Which integrations are available for this server?

Audits Docker Compose and Dockerfile configurations against 44 security and best-practice checks, covering privilege, network, secrets, filesystem, resources, image hygiene, and more. Audits GitHub Actions workflow files against 21 security and supply-chain checks, covering token leaks, permission scoping, action pinning, runner security, and workflow configuration.

How do I use Unbearable IaC Audit Pack?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Unbearable IaC Audit Pack audit my Dockerfile for security issues" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Unbearable IaC Audit Pack

Official

by UnbearableDev

Overview Schema Related Servers Score Discussions

Python

Remote

# Unbearable IaC Audit Pack

Unbearable IaC Audit Pack — all four audit Actors under one MCP endpoint. Snyk-comparable scope at a fraction of the cost. Pay-per-event — only billed when a tool is actually called.

64 checks. 20 categories. 4 audit engines. 1 MCP endpoint.

What's included

Package	Checks	Categories	Primary tool
Docker Compose audit	25	9	`audit_compose`
Dockerfile audit	19	5	`audit_dockerfile`
GitHub Actions audit	21	6	`audit_github_actions`
HU Postcode Validator	5 tools	—	`validate_postcode`, `lookup_city`, …

Plus two bundle-only tools:

audit_all — paste a dict of filenames → content; auto-detects Dockerfile, compose, and workflow files and runs the right audit on each
list_all_checks — full cross-package check catalog in one call

Related MCP server: Obra CTO

Quick start (Claude Desktop)

{
  "mcpServers": {
    "iac-audit-pack": {
      "type": "http",
      "url": "https://unbearable-dev--iac-audit-pack.apify.actor/mcp",
      "headers": {
        "Authorization": "Bearer <your-apify-token>"
      }
    }
  }
}

Tool catalog

Aggregation (bundle-only)

Tool	Description
`audit_all(files, min_severity?)`	Multi-file detection + combined audit report
`list_all_checks()`	All 64 checks across all three audit packages

Docker Compose (25 checks, 9 categories)

Tool	Description
`audit_compose(compose_yaml?, compose_url?, min_severity?)`	Full 25-check audit
`check_privilege`	Privileged mode, cap_add, user namespace
`check_network`	Host networking, exposed dangerous ports
`check_secrets`	Hardcoded passwords, tokens in env vars
`check_filesystem`	Docker socket mounts, host path mounts
`check_resources`	Missing memory/CPU limits
`check_image_hygiene`	Unpinned tags, `latest` usage
`check_runtime_lifecycle`	Restart policies, healthchecks
`check_logging`	Logging driver config
`check_compose_hygiene`	Version field, service naming
`list_checks_compose(category?)`	Check catalog

Dockerfile (19 checks, 5 categories)

Tool	Description
`audit_dockerfile(dockerfile_content?, dockerfile_url?, min_severity?)`	Full 19-check audit
`check_base_image_dockerfile`	Unpinned base, `latest`, root user in FROM
`check_instructions_dockerfile`	ADD vs COPY, COPY ordering, ENV secrets
`check_security_dockerfile`	USER root, privilege escalation patterns
`check_efficiency_dockerfile`	Layer count, cache busting
`check_secrets_dockerfile`	Hardcoded secrets in RUN/ENV/ARG
`list_checks_dockerfile(category?)`	Check catalog

GitHub Actions (21 checks, 6 categories)

Tool	Description
`audit_github_actions(workflow_yaml?, workflow_url?, min_severity?)`	Full 21-check audit
`check_secrets_gha`	Leaked tokens, secret in run: blocks
`check_permissions_gha`	Overly broad write-all permissions
`check_action_pinning_gha`	Unpinned action refs (not SHA-pinned)
`check_runner_security_gha`	Self-hosted runner risks
`check_workflow_config_gha`	pull_request_target misuse, script injection
`check_supply_chain_advanced_gha`	TeamPCP-class supply-chain patterns (GHA-201..208)
`list_checks_github_actions(category?)`	Check catalog

HU Postcode Validator (5 tools)

Tool	Description
`validate_postcode(postcode)`	Settlement + county for a HU postcode
`lookup_postcode(postcode)`	Alias for validate_postcode
`lookup_city(city)`	All postcodes for a city (diacritic-insensitive)
`validate_address(postcode, city)`	Postcode/city pairing validation
`list_postcodes_in_county(county_name)`	All postcodes in a county
`budapest_district_lookup(district_number)`	Budapest I-XXIII → postcodes

Pricing

Event	USD
`audit_all` or any single-domain audit call	$0.10
Single-domain audit (`audit_compose`, `audit_dockerfile`, `audit_github_actions`)	$0.05
`list_checks` / discovery calls	$0.005

Pay-per-event — no subscription, no monthly minimums. You pay only when a tool is invoked.

Architecture

Package-import (not proxy): all four sub-packages are bundled directly into the Actor image. Single cold start, single billing rail, no cross-Actor latency. See DESIGN.md for the full rationale.

Built by Noel @ Unbearable Labs — more like this in the weekly newsletter.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

No tool schema history has been recorded yet.

This server cannot be installed

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Maintenance

ActivityInactive

ResponsivenessSyncing

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Agentic Platform A
io.github.andysalvo
Free MCP tools: the only MCP linter, health checks, cost estimation, and trust evaluation.
Developer Tools Monitoring Observability
31
crowvault
io.github.rajeswaran140
327 dev tools via REST API and MCP. Generate Dockerfiles, schemas, K8s, APIs, and more.
Developer Tools CI/CD & DevOps
2
Frogeye Security Scanner A
io.github.frogeye-ai
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Security Penetration Testing
2
codegworkspace-mcp
com.clauxel.codegworkspace
A paid remote MCP for CodeG, built to return verdicts, receipts, usage logs, and audit-ready JSON.
Code Execution Developer Tools
2

Related MCP Servers

mcp-rules-server
Code Analysis Developer Tools
camoran89
F
license
Not graded
quality
D
maintenance
MCP server that provides code validation rules and analysis for various stacks/frameworks, enabling automated code reviews and reporting directly from VS Code and other editors.
Updated 3 months ago (2026-06-19 15:30 UTC)
-
Obra CTO
Code Analysis Testing & QA Tools Security
lilycip
A
license
A
quality
B
maintenance
A local-first MCP server that scores your codebase's Build Readiness by reading code and running tests on your machine, outputting a diligence-grade score and risk register without uploading your source.
Updated 2 months ago (2026-07-04 15:17 UTC)
5
123
Apache 2.0
bouncer
Legal & Compliance Code Analysis
nugehs
A
license
Not graded
quality
B
maintenance
Static compliance-controls checker that verifies regulatory required controls exist in code, running deterministic rule packs via MCP tools for compliance checks, rule listing, and explanation.
Updated 3 months ago (2026-06-16 12:17 UTC)
120
MIT
sdlc-integrity-mcp
Code Analysis Testing & QA Tools Developer Tools
AsobaCloud
A
license
A
quality
A
maintenance
MCP server that provides audit and safety-check tools for enterprise SDLC code integrity, enabling AI agents to scan workspaces for lifecycle gaps, mock-theater tests, DRY violations, and language-specific issues in shell, JavaScript/HTML, and Python.
Updated a month ago (2026-08-08 06:46 UTC)
4
13
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/UnbearableDev/iac-audit-pack'

If you have feedback or need assistance with the MCP directory API, please join our Discord server