Pinner MCP 📍

@safedep

About Pinner MCP 📍

Model Context Protocol (MCP) server to pin components to their immutable version

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "pinner-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-it",
        "--rm",
        "ghcr.io/safedep/pinner-mcp:latest"
      ]
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Pinner MCP 📍?

Pinner MCP 📍 is a Model Context Protocol (MCP) server for pinning third‑party dependencies to immutable digests. It supports Docker base images and GitHub Actions and is aimed at developers and security engineers who want to enforce dependency integrity in CI/CD pipelines. The server was originally built to protect the vet tool from malicious GitHub Actions.

How to use Pinner MCP 📍?

Run the server as a container with stdio transport: docker run -it --rm ghcr.io/safedep/pinner-mcp:latest. Configure it in VS Code (.vscode/mcp.json) or Cursor (.cursor/mcp.json) using the same Docker command. Then use prompts such as “Pin GitHub Actions to their commit hash” or “Pin container base images to digests” via GitHub Copilot Chat or Cursor Composer to pin or update pinned versions.

Key features of Pinner MCP 📍?

Pins Docker base images to immutable digests.
Pins GitHub Actions to commit hashes.
Runs as a lightweight container with stdio transport.
Integrates with VS Code and Cursor via MCP configuration.
Supports updating pinned versions with natural language prompts.
Automatically published as latest image on GitHub Container Registry.

Use cases of Pinner MCP 📍?

Locking CI/CD pipeline dependencies to prevent supply‑chain attacks.
Enforcing reproducible builds by pinning container base images.
Auditing and fixing GitHub Actions versions in repository workflows.
Updating all pinned dependencies in a project with a single prompt.

FAQ from Pinner MCP 📍

What dependency types does Pinner MCP 📍 support?

It supports Docker base images and GitHub Actions.

How do I run Pinner MCP 📍?

Run the container image with docker run -it --rm ghcr.io/safedep/pinner-mcp:latest using stdio transport.

How do I configure Pinner MCP 📍 in VS Code or Cursor?

Add an entry to your .vscode/mcp.json or .cursor/mcp.json file with the Docker command as shown in the README, and ensure GitHub Copilot or MCP is enabled.

How do I update Pinner MCP 📍 to the latest

Frequently asked questions

What dependency types does Pinner MCP 📍 support?

It supports Docker base images and GitHub Actions.

How do I run Pinner MCP 📍?

Run the container image with `docker run -it --rm ghcr.io/safedep/pinner-mcp:latest` using stdio transport.

How do I configure Pinner MCP 📍 in VS Code or Cursor?

Add an entry to your `.vscode/mcp.json` or `.cursor/mcp.json` file with the Docker command as shown in the README, and ensure GitHub Copilot or MCP is enabled.