mcpField
D
Dockerfile Security Audit

Dockerfile Security Audit

Remote
github.com/tylerscomic-labSecurity0Updated 4w ago
Repository

About Dockerfile Security Audit

An MCP server for developers and security reviewers that parses Dockerfile structure to find container-security issues. It focuses on the final build stage and returns findings with locations, explanations, and concrete fixes.

Key features

  1. 01Parses multi-stage and continued instructions
  2. 02Checks USER in the final stage
  3. 03Finds likely secrets baked into images
  4. 04Detects curl or wget piped to shells
  5. 05Checks for unpinned base image tags
  6. 06Flags ADD instructions with remote URLs

Use cases

  1. 01Audit Dockerfiles before publishing images
  2. 02Check whether containers may run as root
  3. 03Find potential secrets in Dockerfile instructions

MCP support

Provides the `audit_dockerfile` tool to MCP clients, returning a risk level, finding locations, explanations, and concrete fixes.

Configuration

Remote servers need no local install. Pick your client, then copy the config or install in one click.

Endpointhttps://dockerfile-audit-mcp.mcpize.run/mcp
Copy install command
Claude CodeTerminal
Cursor.cursor/mcp.json
VS Code.vscode/mcp.json
Claude Desktopclaude_desktop_config.json
Windsurf~/.codeium/windsurf/mcp_config.json

Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.

Tools

Details

From the project README

dockerfile-audit-mcp

License: MIT Live on MCPize

An MCP server that audits Dockerfiles for real container-security anti-patterns. Parses actual Dockerfile structure (instructions, backslash line continuations, multi-stage builds) via a hand-written parser, not regex over the raw text.

What it catches

Missing USER. If the final stage that actually ships has no USER instruction (or explicitly sets USER root), every process in the running container has root privileges by default. Correctly checks only the final stage — matching real linter convention (hadolint's DL3002), since multi-stage builds exist specifically so earlier build-only stages' root steps never ship.

Baked-in secrets. ENV/ARG values assigned to secret-shaped names (API_KEY, PASSWORD, *_TOKEN, STRIPE_*_KEY, etc.) land permanently in the image's layer history — visible via docker history --no-trunc to anyone who pulls the image, even after a later layer unsets the variable. Placeholder-looking values (<your-key>, changeme) and bare ARG declarations with no default are correctly not flagged.

curl | sh / wget | bash. Pipes a remote script directly into a shell at build time with no integrity check — if the host is compromised or the script changes, every future build silently pulls in whatever it now serves.

Unpinned base images. :latest or no tag at all means the base your image builds on can change between builds with nothing in the Dockerfile to explain why.

ADD with a remote URL. Same unverified-fetch problem as curl | sh, via a different instruction.

Tools

audit_dockerfile

Full audit. Returns a risk level and every finding with its exact location, why it matters, and a concrete fix.

Use it

Hosted (recommended): MCPize — free tier, $7/mo Pro.

Self-host:

npm install
node server.js

Part of a small suite

github-actions-audit-mcp, regex-safety-audit-mcp, secrets-leak-audit-mcp, mcp-trust-audit-mcp.

License

MIT

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.