Dockerfile Security Audit

Audit Dockerfiles for root users, baked-in secrets, curl-pipe-shell and unpinned base images.

Connector by tylerscomic-lab · GitHub account verified by the MCP Registry

IndexedMITRemote (HTTP)

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/tylerscomic-lab-dockerfile-audit-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Remote endpoint

https://dockerfile-audit-mcp.mcpize.run/mcp Remote (HTTP)

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Audit Dockerfiles for root users, baked-in secrets, curl-pipe-shell and unpinned base images.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools: 1 read · 0 write · 0 deleteRead-only
Secrets: None asked for
Install scripts: Nothing to install (hosted)
Runs as: Hosted (remote endpoint)

Tools by what they do 1

Read from the source code; the running server may list different tools.

Read 1 · Look things up without changing anything.

audit_dockerfile

Network hosts it talks to 1

dockerfile-audit-mcp.mcpize.run · found in remote endpoint, install command

Tools (1)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

audit_dockerfile
Audits a Dockerfile for real, documented container-security anti-patterns: no USER instruction (every step runs as root by default), credentials baked into ENV/ARG (permanently visible in image layer history via `docker history`, even after later layers unset them), `curl | sh` / `wget | sh` patterns (unpinned, unverified remote code execution at build time), unpinned `:latest` or untagged base images (non-reproducible builds), and ADD instructions that fetch a remote URL with no checksum. Handles multi-stage builds (checks each stage separately) and backslash line continuations.

Signals

Stars: 0
Forks: 0
Open issues: 0
Last commit: Oct 1, 2026 (27 days ago)
Last release: Oct 1, 2026 (27 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name: io.github.tylerscomic-lab/dockerfile-audit-mcp
Version: 1.0.0
Auth: Auth not stated
License: MIT
Repository: github.com/tylerscomic-lab/dockerfile-audit-mcp
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: Official MCP Registry github-graphql

Rank

of 44,833 in Connectors

Score

0.582

Security 30%not yet
Popularity 25%0.29
Freshness 20%1.00
Rating 15%not yet
Docs 10%0.83

How ranking works →

Grades

Freshness

Active in the last 30 days. Last activity 27 days ago.

–

Security

Security scan: in progress. Grades from our dependency, secret, code and prompt-injection checks appear here once they launch. Until then, check the code before you install.

Indexed

Found automatically from a public source. Not yet claimed by its publisher.

How grades work →

Availability

100% uptime, last 30 days (1 check)

Last check: 4 days ago
Status: Up, asks for a login or key
Median response: 950 ms

Up
Up, auth required
Down
Not checked
No data

A daily MCP handshake with the remote endpoint. “Auth required” means it answered and wants a login or key. “Not checked” means the URL needs your own account or blocks automated checks.

Is this yours?

Claim it to add pricing, screenshots and docs, and to get a verified badge.

Claim listing Suggest a fix

Report a security problem

More from tylerscomic-lab

Cite this page

Dockerfile Security Audit MCP server. Agent Mart. https://agentmart.dev/connectors/tylerscomic-lab-dockerfile-audit-mcp (last updated 2026-10-24)