mcpField
P
Pinner MCP 📍

Pinner MCP 📍

Local
github.com/safedepSecurity13Updated 60w ago
Repository

About Pinner MCP 📍

Pinner MCP is an MCP server for pinning third-party dependencies to immutable digests, supporting Docker base images and GitHub Actions. It is for developers managing dependency versions through AI workflows.

Key features

  1. 01Pins Docker base image digests
  2. 02Pins GitHub Actions to commit hashes
  3. 03Updates pinned dependency versions
  4. 04Runs as a Docker container

Use cases

  1. 01Pin container base image versions
  2. 02Lock GitHub Actions to commits
  3. 03Update pinned versions in a project

MCP support

The MCP server runs over stdio and lets MCP clients pin and update versions of Docker base images and GitHub Actions.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "pinner": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/safedep/pinner-mcp:latest"
      ]
    }
  }
}
Run commanddocker run -i --rm ghcr.io/safedep/pinner-mcp:latest

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
ocighcr.io/safedep/pinner-mcp:latest

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

Pinner MCP 📍

A Model Context Protocol (MCP) server that can help pin 3rd party dependencies to immutable digests. Supported dependency types include:

  • Docker base images
  • GitHub Actions

Pinner MCP

📦 Usage

Run as a container with stdio transport.

docker run -it --rm ghcr.io/safedep/pinner-mcp:latest
💻 VS Code

Add the following to your .vscode/mcp.json file in your workspace. You must have the GitHub Copilot extension installed and enabled.

{
  "servers": {
    "pinner-mcp": {
      "type": "stdio",
      "command": "docker",
      "args": ["run", "--rm", "-i", "ghcr.io/safedep/pinner-mcp:latest"]
    }
  }
}

Use GitHub Copilot Chat with prompts like:

Pin GitHub Actions to their commit hash

Pin container base images to digests

To update pinned versions, you can use a prompt like the following:

Update pinned versions of container base images
💻 Cursor

Add the following to your .cursor/mcp.json file. You must enable the MCP server in the settings. Learn more here.

{
  "mcpServers": {
    "pinner-mcp-stdio-server": {
      "command": "docker",
      "args": ["run", "--rm", "-i", "ghcr.io/safedep/pinner-mcp:latest"]
    }
  }
}

Use a Composer prompt like the following to pin a specific commit hash.

Pin GitHub Actions to their commit hash

Pin container base images to digests

To update pinned versions, you can use a prompt like the following.

Update pinned versions of container base images
🔄 Tool Updates

Updates for the MCP server are automatically pushed to the latest tag on GitHub Container Registry. You must manually update your local container image to the latest version.

docker pull ghcr.io/safedep/pinner-mcp:latest

🔧 Development

Building Locally

For local development on this project, build the container image locally:

docker build -t pinner-mcp:local .

The .vscode/mcp.json and .cursor/mcp.json files in this repository are configured to use the local image (pinner-mcp:local) for development and testing of unpublished changes.

After building locally, you can use VS Code or Cursor with GitHub Copilot as described in the usage sections above.

📚 References

  • Originally built to protect vet from malicious GitHub Actions
  • mcp-go is a great library for building MCP servers
  • Built and maintained by SafeDep Engineering

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.