Which integrations are available for this server?

Audits Docker Compose and Dockerfile configurations against 44 security and best-practice checks, covering privilege, network, secrets, filesystem, resources, image hygiene, and more. Audits GitHub Actions workflow files against 21 security and supply-chain checks, covering token leaks, permission scoping, action pinning, runner security, and workflow configuration.

How do I use Unbearable IaC Audit Pack?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Unbearable IaC Audit Pack audit my Dockerfile for security issues" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Unbearable IaC Audit Pack by UnbearableDev

# Unbearable IaC Audit Pack

Unbearable IaC Audit Pack — all four audit Actors under one MCP endpoint. Snyk-comparable scope at a fraction of the cost. Pay-per-event — only billed when a tool is actually called.

64 checks. 20 categories. 4 audit engines. 1 MCP endpoint.

What's included

Package	Checks	Categories	Primary tool
Docker Compose audit	25	9	`audit_compose`
Dockerfile audit	19	5	`audit_dockerfile`
GitHub Actions audit	21	6	`audit_github_actions`
HU Postcode Validator	5 tools	—	`validate_postcode`, `lookup_city`, …

Plus two bundle-only tools:

audit_all — paste a dict of filenames → content; auto-detects Dockerfile, compose, and workflow files and runs the right audit on each
list_all_checks — full cross-package check catalog in one call

Related MCP server: gitl

Quick start (Claude Desktop)

{
  "mcpServers": {
    "iac-audit-pack": {
      "type": "http",
      "url": "https://unbearable-dev--iac-audit-pack.apify.actor/mcp",
      "headers": {
        "Authorization": "Bearer <your-apify-token>"
      }
    }
  }
}

Tool catalog

Aggregation (bundle-only)

Tool	Description
`audit_all(files, min_severity?)`	Multi-file detection + combined audit report
`list_all_checks()`	All 64 checks across all three audit packages

Docker Compose (25 checks, 9 categories)

Tool	Description
`audit_compose(compose_yaml?, compose_url?, min_severity?)`	Full 25-check audit
`check_privilege`	Privileged mode, cap_add, user namespace
`check_network`	Host networking, exposed dangerous ports
`check_secrets`	Hardcoded passwords, tokens in env vars
`check_filesystem`	Docker socket mounts, host path mounts
`check_resources`	Missing memory/CPU limits
`check_image_hygiene`	Unpinned tags, `latest` usage
`check_runtime_lifecycle`	Restart policies, healthchecks
`check_logging`	Logging driver config
`check_compose_hygiene`	Version field, service naming
`list_checks_compose(category?)`	Check catalog

Dockerfile (19 checks, 5 categories)

Tool	Description
`audit_dockerfile(dockerfile_content?, dockerfile_url?, min_severity?)`	Full 19-check audit
`check_base_image_dockerfile`	Unpinned base, `latest`, root user in FROM
`check_instructions_dockerfile`	ADD vs COPY, COPY ordering, ENV secrets
`check_security_dockerfile`	USER root, privilege escalation patterns
`check_efficiency_dockerfile`	Layer count, cache busting
`check_secrets_dockerfile`	Hardcoded secrets in RUN/ENV/ARG
`list_checks_dockerfile(category?)`	Check catalog

GitHub Actions (21 checks, 6 categories)

Tool	Description
`audit_github_actions(workflow_yaml?, workflow_url?, min_severity?)`	Full 21-check audit
`check_secrets_gha`	Leaked tokens, secret in run: blocks
`check_permissions_gha`	Overly broad write-all permissions
`check_action_pinning_gha`	Unpinned action refs (not SHA-pinned)
`check_runner_security_gha`	Self-hosted runner risks
`check_workflow_config_gha`	pull_request_target misuse, script injection
`check_supply_chain_advanced_gha`	TeamPCP-class supply-chain patterns (GHA-201..208)
`list_checks_github_actions(category?)`	Check catalog

HU Postcode Validator (5 tools)

Tool	Description
`validate_postcode(postcode)`	Settlement + county for a HU postcode
`lookup_postcode(postcode)`	Alias for validate_postcode
`lookup_city(city)`	All postcodes for a city (diacritic-insensitive)
`validate_address(postcode, city)`	Postcode/city pairing validation
`list_postcodes_in_county(county_name)`	All postcodes in a county
`budapest_district_lookup(district_number)`	Budapest I-XXIII → postcodes

Pricing

Event	USD
`audit_all` or any single-domain audit call	$0.10
Single-domain audit (`audit_compose`, `audit_dockerfile`, `audit_github_actions`)	$0.05
`list_checks` / discovery calls	$0.005

Pay-per-event — no subscription, no monthly minimums. You pay only when a tool is invoked.

Architecture

Package-import (not proxy): all four sub-packages are bundled directly into the Actor image. Single cold start, single billing rail, no cross-Actor latency. See DESIGN.md for the full rationale.

Built by Noel @ Unbearable Labs — more like this in the weekly newsletter.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

Need Help?

Related Servers

Related MCP Connectors

Agentic Platform A
io.github.andysalvo
Free MCP tools: the only MCP linter, health checks, cost estimation, and trust evaluation.
Developer Tools Monitoring Observability
31
crowvault
io.github.rajeswaran140
327 dev tools via REST API and MCP. Generate Dockerfiles, schemas, K8s, APIs, and more.
Developer Tools CI/CD & DevOps
2
Frogeye Security Scanner A
io.github.frogeye-ai
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Security Penetration Testing
2
codegworkspace-mcp
com.clauxel.codegworkspace
A paid remote MCP for CodeG, built to return verdicts, receipts, usage logs, and audit-ready JSON.
Code Execution Developer Tools
2

Related MCP Servers

mcp-rules-server
Code Analysis Developer Tools
camoran89
F
license
Not graded
quality
D
maintenance
MCP server that provides code validation rules and analysis for various stacks/frameworks, enabling automated code reviews and reporting directly from VS Code and other editors.
Updated 3 months ago (2026-06-19 15:30 UTC)
-
gitl
Version Control Code Analysis CI/CD & DevOps
akomyagin
A
license
Not graded
quality
A
maintenance
AI code reviews and git activity digests with machine-readable risk scoring, available as an MCP server for use within an agent session.
Updated 5 days ago (2026-09-08 14:16 UTC)
1
MIT
Obra CTO
Code Analysis Testing & QA Tools Security
lilycip
A
license
A
quality
B
maintenance
A local-first MCP server that scores your codebase's Build Readiness by reading code and running tests on your machine, outputting a diligence-grade score and risk register without uploading your source.
Updated 2 months ago (2026-07-04 15:17 UTC)
5
77 npm
Apache 2.0
bouncer
Legal & Compliance Code Analysis
nugehs
A
license
Not graded
quality
C
maintenance
Static compliance-controls checker that verifies regulatory required controls exist in code, running deterministic rule packs via MCP tools for compliance checks, rule listing, and explanation.
Updated 3 months ago (2026-06-16 12:17 UTC)
124 npm
MIT