module id or module@version selector to add, for example payment or booking@0.1.0.
- `version` (string): Optional explicit target version when moduleId does not include @version.

### `check_updates` (~50 tokens)

Check Updates

Check locked module versions against the bundled registry snapshot. Use this to identify available module updates before plan_module_upgrade.

Input parameters:

- `lock` (object): Optional existing microservices.lock.json content to compare against known module versions.

### `plan_module_upgrade` (~124 tokens)

Plan Module Upgrade

Plan a module version change and report approval gates, compatibility notes, and lockfile impact. Use this before applying a module upgrade.

Input parameters:

- `lock` (object): Optional existing microservices.lock.json content used to calculate upgrade impact.
- `moduleId` (string): Module id or module@version selector to upgrade, for example auth or payment@0.1.0.
- `to` (string): Optional target version. Omit to let the planner choose the latest known version.
- `version` (string): Optional current version when it is not available from the lockfile.

### `get_secrets_status` (~116 tokens)

Get Secrets Status

Report required secret names and configured/missing status for a template/module composition without exposing secret values. Use this before deployment planning or remote preview deploys.

Input parameters:

- `config` (object): Template configuration overrides for generated source, runtime bindings, or module-specific settings.
- `modules` (array): Optional microservices.sh module ids to include, such as auth, booking, customer, payment, files, or audit-log.
- `templateId` (string): Template id to use for app composition. Omit to use the registry default template.

### `create_preview_plan` (~141 tokens)

Create Preview Plan

Create a local preview-deployment readiness plan without mutating remote state. Use this before deploy_preview to review resources, checks, errors, warnings, and required approval steps.

Input parameters:

- `config` (object): Template configuration overrides for generated source, runtime bindings, or module-specific settings.
- `mode` (string): Deployment topology mode: embedded for one Worker app, service for separated service modules.
- `modules` (array): Optional microservices.sh module ids to include, such as auth, booking, customer, payment, files, or audit-log.
- `templateId` (string): Template id to use for app composition. Omit to use the registry default template.

### `deploy_preview` (~242 tokens)

Deploy Preview

Prepare a remote preview deployment through the microservices.sh control plane. This is a mutating tool and requires confirm: preview; call create_preview_plan first and only proceed after human review.

Input parameters:

- `actor` (string): Actor label for audit logs, such as the agent, user, or workflow initiating the preview.
- `apiKey` (string): Optional API key for the control plane. Prefer MICROSERVICES_API_KEY or MICROSERVICES_TOKEN in the environment.
- `apiUrl` (string): Optional control-plane URL. Defaults to MICROSERVICES_API_URL or https://api.microservices.sh.
- `config` (object): Template configuration overrides for generated source, runtime bindings, or module-specific settings.
- `confirm` (string, required): Required literal confirmation for this mutating preview-deployment tool.
- `modules` (array): Optional microservices.sh module ids to include, such as auth, booking, customer, payment, files, or audit-log.
- `name` (string): Project or deployment display name recorded in the preview deployment request.
- `templateId` (string): Template id to use for app composition. Omit to use the registry default template.

### `get_deployment_status` (~122 tokens)

Get Deployment Status

Read a remote preview deployment status from the microservices.sh control plane. Use this after deploy_preview to poll status, inspect errors, or retrieve deployment metadata.

Input parameters:

- `apiKey` (string): Optional API key for the control plane. Prefer MICROSERVICES_API_KEY or MICROSERVICES_TOKEN in the environment.
- `apiUrl` (string): Optional control-plane URL. Defaults to MICROSERVICES_API_URL or https://api.microservices.sh.
- `deploymentId` (string, required): Deployment id returned by deploy_preview or the microservices.sh control plane.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/sh-microservices-mcp/microservices-sh-mcp#diagnostics

## Score history

- 2026-08-03: 81
- 2026-08-02: 81
- 2026-08-01: 66
- 2026-07-31: 66
- 2026-07-30: 77
- 2026-07-28: 95
- 2026-07-27: 95
- 2026-07-26: 59

## Links

- npm package: https://www.npmjs.com/package/@microservices-sh/mcp
- Socket report: https://socket.dev/npm/package/@microservices-sh/mcp
- Repository: https://github.com/microservices-sh/mcp
- Changelog RSS feed: https://verifymcp.io/servers/sh-microservices-mcp/microservices-sh-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/sh-microservices-mcp/microservices-sh-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/sh-microservices-mcp/microservices-sh-mcp