Dockerfile Security Audit MCP server
not respondingAudit Dockerfiles for root users, baked-in secrets, curl-pipe-shell and unpinned base images.
0 stars
Reviews
Write oneNobody has reviewed Dockerfile Security Audit yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Dockerfile Security Audit tools
Tool list not cached yet. `describe` through the gateway fetches it live.
Public scan report
scanner v0.1.10 · 2026-10-28 · same rubric, same numbers if you re-run it
- –Code scanremote-only server, no package to scann/a
- Live reliabilityremote unreachable: HTTP 5000/20
- –Tool poisoningtools not inspected (endpoint requires auth); not countedn/a
- Auth qualityno auth information5/15
- Maintenancelast push 27 days ago15/15
- Maintainer identityregistry namespace matches repository owner6/10
Findings (1)
- highRemote endpoint did not respond
reliability.unreachableHTTP 500
How Dockerfile Security Audit compares
Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 43/100
- higher than 7% of 915 Security servers
- Uptime
- 18%
- of our recent checks; the typical remote Security server answers 100%
- Response time
- 404 ms
- faster than 27% of 547 Security servers
Install Dockerfile Security Audit in Claude Code, Cursor or VS Code
claude mcp add --transport http dockerfile-audit-mcp https://dockerfile-audit-mcp.mcpize.run/mcp
What the publisher says
From the Dockerfile Security Audit repository's README, as published. We do not edit it. Read it on GitHub
dockerfile-audit-mcp
An MCP server that audits Dockerfiles for real container-security anti-patterns. Parses actual Dockerfile structure (instructions, backslash line continuations, multi-stage builds) via a hand-written parser, not regex over the raw text.
What it catches
Missing USER. If the final stage that actually ships has no USER instruction (or explicitly sets USER root), every process in the running container has root privileges by default. Correctly checks only the final stage — matching real linter convention (hadolint's DL3002), since multi-stage builds exist specifically so earlier build-only stages' root steps never ship.
Baked-in secrets. ENV/ARG values assigned to secret-shaped names (APIKEY, PASSWORD, TOKEN, STRIPE_*_KEY, etc.) land permanently in the image's layer history — visible via docker history --no-trunc to anyone who pulls the image, even after a later layer unsets the variable. Placeholder-looking values (, changeme) and bare ARG declarations with no default are correctly not flagged.
curl | sh / wget | bash. Pipes a remote script directly into a shell at build time with no integrity check — if the host is compromised or the script changes, every future build silently pulls in whatever it now serves.
Unpinned base images. :latest or no tag at all means the base your image builds on can change between builds with nothing in the Dockerfile to explain why.
ADD with a remote URL. Same unverified-fetch problem as curl | sh, via a different instruction.
Tools
audit_dockerfile
Full audit. Returns a risk level and every finding with its exact location, why it matters, and a concrete fix.
Use it
Hosted (recommended): MCPize — free tier, $7/mo Pro.
Self-host:
npm install
node server.jsPart of a small suite
github-actions-audit-mcp, regex-safety-audit-mcp, secrets-leak-audit-mcp, mcp-trust-audit-mcp.
License
MIT
Nothing above is checked by us. What we check is on the safety report.
Grade history
- 2026-10-28downgradeA → Dscore 43: Remote endpoint did not respond
Dockerfile Security Audit: common questions
- Is Dockerfile Security Audit MCP server safe?
- Not recommended: it is graded D (43/100). Read the Dockerfile Security Audit safety report
- How do I install Dockerfile Security Audit?
- It runs remotely at dockerfile-audit-mcp.mcpize.run. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
- Does Dockerfile Security Audit need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Dockerfile Security Audit maintained?
- The last commit was 34 days ago (2026-10-01). The latest release is v1.0.0.
- Is Dockerfile Security Audit up?
- 18% of our last 28 checks got an answer. We check remote servers about four times a day.
- What can I use instead of Dockerfile Security Audit?
- Servers from other publishers that do the same job: Skylos MCP server, Wireshark MCP server and Mastyf AI MCP server.
- How does Dockerfile Security Audit compare with other Security MCP servers?
- safety score 43/100 (higher than 7% of 915 Security servers); uptime 18% (of our recent checks; the typical remote Security server answers 100%); response time 404 ms (faster than 27% of 547 Security servers). Full comparison.
Alternatives to Dockerfile Security Audit
Same job from other publishers: the closest match first, then the best rated.
- SkylosDead code, security, secrets detection and code quality for Python, TypeScript, Go.not reviewedEstablishedC
- WiresharkProfessional network analysis with tshark. Security audits, deep-dives, and threat detection.not reviewedEstablishedA
- Mastyf AIRuntime proxy for MCP security, cost governance & auditnot reviewedGrowingB
- GuardvibeDeterministic security layer your AI can't be. 644 rules, 39 tools, CLI + doctor + host audit.not reviewedGrowingC
- npm Registry MCP Servernpm registry MCP server — package intelligence, security audits, dependency analysisnot reviewedGrowingB
