Secure Dependencies with Immutable Pinned Digests
MCP server to pin 3rd party dependencies like Docker images and GitHub Actions to immutable digests.
Why it matters
Enhance your software supply chain security by pinning third-party dependencies like Docker images and GitHub Actions to immutable digests or commit hashes. This prevents malicious code injection and ensures the integrity of your build process.
Outcomes
What it gets done
Pin Docker base images to immutable digests.
Pin GitHub Actions to specific commit hashes.
Update pinned dependency versions automatically.
Prevent supply chain attacks on your projects.
Install
Add it to your toolbox
Run in your project directory:
curl -fsSL https://spark.entire.vc/get/vb-pinner-mcp | bash Capabilities
Tools your agent gets
Pin Docker base images to immutable digests for supply chain security.
Pin GitHub Actions to their commit hashes to prevent supply chain attacks.
Update pinned versions of dependencies to newer immutable digests or hashes.
Overview
Pinner MCP Server
MCP server to pin 3rd party dependencies like Docker images and GitHub Actions to immutable digests. As a developer, I want to pin my dependencies to specific, immutable digests. For example, to run the Pinner MCP server, I can use the following command: ```bash docker run -it --rm ghcr.io/safedep/pinner-mcp:latest ``` This allows me to use AI tools like GitHub Copilot Chat to prompt actions such as: ``` Pin GitHub Actions to their commit hash ``` Or to pin container base images: ``` Pin container base images to digests ``` This helps in providing concrete, verifiable references for external code.
What it does
As a developer, I want to pin my dependencies to specific, immutable digests. For example, to run the Pinner MCP server, I can use the following command:
docker run -it --rm ghcr.io/safedep/pinner-mcp:latest
This allows me to use AI tools like GitHub Copilot Chat to prompt actions such as:
Pin GitHub Actions to their commit hash
Or to pin container base images:
Pin container base images to digests
This helps in providing concrete, verifiable references for external code.
Source README
Pinner MCP 📍
A Model Context Protocol (MCP) server that can help pin 3rd party dependencies to immutable digests.
Supported dependency types include:
- Docker base images
- GitHub Actions
📦 Usage
Run as a container with stdio transport.
docker run -it --rm ghcr.io/safedep/pinner-mcp:latest
💻 VS Code
Add the following to your .vscode/mcp.json file in your workspace. You must have the GitHub Copilot extension installed and enabled.
{
"servers": {
"pinner-mcp": {
"type": "stdio",
"command": "docker",
"args": ["run", "--rm", "-i", "ghcr.io/safedep/pinner-mcp:latest"]
}
}
}
Use GitHub Copilot Chat with prompts like:
Pin GitHub Actions to their commit hash
Pin container base images to digests
To update pinned versions, you can use a prompt like the following:
Update pinned versions of container base images
💻 Cursor
Add the following to your .cursor/mcp.json file. You must enable
the MCP server in the settings. Learn more here.
{
"mcpServers": {
"pinner-mcp-stdio-server": {
"command": "docker",
"args": ["run", "--rm", "-i", "ghcr.io/safedep/pinner-mcp:latest"]
}
}
}
Use a Composer prompt like the following to pin a specific commit hash.
Pin GitHub Actions to their commit hash
Pin container base images to digests
To update pinned versions, you can use a prompt like the following.
Update pinned versions of container base images
🔄 Tool Updates
Updates for the MCP server are automatically pushed to the latest tag on
GitHub Container Registry. You
must manually update your local container image to the latest version.
docker pull ghcr.io/safedep/pinner-mcp:latest
🔧 Development
Building Locally
For local development on this project, build the container image locally:
docker build -t pinner-mcp:local .
The .vscode/mcp.json and .cursor/mcp.json files in this repository are configured to use the local image (pinner-mcp:local) for development and testing of unpublished changes.
After building locally, you can use VS Code or Cursor with GitHub Copilot as described in the usage sections above.
📚 References
- Originally built to protect vet from malicious GitHub Actions
- mcp-go is a great library for building MCP servers
- Built and maintained by SafeDep Engineering
FAQ
Common questions
Discussion
Questions & comments · 0
Sign In Sign in to leave a comment.