{
  "markdown": "# Unbearable IaC Audit Pack\r\n\r\n**Unbearable IaC Audit Pack** — all four audit Actors under one MCP endpoint. Snyk-comparable scope at a fraction of the cost. Pay-per-event — only billed when a tool is actually called.\r\n\r\n64 checks. 20 categories. 4 audit engines. 1 MCP endpoint.\r\n\r\n---\r\n\r\n## What's included\r\n\r\n| Package | Checks | Categories | Primary tool |\r\n|---------|--------|------------|--------------|\r\n| Docker Compose audit | 25 | 9 | `audit_compose` |\r\n| Dockerfile audit | 19 | 5 | `audit_dockerfile` |\r\n| GitHub Actions audit | 21 | 6 | `audit_github_actions` |\r\n| HU Postcode Validator | 5 tools | — | `validate_postcode`, `lookup_city`, … |\r\n\r\nPlus two bundle-only tools:\r\n- **`audit_all`** — paste a dict of filenames → content; auto-detects Dockerfile, compose, and workflow files and runs the right audit on each\r\n- **`list_all_checks`** — full cross-package check catalog in one call\r\n\r\n## Quick start (Claude Desktop)\r\n\r\n```json\r\n{\r\n  \"mcpServers\": {\r\n    \"iac-audit-pack\": {\r\n      \"type\": \"http\",\r\n      \"url\": \"https://unbearable-dev--iac-audit-pack.apify.actor/mcp\",\r\n      \"headers\": {\r\n        \"Authorization\": \"Bearer <your-apify-token>\"\r\n      }\r\n    }\r\n  }\r\n}\r\n```\r\n\r\n## Tool catalog\r\n\r\n### Aggregation (bundle-only)\r\n\r\n| Tool | Description |\r\n|------|-------------|\r\n| `audit_all(files, min_severity?)` | Multi-file detection + combined audit report |\r\n| `list_all_checks()` | All 64 checks across all three audit packages |\r\n\r\n### Docker Compose (25 checks, 9 categories)\r\n\r\n| Tool | Description |\r\n|------|-------------|\r\n| `audit_compose(compose_yaml?, compose_url?, min_severity?)` | Full 25-check audit |\r\n| `check_privilege` | Privileged mode, cap_add, user namespace |\r\n| `check_network` | Host networking, exposed dangerous ports |\r\n| `check_secrets` | Hardcoded passwords, tokens in env vars |\r\n| `check_filesystem` | Docker socket mounts, host path mounts |\r\n| `check_resources` | Missing memory/CPU limits |\r\n| `check_image_hygiene` | Unpinned tags, `latest` usage |\r\n| `check_runtime_lifecycle` | Restart policies, healthchecks |\r\n| `check_logging` | Logging driver config |\r\n| `check_compose_hygiene` | Version field, service naming |\r\n| `list_checks_compose(category?)` | Check catalog |\r\n\r\n### Dockerfile (19 checks, 5 categories)\r\n\r\n| Tool | Description |\r\n|------|-------------|\r\n| `audit_dockerfile(dockerfile_content?, dockerfile_url?, min_severity?)` | Full 19-check audit |\r\n| `check_base_image_dockerfile` | Unpinned base, `latest`, root user in FROM |\r\n| `check_instructions_dockerfile` | ADD vs COPY, COPY ordering, ENV secrets |\r\n| `check_security_dockerfile` | USER root, privilege escalation patterns |\r\n| `check_efficiency_dockerfile` | Layer count, cache busting |\r\n| `check_secrets_dockerfile` | Hardcoded secrets in RUN/ENV/ARG |\r\n| `list_checks_dockerfile(category?)` | Check catalog |\r\n\r\n### GitHub Actions (21 checks, 6 categories)\r\n\r\n| Tool | Description |\r\n|------|-------------|\r\n| `audit_github_actions(workflow_yaml?, workflow_url?, min_severity?)` | Full 21-check audit |\r\n| `check_secrets_gha` | Leaked tokens, secret in run: blocks |\r\n| `check_permissions_gha` | Overly broad write-all permissions |\r\n| `check_action_pinning_gha` | Unpinned action refs (not SHA-pinned) |\r\n| `check_runner_security_gha` | Self-hosted runner risks |\r\n| `check_workflow_config_gha` | pull_request_target misuse, script injection |\r\n| `check_supply_chain_advanced_gha` | TeamPCP-class supply-chain patterns (GHA-201..208) |\r\n| `list_checks_github_actions(category?)` | Check catalog |\r\n\r\n### HU Postcode Validator (5 tools)\r\n\r\n| Tool | Description |\r\n|------|-------------|\r\n| `validate_postcode(postcode)` | Settlement + county for a HU postcode |\r\n| `lookup_postcode(postcode)` | Alias for validate_postcode |\r\n| `lookup_city(city)` | All postcodes for a city (diacritic-insensitive) |\r\n| `validate_address(postcode, city)` | Postcode/city pairing validation |\r\n| `list_postcodes_in_county(county_name)` | All postcodes in a county |\r\n| `budapest_district_lookup(district_number)` | Budapest I-XXIII → postcodes |\r\n\r\n## Pricing\r\n\r\n| Event | USD |\r\n|-------|-----|\r\n| `audit_all` or any single-domain audit call | $0.10 |\r\n| Single-domain audit (`audit_compose`, `audit_dockerfile`, `audit_github_actions`) | $0.05 |\r\n| `list_checks` / discovery calls | $0.005 |\r\n\r\nPay-per-event — no subscription, no monthly minimums. You pay only when a tool is invoked.\r\n\r\n## Architecture\r\n\r\nPackage-import (not proxy): all four sub-packages are bundled directly into the\r\nActor image. Single cold start, single billing rail, no cross-Actor latency.\r\nSee `DESIGN.md` for the full rationale.\r\n\r\n---\r\n\r\nBuilt by Noel @ Unbearable Labs — more like this in the [weekly newsletter](https://unbearabletechtips.beehiiv.com).\r\n",
  "bytes": 4761,
  "sha": "3483c4296836fb968d7ca075b20d2c8702e807f425a1973e899647e1f93e5935",
  "repo_slug": "unbearabledev/iac-audit-pack",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_unbearabledev_iac_audit_pack_0176c10a/readme"
}