How do I install Dockerfile Security Audit?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Dockerfile Security Audit need an API key?

No required environment variable is listed on this record.

What transport does Dockerfile Security Audit use?

Dockerfile Security Audit is reached over HTTP.

When was Dockerfile Security Audit last checked?

Last checked 2026-11-10. Audit Dockerfiles for root users, baked-in secrets, curl-pipe-shell and unpinned base images.

Dockerfile Security Audit MCP server

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://dockerfile-audit-mcp.mcpize.run/mcp

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http io.github.tylerscomic-lab-dockerfile-audit-mcp https://dockerfile-audit-mcp.mcpize.run/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.tylerscomic-lab-dockerfile-audit-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://dockerfile-audit-mcp.mcpize.run/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Remote

Transport: http
Version: 1.0.0
Last checked

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

dockerfile-audit-mcp

An MCP server that audits Dockerfiles for real container-security anti-patterns. Parses actual Dockerfile structure (instructions, backslash line continuations, multi-stage builds) via a hand-written parser, not regex over the raw text.

What it catches

Missing USER. If the final stage that actually ships has no USER instruction (or explicitly sets USER root), every process in the running container has root privileges by default. Correctly checks only the final stage — matching real linter convention (hadolint's DL3002), since multi-stage builds exist specifically so earlier build-only stages' root steps never ship.

Baked-in secrets. ENV/ARG values assigned to secret-shaped names (API_KEY, PASSWORD, *_TOKEN, STRIPE_*_KEY, etc.) land permanently in the image's layer history — visible via docker history --no-trunc to anyone who pulls the image, even after a later layer unsets the variable. Placeholder-looking values (<your-key>, changeme) and bare ARG declarations with no default are correctly not flagged.

curl | sh / wget | bash. Pipes a remote script directly into a shell at build time with no integrity check — if the host is compromised or the script changes, every future build silently pulls in whatever it now serves.

Unpinned base images. :latest or no tag at all means the base your image builds on can change between builds with nothing in the Dockerfile to explain why.

ADD with a remote URL. Same unverified-fetch problem as curl | sh, via a different instruction.

Tools

audit_dockerfile

Full audit. Returns a risk level and every finding with its exact location, why it matters, and a concrete fix.

Use it

Hosted (recommended): MCPize — free tier, $7/mo Pro.

Self-host:

npm install node server.js

Part of a small suite

License

MIT

Dockerfile Security Audit

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Dockerfile Security Audit?

Does Dockerfile Security Audit need an API key?

What transport does Dockerfile Security Audit use?

When was Dockerfile Security Audit last checked?

Documentation

dockerfile-audit-mcp

What it catches

Tools

`audit_dockerfile`

Use it

Part of a small suite

License