tools / mcp audit / rules / docker image without a pinned tag or digest · v0.1.0 · View source · Edit on GitHub
MCP audit rule · v0.1.0
Docker image without a pinned tag or digest
An image with no tag, or :latest, can change under you; the next run may pull different code.
- each server checks
- 4 test fixtures
medium docker-unpinned
Flagged
7 "-i",
8 "--rm",
9 > "mcp/fetch"
10 ]
11 }Fix
Pin a digest: "args": ["run", "-i", "--rm", "mcp/fetch@sha256:<digest>"], or at least a version tag.
Fine
{
"mcpServers": {
"s": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"mcp/fetch@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
]
}
}
}