Pinner MCP

🚀 Pinner MCP 📍

A Model Context Protocol (MCP) server designed to pin third - party dependencies to immutable digests. Supported dependency types include:

• Docker base images
• GitHub Actions

🚀 Quick Start

📦 Usage

Run as a container with stdio transmission.

docker run -it --rm ghcr.io/safedep/pinner-mcp:latest

💻 Cursor

Add the following content to your .cursor/mcp.json file. You must enable the MCP server settings. Learn more here.

{
  "mcpServers": {
    "pinner-mcp-stdio-server": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/safedep/pinner-mcp:latest"
      ]
    }
  }
}

Use prompts like the following to pin specific commit hashes.

Pin GitHub Actions to their commit hashes

Pin container base images to digests

To update the pinned versions, you can use prompts like the following.

Update the pinned versions of container base images

🔄 Tool Update

Updates to the MCP server are automatically pushed to the latest tag on the GitHub Packages Registry. You must manually update your local container image to the latest version.

docker pull ghcr.io/safedep/pinner-mcp:latest

📚 Documentation

• Initially built to protect vet from malicious GitHub Actions.
• mcp-go is a great library for building MCP servers.
• Developed and maintained by the SafeDep Engineering Team.