Configuration & Environment
Dockerfiles that run as root, pull unpinned base images, fetch scripts over plain HTTP, or `curl | sh` at build time — every one of which extends the attack surface from the MCP server to the host kernel.
Containers are not a security boundary when the container is root and the base image is `:latest`. The canonical mistakes are (1) no `USER` directive, so the default is root; (2) `FROM python:latest` so today's image is not tomorrow's; (3) `ADD http://...` which silently follows redirects and does not verify TLS certs for some clients; (4) `RUN curl https://... | sh` which inlines a remote shell script into the build; (5) missing `--no-install-recommends` bloating the image and thus the attack surface.
An MCP server distributed as a Docker image is often run with `--network host` or with volume mounts into the user's home directory. A container image that runs as root gives any in-container RCE direct access to those mounts. Build-time `curl | sh` also means the image contents depend on what the remote URL served at build time — two builds of the same Dockerfile can produce meaningfully different artifacts.
FROM python:latest # unpinned tag |
RUN curl -fsSL https://get.example.io/setup | sh # pipe-to-shell |
ADD http://releases.example.com/tool.tgz /opt/ # plaintext fetch |
RUN pip install -r requirements.txt # no --no-cache-dir |
COPY . /app |
WORKDIR /app |
# No USER directive — container runs as root |
CMD ["python", "server.py"] |
FROM python:3.12.4-slim-bookworm@sha256:abc123... # pinned by digest |
RUN apt-get update \ |
&& apt-get install -y --no-install-recommends ca-certificates \ |
&& rm -rf /var/lib/apt/lists/* |
WORKDIR /app |
COPY requirements.txt . |
RUN pip install --no-cache-dir -r requirements.txt |
COPY . . |
RUN useradd --system --uid 10001 mcp |
USER mcp |
CMD ["python", "server.py"] |
We parse Dockerfiles, flag `FROM ...:latest` or tagless bases, missing or root `USER`, `ADD http://` (plaintext) and `ADD https://` without a checksum, `curl ... | sh` / `wget ... | bash` patterns, `apt-get install` without `--no-install-recommends`, and pip/npm installs that omit the cache-disable flag.
See the full threat catalog for every documented detection.
MCPSafe runs this check — and every other rule in the catalog — on any MCP server you paste in.
Scan now