dockerlint-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| --dir | No | Only files inside this directory can be read (default: the current directory). Every path is resolved and must stay inside this directory. | . |
| --disable | No | Comma-separated rule ids to turn off, e.g. DL1013,DC2008. Repeatable. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
Statically lint and explain Dockerfiles and docker-compose files. Nothing is built or run and no Docker daemon is needed. Pass a file path (relative to the server's --dir, or absolute inside it). Typical flow: dockerfile_overview to understand the file, lint_dockerfile for rule IDs + line numbers + concrete fixes, explain_layers for cache order and size, check_dockerignore for the build context, fix_preview for a diff of the safe automatic fixes, suggest_multistage for a rewrite proposal, lint_compose for compose files. Silence a finding with a # dockerlint-ignore: DL1003 comment above the instruction.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| dockerfile_overviewA | Summarize a Dockerfile: stages with base images (tag/digest), layer count, exposed ports,
final user, workdir, and ENTRYPOINT/CMD (exec vs shell form). Start here to understand a file
before linting it. |
| lint_dockerfileA | Lint a Dockerfile with 28 rules (IDs DL1001-DL1028). Each finding has a rule ID, severity
(error/warning/info), the line of the instruction, an explanation, and a concrete fix.
Covers unpinned/latest tags, apt/pip/apk/yum hygiene, root user, ADD vs COPY, COPY-before-install
cache busting, secrets in ENV/ARG/RUN (values are never echoed), curl|sh, HEALTHCHECK,
shell-form CMD/ENTRYPOINT, WORKDIR, sudo, chmod 777 and COPY of node_modules/.git.
Suppress with |
| explain_layersA | Explain which Dockerfile instructions create image layers, with heuristic size hints (small/large and why), and list ORDER problems that invalidate the build cache or bloat the image (COPY . before dependency install, cleanup in a later layer, recursive chown after COPY, volatile build args before expensive steps). Sizes are estimates; nothing is built. |
| lint_composeA | Lint a docker-compose / compose.yaml file (rule IDs DC2001-DC2014): unpinned or :latest
images, privileged, host network, docker.sock mounts, secrets in environment (values never
echoed), ports published on all interfaces, missing restart/healthcheck, depends_on without a
condition, broad bind mounts (/, home), obsolete |
| check_dockerignoreA | Check the .dockerignore for a Dockerfile (or a directory): missing file, patterns that do not exclude .git, node_modules or .env files, nested node_modules the root-anchored patterns miss, and patterns that exclude files the Dockerfile COPYs (the build would fail or silently omit them). Uses Docker's matching rules (root-anchored, last match wins, ** crosses dirs). |
| suggest_multistageA | Propose a multi-stage rewrite of a single-stage Dockerfile as TEXT (never writes a file). Recognizes common Python, Node, Go and Rust patterns and reuses your base image version, workdir, ports and CMD/ENTRYPOINT. Explains what moves to the build stage and why the final image shrinks. |
| fix_previewA | Show a unified diff of the safe automatic fixes for a Dockerfile (add -y and --no-install-recommends to apt-get install, --no-cache-dir to pip, --no-cache to apk, apt -> apt-get, ADD -> COPY, shell-form CMD -> exec form, MAINTAINER -> LABEL, apt lists cleanup). Never writes the file: apply the diff yourself. Lists the findings that need manual changes. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool has a fairly distinct role: overview summarizes, lint_dockerfile reports rule findings, explain_layers focuses on layer/cache heuristics, fix_preview shows diffs. There is minor overlap between explain_layers' order/cache problems and lint_dockerfile's cache-busting rule, but descriptions clarify the split.
All tools use snake_case, which is consistent, but the ordering is mostly verb_noun (lint_dockerfile, check_dockerignore, fix_preview) with one noun_verb outlier (dockerfile_overview). Readable and predictable overall with a single minor deviation.
Seven tools is well-scoped for a Dockerfile/compose linting server, each covering a distinct artifact (Dockerfile, compose, dockerignore) or function (summarize, lint, explain, suggest, fix). No tool feels redundant or like padding.
The surface covers the full lint lifecycle for Dockerfiles plus compose and .dockerignore, with suggestions and fix previews but no write/apply by design. Minor gaps exist, such as no automatic fix suggestions for compose or dockerignore, but core workflows are covered.