D
Dockerfile Audit
Hadolint-grade Dockerfile audit — 19 checks: secrets, privileges, supply chain, hygiene.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Manual Client & Custom JSON ConfigExpand JSON ▾
Install Config Generator
Choose your client
💡 Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)
Documentation Overview
Dockerfile Security & Quality Audit
Hadolint-grade Dockerfile audit as an MCP server. 18+ checks across 5 categories, every finding ships with severity, line number, remediation text, and a copy-paste Dockerfile snippet.
Built by Unbearable Labs. Pay-per-event pricing — only billed when a tool is actually called.
Available on
- Apify Actor Store — primary, metered usage (PPE)
- MCPize — pending submission
- MCP.so — pending submission
- PulseMCP — pending submission
- Smithery — pending submission
- Glama — pending submission
Newsletter: Unbearable TechTips Weekly · All Actors: github.com/UnbearableDev
What it does
Point any MCP-capable client (Claude Desktop, Cursor, n8n, Make, Zapier, custom agents) at this server, hand it a Dockerfile, get back a structured report:
- Severity — high / medium / low / info
- Line number — exact location in the file
- Description — what's wrong and why it matters
- Remediation — what to do about it
- Fix snippet — Dockerfile syntax you can paste directly
Tools
| Tool | Purpose |
|---|---|
audit_dockerfile(dockerfile_content? | dockerfile_url?, min_severity='low') | Run all checks |
check_base_image(...) | FROM/tag/digest/registry checks only |
check_instructions(...) | CMD form, ADD vs COPY, MAINTAINER, etc. |
check_security(...) | USER, sudo, chmod 777, curl|bash, hardcoded secrets, HEALTHCHECK |
check_efficiency(...) | apt cache hygiene, pip caching |
check_secrets(...) | ARG with secret-pattern names |
list_checks(category?) | Browse the full check catalog |
Provide exactly one of dockerfile_content (paste the file) or dockerfile_url (HTTPS URL — e.g. GitHub raw).
Check catalog (v1: 18 checks across 5 categories)
| ID | Category | Severity | Title |
|---|---|---|---|
| DFA-001 | base_image | medium | Image uses :latest tag or no tag |
| DFA-002 | base_image | info | No SHA256 digest pin on FROM |
| DFA-003 | base_image | medium | Untrusted registry |
| DFA-010 | instructions | low | CMD in shell form |
| DFA-011 | instructions | low | ENTRYPOINT in shell form |
| DFA-012 | instructions | info | MAINTAINER instruction is deprecated |
| DFA-013 | instructions | medium | ADD used where COPY would suffice |
| DFA-020 | security | medium | No USER directive (runs as root) |
| DFA-021 | security | high | USER root set explicitly |
| DFA-022 | security | high | sudo invoked in RUN |
| DFA-023 | security | high | chmod 777 in RUN |
| DFA-024 | security | medium | curl|bash pattern in RUN |
| DFA-025 | security | high | Hardcoded secret in ENV |
| DFA-027 | security | low | No HEALTHCHECK |
| DFA-030 | efficiency | low | apt-get update without install |
| DFA-031 | efficiency | low | apt-get install without --no-install-recommends |
| DFA-032 | efficiency | low | pip install without --no-cache-dir |
| DFA-040 | secrets | medium | ARG with secret-pattern name |
Use list_checks to get the canonical, up-to-date catalog.
Pricing
| Event | USD |
|---|---|
| Any audit / check_* tool call | $0.02 |
list_checks discovery | $0.005 |
Example response (truncated)
Connecting from Claude Desktop
Limits
- Dockerfile size: 200 KB cap per audit
- URL fetch: 5s timeout, max 3 redirects, HTTPS only
- Session timeout: 5 minutes of inactivity
What's NOT covered (yet)
- Live image vulnerability scanning (use Trivy / Grype for that)
- Multi-stage build optimization analysis (DFA-004 / DFA-005 — roadmapped)
- Compose-file audit (separate MCP:
docker-compose-audit)
Sibling MCPs from Unbearable Labs
docker-compose-audit— same pattern fordocker-compose.ymlhu-postcode-validator— Hungarian postcode lookup
Source / contact
Issues and ideas: unbearabledev@gmail.com or the GitHub org UnbearableDev.
Related MCP Servers
Frequently Asked Questions about Dockerfile Audit
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/dockerfile-audit)HTML Embed
<a href="https://allmcps.com/mcp/dockerfile-audit"><img src="https://allmcps.com/api/badge/dockerfile-audit?style=directory" alt="Dockerfile Audit on AllMCPs" /></a>Technical Specs & Signals
CategorySecurity
0/4 checks healthy over the last 6h
27Quality signal: Emerging · 27/100How this signal is calculated ▾
Server availabilityNot measured
Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership8/20
Documentation & tools11/30
Adoption & activity1/15
Community engagement0/10
A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to get the verified badge and attach your website.
Free dofollow backlink: after claiming, verify your product site and place a dofollow AllMCPs badge — we recheck it stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.