The ORAS MCP Server enables AI assistants to interact with OCI registries and container registries to query and analyze container images, artifacts, and their associated metadata.
List well-known registries: Discover public registries that support catalog functionality
Browse repositories: Enumerate all repositories available in a specific registry
Explore image tags: Retrieve all tags within a repository
Analyze referrers: Identify artifacts that reference a specific container image or OCI artifact (such as signatures or SBOMs)
Fetch manifests: Retrieve detailed manifest information for images and artifacts by tag or digest
Access blob content: Download specific blob data (like image layers or configuration files) referenced by digest
Parse references: Break down container reference strings into their component parts (registry, repository, tag, digest)
This server is particularly useful for understanding container image metadata, platform support, signatures, and artifact relationships across various container registries.
Supports working with CNCF Notary signatures for container images, allowing verification of image authenticity and integrity.
Provides tools for running the ORAS MCP Server inside a Docker container, making deployment and execution straightforward without local installation requirements.
Enables interaction with GitHub Container Registry (ghcr.io) to retrieve and analyze container images and their metadata.
Provides capabilities to analyze Linux-based container images across multiple architectures including amd64, arm64, arm/v7, s390x, and ppc64le.
ORAS MCP Server
Usage
Configure the ORAS MCP Server to run inside VS Code agent mode for registry-aware chats.
The server is implemented with the oras-go library and does not depend on the oras CLI.
Setup with Docker
It is easier to use docker to run the ORAS MCP Server.
Setup for VS Code
Add the following code to .vscode/mcp.json:
Mount Docker credentials (Linux only)
Linux users can share docker login credentials by mounting the config file:
Adjust the path if you keep credentials under ${env:DOCKER_CONFIG}. The container understands only inline auths entries; helper-based configs (credsStore, credHelpers) won't work. On macOS/Windows, install the released binary instead.
Setup from Released Binaries
Visit the GitHub releases page and download the archive that matches your operating system and CPU architecture (
oras-mcp_<version>_<os>_<arch>.tar.gzfor Linux or macOS,oras-mcp_<version>_windows_<arch>.zipfor Windows).Extract the archive; the folder contains a single executable named
oras-mcp(ororas-mcp.exeon Windows) and a copy of the project license.Move the binary to a directory on your
PATH(for example,/usr/local/binon Linux/macOS or%LOCALAPPDATA%\Programs\oras-mcpon Windows) or reference it directly from its extracted location.Run
oras-mcp serve --help(ororas-mcp.exe serve --help) to confirm the binary works on your system.To integrate with VS Code agent mode, update
.vscode/mcp.jsonto point at the extracted binary:{ "servers": { "oras-mcp-server": { "type": "stdio", "command": "/absolute/path/to/oras-mcp", "args": [ "serve" ] } } }On Windows, set
"command": "C:/path/to/oras-mcp.exe".
Authentication
oras-mcp reads credentials from the same stores used by the ORAS and Docker CLIs, but you need to expose those stores to the server process:
Released binary – Run
oras login <registry>ordocker login <registry>on the host machine; the binary will pick up the cached credentials automatically.Docker container – On Linux you can mount your Docker config as shown in the credential section; ensure the file contains inline
authsentries. Docker Desktop (macOS/Windows) depends on keychain helpers, so use the released binary there.
Related MCP server: mcp-OpenSearch
Example Chats
Q: What platform does the image ghcr.io/oras-project/oras support?
A: The image ghcr.io/oras-project/oras supports the following platforms:
Linux (amd64)
Linux (arm64)
Linux (arm, variant v7)
Linux (s390x)
Linux (ppc64le)
Let me know if you need further details!
Q: What's the latest Azure Linux 3.0 image in MCR? Does it have a signature? What's the type of it?
A: The latest Azure Linux 3.0 image in the Microsoft Container Registry (MCR) is tagged as 3.0.20250402. It has a signature, and the type of the signature is application/vnd.cncf.notary.signature.
Release Process
Maintainers can find the full release steps in the release checklist.