Skip to main content
Glama
Sign In
dockerfile-audit-mcp

dockerfile-audit-mcp

by tylerscomic-lab
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

dockerfile-audit-mcp

License: MIT Live on MCPize

An MCP server that audits Dockerfiles for real container-security anti-patterns. Parses actual Dockerfile structure (instructions, backslash line continuations, multi-stage builds) via a hand-written parser, not regex over the raw text.

What it catches

Missing USER. If the final stage that actually ships has no USER instruction (or explicitly sets USER root), every process in the running container has root privileges by default. Correctly checks only the final stage — matching real linter convention (hadolint's DL3002), since multi-stage builds exist specifically so earlier build-only stages' root steps never ship.

Baked-in secrets. ENV/ARG values assigned to secret-shaped names (API_KEY, PASSWORD, *_TOKEN, STRIPE_*_KEY, etc.) land permanently in the image's layer history — visible via docker history --no-trunc to anyone who pulls the image, even after a later layer unsets the variable. Placeholder-looking values (<your-key>, changeme) and bare ARG declarations with no default are correctly not flagged.

curl | sh / wget | bash. Pipes a remote script directly into a shell at build time with no integrity check — if the host is compromised or the script changes, every future build silently pulls in whatever it now serves.

Unpinned base images. :latest or no tag at all means the base your image builds on can change between builds with nothing in the Dockerfile to explain why.

ADD with a remote URL. Same unverified-fetch problem as curl | sh, via a different instruction.

Related MCP server: EVIDIQ Bastion

Tools

audit_dockerfile

Full audit. Returns a risk level and every finding with its exact location, why it matters, and a concrete fix.

Use it

Hosted (recommended): MCPize — free tier, $7/mo Pro.

Self-host:

npm install
node server.js

Part of a small suite

github-actions-audit-mcp, regex-safety-audit-mcp, secrets-leak-audit-mcp, mcp-trust-audit-mcp.

License

MIT

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    This server cannot be deployed

    Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

    Maintenance

    ActivitySlowing
    ResponsivenessOutdated data

    Resources

    Related MCP Connectors

    Related MCP Servers

    • EVIDIQ Bastion

      EVIDIQ Bastionofficial

      evidiq
      A
      license
      Not graded
      quality
      B
      maintenance
      Audits infrastructure configurations (Dockerfiles, GitHub Actions, Kubernetes, Terraform/Compose) against 14 deterministic security rules, returning BLOCK/REVIEW/PASS verdicts and signing attestations. Helps agents verify deployment configs before applying them.
      1
      MIT

    • Dockerfile Check

      arhancanli
      A
      license
      A
      quality
      C
      maintenance
      Enables agents to validate Dockerfiles for build-breaking syntax errors, risky patterns like root users and secrets in ENV/ARG, and cache-order problems, returning every finding with its line and a fix. It also verifies referenced container images against public registries, reporting tag existence, digests to pin, supported platforms, last rebuild time, and end-of-life status with an upgrade tag.
      2
      1
      MIT

    • locklens

      ThomasMehta
      A
      license
      Not graded
      quality
      A
      maintenance
      Enables auditing npm, Yarn, and pnpm lockfiles in local project directories or remote Git repositories to surface dependency vulnerabilities. Exposes a tool that supports severity thresholds, registry overrides, optional dev-dependency skipping, and text or JSON reports.
      12 npm
      MIT