Dockerfile Security Auditor

Audit Kubernetes workloads for privileged containers, root execution, writable filesystems, missing capability drops, host access and mutable images.

Scan AI agent repos, MCP servers, and coding-agent configs for unsafe eval, shell execution, package hallucinations, prompt injection, and MCP security risks.

Audit OpenAPI and Swagger specifications for unsecured operations, unsafe server URLs, weak auth schemes and missing security responses.

Dockerfile Security & Quality Audit

unbearable_dev/dockerfile-audit

Hadolint-grade Dockerfile audit, MCP-native. 18+ checks across 5 categories (base image, instructions, security, efficiency, secrets) with severity, line numbers, remediation, and fix snippets. Pay-per-event. Call from Claude Desktop, Cursor, n8n, or any MCP client. Built by Unbearable Labs.

Gate agent-generated shell commands with deterministic allowlists and checks for injection, destructive operations, privilege escalation and download-to-shell patterns.

Dockerfile Linter — Security & best-practices checker

perryay/dockerfile-linter-checker

Lint Dockerfiles and docker-compose files against 15+ security and best-practice rules. Detects running as root, missing USER directive, unpinned packages, missing HEALTHCHECK, and more. Supports strict mode and batch linting.

Audit OIDC discovery documents and JWKS for issuer mismatches, unsafe endpoints, weak keys, insecure algorithms and missing PKCE.

Security Headers Auditor

junipr/security-headers-auditor

Audit website security headers such as CSP, HSTS, X-Frame-Options, Referrer-Policy, and Permissions-Policy.

security.txt Auditor

junipr/security-txt-auditor

Audit security.txt auditor inputs and return structured findings, evidence rows, and a buyer-ready report for SEO, developer, and operations teams.

Inspect public MCP/server GitHub repos for manifest/readme/package safety signals: tool scope, auth, secrets, shell/file/network language, and maintenance metadata.