Pinner MCP Server

What is Pinner MCP 📍?

Pinner MCP 📍 is a Model Context Protocol (MCP) server for pinning third‑party dependencies to immutable digests. It supports Docker base images and GitHub Actions and is aimed at developers and security engineers who want to enforce dependency integrity in CI/CD pipelines. The server was originally built to protect the vet tool from malicious GitHub Actions.

How to use Pinner MCP 📍?

Run the server as a container with stdio transport: docker run -it --rm ghcr.io/safedep/pinner-mcp:latest. Configure it in VS Code (.vscode/mcp.json) or Cursor (.cursor/mcp.json) using the same Docker command. Then use prompts such as “Pin GitHub Actions to their commit hash” or “Pin container base images to digests” via GitHub Copilot Chat or Cursor Composer to pin or update pinned versions.

Key features of Pinner MCP 📍?

• Pins Docker base images to immutable digests.
• Pins GitHub Actions to commit hashes.
• Runs as a lightweight container with stdio transport.
• Integrates with VS Code and Cursor via MCP configuration.
• Supports updating pinned versions with natural language prompts.
• Automatically published as latest image on GitHub Container Registry.

Use cases of Pinner MCP 📍?

• Locking CI/CD pipeline dependencies to prevent supply‑chain attacks.
• Enforcing reproducible builds by pinning container base images.
• Auditing and fixing GitHub Actions versions in repository workflows.
• Updating all pinned dependencies in a project with a single prompt.