devops-infra MCP Server
Model Context Protocol (MCP) server for IBM Code Engine and Docker/Podman integration. It enables AI assistants to build, run, push, and deploy containerized workloads with a single MCP server.
Discovered via github-topic:mcp-server and last synced 3mo ago.
1. Install the package
npx -y code-engine-mcp-server@latest
2. Add to claude_desktop_config.json
{
"mcpServers": {
"code-engine-mcp-server": {
"command": "npx",
"args": [
"-y",
"code-engine-mcp-server@latest"
]
}
}
}Config file location: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) / %APPDATA%\Claude\claude_desktop_config.json (Windows)
Push image to registry
Build a container image
Delete an image by full tag
Get application details and public URL
G[Multi-step Workflows] D -->
Run container for local testing
Get logs from a running container
Key Parameters
Validate a Dockerfile for Code Engine compatibility (architecture, port, nginx sed patterns, USER, CMD)
Create a new project
Get status details for a specific instance
Get build run status
List job runs
Delete a secret
List all custom domain mappings
List local container images
List ICR namespaces in your account
Poll until app status is ready or timeout; returns `poll_history`
Delete a build run
Submit a job run
List local containers
List images in ICR (optionally filtered by namespace)
List applications in a project
Delete a job run
Create a new ICR namespace
Deploy a new application
Get logs for an app instance
Start a build run
Get job run status
Create a TLS secret from PEM files
Get status and CNAME target for a mapping
Build container for linux/amd64 → push → create/update CE app → wait for ready → return URL + `poll_history`
Delete a project
List build runs
Create a job definition
Get secret metadata (no values)
List configmaps
Delete a custom domain mapping
List all running instances with status
Delete a build configuration
Get job definition details
List secrets (names + keys only)
What it does
Map a custom domain to an app
I([Live App\nhttps://app.region.codeengine.appdomain.cloud]) style A fill:#1261FE,color:#fff style B fill:#0f3460,color:#fff style G fill:#7b2d8b,color:#fff style I fill:#198038,color:#fff ``` ## ✨ What You Get - Container workflow tools for Docker or Podman - IBM Container Registry (ICR) tools — list namespaces, list images, delete images - IBM Code Engine project and application management tools - MCP-ready setup for GitHub Copilot, Cline, Claude Desktop, and the optional VS Code extension in `vscode-extension/` - A simple local development and troubleshooting workflow ## 🚀 Quick Start ```bash # 1) Install dependencies npm install # 2) Build the server npm run build # 3) Run once to verify node build/index.js ``` Then configure your MCP client using one of the examples in the Configuration section below. ## 🤖 The Agentic Experience (No Docker/Code Engine Lingo Needed) The true power of this MCP server is that **you don't need to know Docker or Code Engine commands**. You can simply state your goal, and the LLM will discover the environment, run the pipeline, and fix issues autonomously. Here is an example interaction from a real session: **User:** > "I have an app in the `developer-splash` folder. Deploy it to my Code Engine project." **Assistant's Autonomous Thought Process:** 1. *Discovery:* "Let me check what projects and namespaces exist... Found project `markus-app-v2-toronto` and namespace `mvk-code-engine`." 2. *Prerequisites:* "No pull secret in this project yet. I'll get the API key from the `.env` file and create the secret `icr-pull-secret`." 3. *Execution:* "Now I'll run the full pipeline: build → push → deploy → wait." 4. *Validation:* "It's deployed but stuck at 'deploying'. Let me check the logs... The container is running but the readiness probe is failing." 5. *Self-Correction:* "Ah, the `sed` pattern in the Dockerfile didn't match nginx alpine's default config format for port 80. I'll fix the Dockerfile with a regex-safe `sed` and rebuild." 6. *Completion:* "App is live! 🎉 Status: ready." **Assistant Response to User:** > "Your app is deployed and live at: `https://developer-splash.29m5mrru3s3n.ca-tor.codeengine.appdomain.cloud`. I had to fix a minor port configuration issue in your Dockerfile, but it is successfully running now!" With this MCP server, the AI acts as an expert DevOps engineer pairing with you. ## Deploy Your First App This walks through deploying the included [Star Wars splash page example](./examples/starwars-splash/) — a static nginx container — entirely through the MCP server. > **Apple Silicon users:** always build with `--platform linux/amd64`. Code Engine runs amd64 only. ### Step 1 — Build and push the image ```bash cd examples/starwars-splash podman build --platform linux/amd64 -t us.icr.io/<your-namespace>/starwars-splash:v1.0.0 . podman push us.icr.io/<your-namespace>/starwars-splash:v1.0.0 ``` Or ask your assistant: ``` Build examples/starwars-splash as us.icr.io/my-namespace/starwars-splash:v1.0.0 for linux/amd64 and push it ``` **MCP response — `build_container_image`:** ```json { "success": true, "command": "podman build --platform linux/amd64 -t us.icr.io/my-namespace/starwars-splash:v1.0.0 ...", "build_output": "STEP 1/5: FROM nginx:alpine\nSTEP 2/5: COPY index.html /usr/share/nginx/html/index.html\nSTEP 3/5: RUN sed -i 's/listen 80;/listen 8080;/g' /etc/nginx/conf.d/default.conf\nSTEP 4/5: EXPOSE 8080\nSTEP 5/5: CMD [\"nginx\", \"-g\", \"daemon off;\"]\nSuccessfully tagged us.icr.io/my-namespace/starwars-splash:v1.0.0" } ``` > **Note:** Container runtimes (Podman/Docker) write build progress to stderr. The `build_output` field combines stdout and stderr so you see the full build log. **MCP response — `push_container_image`:** ```json { "success": true, "command": "podman push us.icr.io/my-namespace/starwars-splash:v1.0.0", "output": "Getting image source signatures\nCopying blobs...\nWriting manifest to image destination" } ``` ### Step 2 — Create a registry pull secret Ask your assistant (once per project): ``` Create a registry secret called icr-pull-secret in project <project-id> for us.icr.io using my IBM Cloud API key ``` Or use the `ce_create_secret` tool directly: ```json { "project_id": "<your-project-id>", "name": "icr-pull-secret", "format": "registry", "data": { "username": "iamapikey", "password": "<your-ibm-cloud-api-key>", "server": "us.icr.io", "email": "[email protected]" } } ``` **MCP response — `ce_create_secret`:** ```json { "name": "icr-pull-secret", "format": "registry", "resource_type": "secret_registry_v2", "created_at": "2026-05-08T22:10:00Z", "project_id": "<your-project-id>" } ``` ### Step 3 — Deploy the application Ask your assistant: ``` Deploy us.icr.io/my-namespace/starwars-splash:v1.0.0 to Code Engine project <project-id> as app "starwars-splash" using pull secret icr-pull-secret, min 1 instance ``` Or use the `ce_create_application` tool: ```json { "project_id": "<your-project-id>", "name": "starwars-splash", "image": "us.icr.io/<your-namespace>/starwars-splash:v1.0.0", "image_secret": "icr-pull-secret", "scale_min_instances": 1, "scale_max_instances": 3 } ``` **MCP response — `ce_create_application`:** ```json { "name": "starwars-splash", "resource_type": "app_v2", "status": "deploying", "image_reference": "us.icr.io/my-namespace/starwars-splash:v1.0.0", "image_secret": "icr-pull-secret", "image_port": 8080, "scale_min_instances": 1, "scale_max_instances": 3, "scale_cpu_limit": "1", "scale_memory_limit": "4G", "endpoint": "https://starwars-splash.<subdomain>.us-south.codeengine.appdomain.cloud", "status_details": { "latest_created_revision": "starwars-splash-00001", "latest_ready_revision": null } } ``` ### Step 4 — Check deployment status ``` Get details for the starwars-splash app in project <project-id> ``` This calls `ce_get_application` and returns the public URL once the app reaches `ready` status. ``` List the running instances of starwars-splash in project <project-id> ``` This calls `ce_list_app_instances` (or `ce_get_app_instance` for a specific instance) and shows: - Instance name and revision - Container status (`running` / `pending` / `failed`) - Restart count - Started-at timestamp - CPU and memory allocation **MCP response — `ce_get_application` (once ready):** ```json { "name": "starwars-splash", "status": "ready", "image_reference": "us.icr.io/my-namespace/starwars-splash:v1.0.0", "image_port": 8080, "scale_min_instances": 1, "scale_max_instances": 3, "scale_cpu_limit": "0.5", "scale_memory_limit": "1G", "region": "us-south", "endpoint": "https://starwars-splash.<subdomain>.us-south.codeengine.appdomain.cloud", "status_details": { "latest_created_revision": "starwars-splash-00001", "latest_ready_revision": "starwars-splash-00001" } } ``` ### Step 5 — Map a custom domain (optional) To serve the app at your own domain (e.g. `myapp.example.com`) you need a TLS certificate. The IBM Code Engine REST API always requires a real certificate — IBM's Console "Platform managed" option is not available via the API. **5a — Get a Let's Encrypt certificate (certbot)** ```bash # Install once brew install certbot # Request cert — certbot will print a DNS TXT challenge value mkdir -p ~/certbot/{config,work,logs} /opt/homebrew/bin/certbot certonly --manual --preferred-challenges dns \ -d <your-domain> --agree-tos --no-eff-email --email [email protected] \ --config-dir ~/certbot/config --work-dir ~/certbot/work --logs-dir ~/certbot/logs ``` Certbot will pause and ask you to add a TXT record: ``` Add TXT record: _acme-challenge.<your-domain> = <challenge-value> ``` Verify propagation, then press Enter. Certbot writes: - `~/certbot/config/live/<your-domain>/fullchain.pem` - `~/certbot/config/live/<your-domain>/privkey.pem` **5b — Create the TLS secret in Code Engine** Ask your assistant: ``` Create a TLS secret called starwars-tls in project <project-id> using cert ~/certbot/config/live/myapp.example.com/fullchain.pem and key ~/certbot/config/live/myapp.example.com/privkey.pem ``` This calls `ce_create_tls_secret_from_pem` — reads the PEM files from disk and stores them as a Code Engine `tls` secret. **MCP response — `ce_create_tls_secret_from_pem`:** ```json { "name": "my-tls", "format": "tls", "resource_type": "secret_tls_v2", "created_at": "2026-05-08T22:30:00Z", "project_id": "<your-project-id>" } ``` **5c — Create the domain mapping** Ask your assistant: ``` Map domain myapp.example.com to app my-app in project <project-id> using TLS secret my-tls ``` This calls `ce_create_domain_mapping` and returns the `cname_target`. **MCP response — `ce_create_domain_mapping`:** ```json { "name": "myapp.example.com", "status": "ready", "cname_target": "custom.<subdomain>.us-south.codeengine.appdomain.cloud", "component": { "resource_type": "app_v2", "name": "my-app" }, "tls_secret": "my-tls", "region": "us-south" } ``` **5d — Update your CNAME** In your DNS provider, set: ``` myapp.example.com CNAME custom.<subdomain>.us-south.codeengine.appdomain.cloud ``` Use the `cname_target` value returned in 5c (it uses the `custom.` prefix, not the app name). Once DNS propagates, `https://<your-domain>` serves the app with a valid TLS certificate. > **Certificate renewal:** Let's Encrypt certs expire after 90 days. Re-run certbot to get updated PEM files, then ask Copilot to run `ce_renew_tls_secret_from_pem` — it patches the existing secret in-place so your domain mapping continues working without any changes. ### Full one-shot prompt ``` I have a Star Wars splash page in examples/starwars-splash. Build it for linux/amd64 as us.icr.io/my-namespace/starwars-splash:v1.0.0, push it, then deploy it to Code Engine project <project-id> with pull secret icr-pull-secret. Tell me the public URL and confirm the instance is running. ``` --- ## 🌐 Host Any MCP Server on Code Engine You can use **this** MCP server to deploy **another** MCP server to Code Engine — no CLI, no Dockerfile, no YAML. The key ingredient is [`supergateway`](https://github.com/supercorp-ai/supergateway): a tiny bridge that wraps any STDIO-based MCP server as an HTTP + SSE endpoint, making it accessible to any remote client. > Credit: [Jeremias Werner & Enrico Regge — IBM Cloud Code Engine](https://community.ibm.com/community/user/blogs/jeremias-werner/2025/04/30/code-engine-mcp-server) ``` Your AI Assistant │ MCP JSON-RPC (STDIO, local) ▼ code-engine-mcp-server ──► ce_create_application │ ▼ Code Engine App image: docker.io/supercorp/supergateway args: --stdio "npx -y <any-mcp-server>" --outputTransport sse │ HTTPS + SSE (public URL) ▼ Any remote MCP client (Claude Desktop, Cursor, VS Code, …) ``` Any STDIO MCP server becomes a remotely accessible, auto-scaling cloud service — with no custom infrastructure. This example deploys [`@tokenizin/mcp-npx-fetch`](https://www.npmjs.com/package/@tokenizin/mcp-npx-fetch), an MCP server that lets an AI assistant fetch content from public URLs. The example files live in [examples/mcp-server-supergateway/](./examples/mcp-server-supergateway/). ### Step 1 — Deploy the hosted MCP server Ask your assistant: ``` Deploy a hosted MCP fetch server to my Code Engine project <project-id>. Use image docker.io/supercorp/supergateway on port 8000. Startup args: --stdio "npx -y @tokenizin/mcp-npx-fetch" --outputTransport sse Name it "mcp-fetch-server". No pull secret needed. ``` This calls `ce_create_application`: ```json { "project_id": "<your-project-id>", "name": "mcp-fetch-server", "image": "docker.io/supercorp/supergateway", "port": 8000, "run_args": ["--stdio", "npx -y @tokenizin/mcp-npx-fetch", "--outputTransport", "sse"] } ``` **MCP response — `ce_create_application`:** ```json { "name": "mcp-fetch-server", "resource_type": "app_v2", "status": "deploying", "image_reference": "docker.io/supercorp/supergateway", "image_port": 8000, "scale_min_instances": 0, "scale_max_instances": 10, "endpoint": "https://mcp-fetch-server.<subdomain>.<region>.codeengine.appdomain.cloud", "status_details": { "latest_created_revision": "mcp-fetch-server-00001", "latest_ready_revision": null } } ``` > No pull secret is needed — `docker.io/supercorp/supergateway` is a public image. Code Engine scales to zero when idle; you pay only for actual requests. ### Step 2 — Wait for the app to be ready Ask your assistant: ``` Wait for mcp-fetch-server in project <project-id> to be ready ``` This calls `ce_wait_for_app_ready`: ```json { "project_id": "<your-project-id>", "app_name": "mcp-fetch-server", "timeout_seconds": 120 } ``` **MCP response — `ce_wait_for_app_ready`:** ```json { "app_name": "mcp-fetch-server", "status": "ready", "endpoint": "https://mcp-fetch-server.<subdomain>.<region>.codeengine.appdomain.cloud", "elapsed_seconds": 34, "poll_history": [ { "attempt": 1, "status": "deploying", "elapsed_seconds": 10 }, { "attempt": 2, "status": "deploying", "elapsed_seconds": 20 }, { "attempt": 3, "status": "ready", "elapsed_seconds": 34 } ] } ``` ### Step 3 — Verify the running instance Ask your assistant: ``` List the running instances of mcp-fetch-server in project <project-id> ``` This calls `ce_list_app_instances`: **MCP response — `ce_list_app_instances`:** ```json { "instances": [ { "name": "mcp-fetch-server-00001-deployment-abc123", "revision": "mcp-fetch-server-00001", "status": "running", "restart_count": 0, "started_at": "2026-05-09T12:01:44Z" } ] } ``` ### Step 4 — Connect your MCP client Use [`mcp-remote`](https://www.npmjs.com/package/mcp-remote) to bridge the HTTP+SSE endpoint back to STDIO for local clients. **VS Code `mcp.json`:** ```json { "servers": { "fetch": { "command": "npx", "args": [ "mcp-remote", "https://mcp-fetch-server.<subdomain>.<region>.codeengine.appdomain.cloud/sse" ] } } } ``` **Claude Desktop `claude_desktop_config.json`:** ```json { "mcpServers": { "fetch": { "command": "npx", "args": [ "mcp-remote", "https://mcp-fetch-server.<subdomain>.<region>.codeengine.appdomain.cloud/sse" ] } } } ``` ### Step 5 — Test the endpoint Verify the server is live and streaming: ```bash curl -N https://mcp-fetch-server.<subdomain>.<region>.codeengine.appdomain.cloud/sse ``` Or open it in the [MCP Inspector](https://github.com/modelcontextprotocol/inspector): ```bash npx @modelcontextprotocol/inspector # Connect via SSE → paste the Code Engine URL ``` Once connected, you will see the `fetch` tool listed and can invoke it directly from the inspector. ### Full one-shot prompt ``` Deploy a hosted MCP fetch server to my Code Engine project <project-id>. Use image docker.io/supercorp/supergateway on port 8000 with no pull secret. run_args: --stdio "npx -y @tokenizin/mcp-npx-fetch" --outputTransport sse Name it "mcp-fetch-server", wait for it to be ready, and give me the /sse URL so I can add it to my mcp.json. ``` See [examples/mcp-server-supergateway/](./examples/mcp-server-supergateway/) for the ready-to-use client config file. ### Deploy any other STDIO MCP server The same pattern works for any `npx`-runnable MCP server — just swap the `--stdio` argument:
`npx -y @tokenizin/mcp-npx-fetch`
`npx -y @modelcontextprotocol/server-filesystem /data`
Link
Detect Docker or Podman
Stop and remove a container
List all projects in a region
Get project details
Update image, scaling, env, pull secret, run args
Delete an application
List build configurations
Get build configuration details
Create a build configuration
Poll until build run succeeds or fails; returns `poll_history`
List job definitions
Delete a job definition
Create a secret
Update an existing secret in-place (PATCH)
Delete and recreate an ICR registry pull secret using the server's own API key — fixes stale-credential failures without needing the CLI
Renew an existing TLS secret from updated PEM files
Get configmap details
Create a configmap
Delete a configmap
Inspect the current IAM token — account, expiry, validity
Read PEM files → create TLS secret → create domain mapping → return CNAME target
Start CE build run → wait for success → create/update app → wait for ready → return URL + `build_poll_history` + `app_poll_history`
Reduce container attack surface by building application images on Google distroless base images that contain only the application runtime with no shell, package manager, or unnecessary OS utilities.
Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.
Harden the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls.
Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators
AI Agent Assistant & development framework that integrates lots of IM platforms, LLMs, plugins and AI feature, and can be your openclaw alternative. ✨
ToolJet is the open-source foundation of ToolJet AI - the enterprise app generation platform for building internal tools, dashboard, business applications, workflows and AI agents 🚀
Turn your PC, Mac, or Linux box into an AI server. LLM inference, chat UI, voice, agents, workflows, RAG, and image generation.
Turn your PC, Mac, or Linux box into an AI server. LLM inference, chat UI, voice, agents, workflows, RAG, and image generation.
Learn how to use the Redis Manager Claude skill. Complete guide with installation instructions and examples.
Learn how to use the Privacy Search Claude skill. Complete guide with installation instructions and examples.
Learn how to use the Clawboard Claude skill. Complete guide with installation instructions and examples.