About Pinner MCP
Pinner MCP is an MCP server published by safedep in the Developer Tools category: model Context Protocol (MCP) server to pin components to their immutable version.
The repository has 13 stars and 4 forks, with the last commit a year ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.
Install
git clone https://github.com/safedep/pinner-mcpThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Ask AI
Ask AI about Pinner MCP
Powered by Claude · Grounded in docs
Security checks
Static checks derived from the repository 6 days ago. Heuristics on the source, not an audit.
- ✓README presentThe repository ships documentation.
- ✓License declaredUsable under a stated license.
- ✓Tests presentA test suite exists in the repository.
- ✓Dependencies pinnedA lockfile pins dependency versions.
- ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.
- !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.
README
Pinner MCP 📍
A Model Context Protocol (MCP) server that can help pin 3rd party dependencies to immutable digests. Supported dependency types include:
- Docker base images
- GitHub Actions
📦 Usage
Run as a container with stdio transport.
docker run -it --rm ghcr.io/safedep/pinner-mcp:latest
💻 VS Code
Add the following to your .vscode/mcp.json file in your workspace. You must have the GitHub Copilot extension installed and enabled.
{
"servers": {
"pinner-mcp": {
"type": "stdio",
"command": "docker",
"args": ["run", "--rm", "-i", "ghcr.io/safedep/pinner-mcp:latest"]
}
}
}
Use GitHub Copilot Chat with prompts like:
Pin GitHub Actions to their commit hash
Pin container base images to digests
To update pinned versions, you can use a prompt like the following:
Update pinned versions of container base images
💻 Cursor
Add the following to your .cursor/mcp.json file. You must enable
the MCP server in the settings. Learn more here.
{
"mcpServers": {
"pinner-mcp-stdio-server": {
"command": "docker",
"args": ["run", "--rm", "-i", "ghcr.io/safedep/pinner-mcp:latest"]
}
}
}
Use a Composer prompt like the following to pin a specific commit hash.
Pin GitHub Actions to their commit hash
Pin container base images to digests
To update pinned versions, you can use a prompt like the following.
Update pinned versions of container base images
🔄 Tool Updates
Updates for the MCP server are automatically pushed to the latest tag on
GitHub Container Registry. You
must manually update your local container image to the latest version.
docker pull ghcr.io/safedep/pinner-mcp:latest
🔧 Development
Building Locally
For local development on this project, build the container image locally:
docker build -t pinner-mcp:local .
The .vscode/mcp.json and .cursor/mcp.json files in this repository are configured to use the local image (pinner-mcp:local) for development and testing of unpublished changes.
After building locally, you can use VS Code or Cursor with GitHub Copilot as described in the usage sections above.
📚 References
- Originally built to protect vet from malicious GitHub Actions
- mcp-go is a great library for building MCP servers
- Built and maintained by SafeDep Engineering
README fetched from the repository 6 days ago. The original is authoritative.