MCP, MCP server
Docker Mcp
Docker Mcp, an MCP server listed in the PlugVet directory.
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
docker_mcp/tools/_ssh_proxy.py, line 76
"""Resolved connection parameters for an ssh:// DOCKER_HOST, after ~/.ssh/config lookup.
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
docker_mcp/tools/_cli.py, line 219
# before subprocess.run(timeout=timeout) below, so without this an unreachable or
docker_mcp/tools/_cli.py, line 228
proc = subprocess.run( # noqa: S603 - shell=False, argv is a list, binary is resolved via shutil.which
docker_mcp/tools/_cli.py, line 431
local path, where `cwd=None` reaches `subprocess.run` as the server's cwd. Resolving it to nothing
Show more
docker_mcp/tools/_cli.py, line 474
# Verbatim, deliberately: `subprocess.run(cwd=...)` does not expand `~` (verified - it raises
docker_mcp/tools/_ssh_proxy.py, line 211
`timeout` argument only wraps `subprocess.run` and would otherwise leave this paramiko connect
docker_mcp/tools/_ssh_proxy.py, line 500
local path exactly: `subprocess.run` raises that same exception immediately for `0`, `-1` and
docker_mcp/tools/_ssh_proxy.py, line 719
the local path: `subprocess.run(timeout=...)` calls `Popen.kill()`, which is
docker_mcp/tools/_ssh_proxy.py, line 1042
remote command until our own deadline - the classic pipe deadlock. `subprocess.run` avoids this
scripts/claude_plugin_release.py, line 558
shutil.rmtree(cache, ignore_errors=True)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach auth.docker.io. The description does not name that host. can reach registry-1.docker.io. The description does not name that host. can reach hub.docker.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
scripts/claude_plugin_release.py, line 212
with urllib.request.urlopen(request, timeout=HTTP_TIMEOUT) as response: # noqa: S310
skills/l337-docker/reference/registry.md, line 26
TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:$REPO:pull" | jq -r .token)
skills/l337-docker/reference/registry.md, line 35
curl -s -H "Authorization: Bearer $TOKEN" \
Show more
skills/l337-docker/reference/registry.md, line 47
curl -sf -D "$hdr" -H "Authorization: Bearer $TOKEN" "$url" | jq -er '.tags[]' \
skills/l337-docker/reference/registry.md, line 64
curl -s -H "Authorization: Bearer $TOKEN" "https://registry-1.docker.io/v2/$REPO/tags/list?n=1000" \
skills/l337-docker/reference/registry.md, line 82
curl -s -H "Authorization: Bearer $TOKEN" -H "Accept: $ACCEPT" \
skills/l337-docker/reference/registry.md, line 89
curl -sI -H "Authorization: Bearer $TOKEN" -H "Accept: $ACCEPT" \
skills/l337-docker/reference/registry.md, line 117
token=$(curl -sf "https://auth.docker.io/token?service=registry.docker.io&scope=repository:$repo:pull" \
skills/l337-docker/reference/registry.md, line 145
TOKEN=$(curl -s "https://ghcr.io/token?scope=repository:ORG/IMAGE:pull" | jq -r .token)
skills/l337-docker/reference/registry.md, line 146
curl -s -H "Authorization: Bearer $TOKEN" "https://ghcr.io/v2/ORG/IMAGE/tags/list" | jq
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL
docker_mcp/tools/_ssh_proxy.py, line 76
"""Resolved connection parameters for an ssh:// DOCKER_HOST, after ~/.ssh/config lookup.
docker_mcp/tools/_ssh_proxy.py, line 79
hostname: the host to connect to, after ~/.ssh/config lookup.
docker_mcp/tools/_ssh_proxy.py, line 142
Applies the same ~/.ssh/config lookups (Hostname, Port, User, IdentityFile, ProxyCommand)
Show more
docker_mcp/tools/_ssh_proxy.py, line 172
ssh_config_file = os.path.expanduser("~/.ssh/config")
docker_mcp/tools/_ssh_proxy.py, line 216
Unless a `~/.ssh/config` `ProxyCommand` is in play (which already supplies its own `sock` - a
docker_mcp/tools/_ssh_proxy.py, line 265
f"key is in ~/.ssh/known_hosts (paramiko rejects unknown hosts - connect once with `ssh` "
docker_mcp/tools/buildx.py, line 111
spec: one spec value, e.g. "type=local,dest=out" or "id=npmrc,src=/home/u/.npmrc"
docker_mcp/tools/buildx.py, line 127
The CLI receives its argv without a shell, so `~/.npmrc` would otherwise reach buildx literally and
scripts/claude_plugin_release.py, line 1052
gh = GitHub(repo, os.environ.get("GH_TOKEN"))
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 268b2840fb69. can delete files. can reach a host that is not written as a fixed address. can reach auth.docker.io. The description does not name that host. can reach registry-1.docker.io. The description does not name that host. can reach hub.docker.com. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 268b2840fb693c172567ac0381b344457f231cd6
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.