Pinner Mcp

Pinner Mcp

What is Pinner Mcp about?

Pinner Mcp provides an MCP server that resolves and pins external components (container base images, GitHub Actions) to their immutable versions (image digests or commit hashes). By converting mutable references to fixed identifiers, it helps maintain secure and repeatable CI/CD pipelines.

How to use Pinner Mcp?

1. Run the server as a Docker container using the standard stdio transport:

   docker run -it --rm ghcr.io/safedep/pinner-mcp:latest
   

2. Configure Cursor (or any MCP‑compatible client) by adding the server definition to .cursor/mcp.json:

   {
     "mcpServers": {
       "pinner-mcp-stdio-server": {
         "command": "docker",
         "args": ["run", "--rm", "-i", "ghcr.io/safedep/pinner-mcp:latest"]
       }
     }
   }
   

3. Interact via prompts such as:
   • Pin GitHub Actions to their commit hash
   • Pin container base images to digests
   • Update pinned versions of container base images
4. Update the container image when new releases are published:

   docker pull ghcr.io/safedep/pinner-mcp:latest
   

Key features of Pinner Mcp

• Supports Docker base image digest resolution.
• Supports GitHub Actions commit‑hash pinning.
• Works with any MCP‑compatible client (e.g., Cursor).
• Simple container‑only deployment; no additional runtime dependencies.
• Automatic upstream updates via the latest tag on GitHub Container Registry.

Use cases of Pinner Mcp

• Supply‑chain security: Freeze CI/CD dependencies to immutable versions, preventing accidental or malicious upgrades.
• Reproducible builds: Ensure builds produce identical artifacts across environments and over time.
• Compliance auditing: Track exact versions used in pipelines for regulatory or internal audits.
• Team onboarding: Provide a shared source of truth for dependency versions across developers.

FAQ from the Pinner Mcp

• Q: Do I need to rebuild the image after each pinning operation? A: No. The MCP server runs as a long‑living process; pinning requests are handled on‑the‑fly.
• Q: Can I run the server outside Docker? A: Currently the distribution is container‑based, but the underlying Go implementation can be compiled and run natively.
• Q: How are updates handled? A: Pull the latest image tag (docker pull ghcr.io/safedep/pinner-mcp:latest) and restart the container.
• Q: Which dependency types are supported? A: Docker base images and GitHub Actions workflows.
• Q: Is authentication required? A: The server is stateless and does not require API keys; any MCP client can communicate over standard I/O.

Pinner MCP 📍

A Model Context Protocol (MCP) server that can help pin 3rd party dependencies to immutable digests. Supported dependency types include:

• Docker base images
• GitHub Actions

📦 Usage

Run as a container with stdio transport.

docker run -it --rm ghcr.io/safedep/pinner-mcp:latest

💻 Cursor

Add the following to your .cursor/mcp.json file. You must enable the MCP server in the settings. Learn more here.

{
  "mcpServers": {
    "pinner-mcp-stdio-server": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "ghcr.io/safedep/pinner-mcp:latest"
      ]
    }
  }
}

Use a Composer prompt like the following to pin a specific commit hash.

Pin GitHub Actions to their commit hash

Pin container base images to digests

To update pinned versions, you can use a prompt like the following.

Update pinned versions of container base images

🔄 Tool Updates

Updates for the MCP server are automatically pushed to the latest tag on GitHub Container Registry. You must manually update your local container image to the latest version.

docker pull ghcr.io/safedep/pinner-mcp:latest

📚 References

• Originally built to protect vet from malicious GitHub Actions
• mcp-go is a great library for building MCP servers
• Built and maintained by SafeDep Engineering