{
  "markdown": "# Docker Compose Security Audit\n\n> MCP server that audits `docker-compose.yml` files for security misconfigurations. Trivy-grade check catalog, designed for AI agents — every finding ships with a severity rating, full remediation text, and a YAML fix snippet you can paste.\n\n**Built by [Unbearable Labs](https://github.com/UnbearableDev). Pay-per-event pricing — you only pay when an audit runs.**\n\n---\n\n## Available on\n\n- [Apify Actor Store](https://apify.com/unbearable_dev/docker-compose-audit) — primary, metered usage (PPE)\n- MCPize — *pending submission*\n- MCP.so — *pending submission*\n- PulseMCP — *pending submission*\n- Smithery — *pending submission*\n- Glama — *pending submission*\n\n**Newsletter:** [Unbearable TechTips Weekly](https://unbearabletechtips.beehiiv.com) · **All Actors:** [github.com/UnbearableDev](https://github.com/UnbearableDev)\n\n## What it does\n\nPoint any MCP-capable client (Claude Desktop, Cursor, n8n, Make, Zapier, custom agents) at this server, hand it the contents of a `docker-compose.yml`, and get back a structured report with:\n\n- **Severity** — high / medium / low / info\n- **Service** — which compose service the finding affects\n- **Description** — what's wrong and why it matters\n- **Remediation** — what to do about it\n- **Fix snippet** — YAML you can paste directly into the file\n\n## Tools\n\n| Tool | Purpose |\n|------|---------|\n| `audit_compose(compose_yaml? \\| compose_url?, min_severity='low')` | Run all checks, return full report |\n| `check_privilege(...)` | Container privilege & capability issues only |\n| `check_network(...)` | Network exposure issues only |\n| `check_filesystem(...)` | Volume mount & filesystem issues only |\n| `check_secrets(...)` | Secret hygiene issues only |\n| `check_resources(...)` | Resource limit issues only |\n| `check_image_hygiene(...)` | Image tag / registry / pinning issues only |\n| `check_runtime_lifecycle(...)` | Healthcheck / restart / init issues only |\n| `check_logging(...)` | Logging driver / rotation issues only |\n| `check_compose_hygiene(...)` | Deprecated fields / Compose-spec hygiene only |\n| `list_checks(category?)` | Browse the full check catalog |\n\nAll audit-running tools accept the same input:\n- `compose_yaml` (string) — paste the YAML content directly, **OR**\n- `compose_url` (string) — public HTTPS URL to fetch (e.g. GitHub raw URL)\n\nProvide exactly one. `min_severity` defaults to `low` (drops `info` findings); set to `medium` or `high` to filter further.\n\n## Example response (truncated)\n\n```json\n{\n  \"summary\": {\n    \"total_findings\": 14,\n    \"by_severity\": {\"high\": 3, \"medium\": 6, \"low\": 5, \"info\": 0},\n    \"by_category\": {\"privilege\": 4, \"network\": 3, \"secrets\": 2, \"...\": 5}\n  },\n  \"findings\": [\n    {\n      \"id\": \"DCS-002\",\n      \"category\": \"privilege\",\n      \"severity\": \"high\",\n      \"service\": \"web\",\n      \"title\": \"Privileged mode enabled\",\n      \"description\": \"Service 'web' has `privileged: true`...\",\n      \"remediation\": \"Remove `privileged: true`. If you need specific capabilities...\",\n      \"fix_yaml_snippet\": \"    # remove `privileged: true`; if needed, use cap_add or devices selectively\",\n      \"references\": [\"CIS-Docker-5.4\", \"NIST-800-190\"]\n    },\n    ...\n  ]\n}\n```\n\n## Pricing\n\n| Event | USD |\n|-------|-----|\n| Any audit / check_* tool call | $0.02 |\n| `list_checks` discovery call | $0.005 |\n\nYou pay only when a tool is invoked. No subscription, no monthly minimums.\n\n## Check catalog (25 live in v1, growing toward 54)\n\n| Category | Live checks |\n|----------|------------|\n| **Privilege** | Root user (DCS-001), privileged mode (DCS-002), dangerous capabilities (DCS-003), `cap_add: ALL` (DCS-004), `cap_drop: ALL` missing (DCS-005), `no-new-privileges` missing (DCS-006) |\n| **Network** | `network_mode: host` (DCS-010), port bound to 0.0.0.0 (DCS-011), SSH port exposed (DCS-013), DB port exposed (DCS-014) |\n| **Filesystem** | `/var/run/docker.sock` mount (DCS-018), host root mount (DCS-019), sensitive host paths (DCS-020) |\n| **Secrets** | Hardcoded secret in env (DCS-026), secret-pattern env without Docker secrets (DCS-027) |\n| **Resources** | No memory limit (DCS-032), no CPU limit (DCS-033), no PID limit (DCS-034) |\n| **Image hygiene** | Unpinned / `:latest` image (DCS-037) |\n| **Runtime lifecycle** | No healthcheck (DCS-043), no restart policy (DCS-044) |\n| **Logging** | No log driver (DCS-048), no log rotation (DCS-049) |\n| **Compose hygiene** | Deprecated `version:` field (DCS-051), `depends_on` without healthcheck condition (DCS-052) |\n\nUse `list_checks` to get the canonical, up-to-date catalog with IDs, severities, and titles.\n\n## Connecting from Claude Desktop\n\nAdd to your MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"compose-audit\": {\n      \"transport\": \"streamable-http\",\n      \"url\": \"https://YOUR-ACTOR-URL.apify.actor/mcp\"\n    }\n  }\n}\n```\n\n(Replace `YOUR-ACTOR-URL` with the Standby URL shown on the Apify Store page after you start the Actor.)\n\n## Limits\n\n- **YAML size:** 1 MB cap per audit call\n- **URL fetch:** 5-second timeout, max 3 redirects, HTTPS only\n- **Session timeout:** 5 minutes of inactivity\n\n## What's NOT covered (yet)\n\nPure static analysis of the compose file only. Out of scope for this version:\n- Image vulnerability scanning (use Trivy / Grype for that)\n- Live container inspection\n- Kubernetes / Helm manifests (different surface)\n- Dockerfile-specific lint (use Hadolint)\n\nThe next 29 checks on the v1.x → v2 roadmap include build-context security, additional capability checks, secret-pattern detection in build args, and registry trust verification.\n\n## Source / contact\n\nIssues, ideas, or false-positive reports: open an issue on the [GitHub repo](https://github.com/UnbearableDev) or email `unbearabledev@gmail.com`.\n\nget the weekly newsletter(https://unbearabletechtips.beehiiv.com).\n",
  "bytes": 5789,
  "sha": "23e02b68a5ceaf7e4fe21171c5e7e740b3f16008682cd02480bfaa3a9bdb8f98",
  "repo_slug": "unbearabledev/docker-compose-audit",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_unbearabledev_docker_compose_a_6d572330/readme"
}