IAC Audit Pack
Bundles four IaC security auditors into one MCP endpoint: Docker Compose (25 checks), Dockerfile (19 checks), GitHub Actions (21 checks), plus a Hungarian postcode validator. The audit_all tool auto-detects file types and runs the right scanner. Each audit covers secrets, permissions, pinning, and supply chain risks. Built on Apify, billed per call ($0.05 per audit, $0.10 for audit_all). Good fit if you're reviewing infrastructure files in Claude and want Snyk-style checks without leaving the conversation. Category-specific tools let you drill into privileged mode, unpinned actions, or hardcoded tokens individually.
- tools
- 34
- auth
- Secret needed
- transport
- HTTP
- last updated
- Jun 10, 2026
Tools
34 toolsPublic tool metadata for what this MCP can expose to an agent.
audit_allMulti-file detection + combined audit report.
Multi-file detection + combined audit report.
No parameter schema in public metadata yet.
list_all_checksAll 64 checks across all three audit packages.
All 64 checks across all three audit packages.
No parameter schema in public metadata yet.
audit_composeFull 25-check audit.
Full 25-check audit.
No parameter schema in public metadata yet.
check_privilegePrivileged mode, cap_add, user namespace.
Privileged mode, cap_add, user namespace.
No parameter schema in public metadata yet.
check_networkHost networking, exposed dangerous ports.
Host networking, exposed dangerous ports.
No parameter schema in public metadata yet.
check_secretsHardcoded passwords, tokens in env vars.
Hardcoded passwords, tokens in env vars.
No parameter schema in public metadata yet.
check_filesystemDocker socket mounts, host path mounts.
Docker socket mounts, host path mounts.
No parameter schema in public metadata yet.
check_resourcesMissing memory/CPU limits.
Missing memory/CPU limits.
No parameter schema in public metadata yet.
check_image_hygieneUnpinned tags, latest usage.
Unpinned tags, latest usage.
No parameter schema in public metadata yet.
check_runtime_lifecycleRestart policies, healthchecks.
Restart policies, healthchecks.
No parameter schema in public metadata yet.
check_loggingLogging driver config.
Logging driver config.
No parameter schema in public metadata yet.
check_compose_hygieneVersion field, service naming.
Version field, service naming.
No parameter schema in public metadata yet.
list_checks_composeCheck catalog.
Check catalog.
No parameter schema in public metadata yet.
audit_dockerfileFull 19-check audit.
Full 19-check audit.
No parameter schema in public metadata yet.
check_base_image_dockerfileUnpinned base, latest, root user in FROM.
Unpinned base, latest, root user in FROM.
No parameter schema in public metadata yet.
check_instructions_dockerfileADD vs COPY, COPY ordering, ENV secrets.
ADD vs COPY, COPY ordering, ENV secrets.
No parameter schema in public metadata yet.
check_security_dockerfileUSER root, privilege escalation patterns.
USER root, privilege escalation patterns.
No parameter schema in public metadata yet.
check_efficiency_dockerfileLayer count, cache busting.
Layer count, cache busting.
No parameter schema in public metadata yet.
check_secrets_dockerfileHardcoded secrets in RUN/ENV/ARG.
Hardcoded secrets in RUN/ENV/ARG.
No parameter schema in public metadata yet.
list_checks_dockerfileCheck catalog.
Check catalog.
No parameter schema in public metadata yet.
audit_github_actionsFull 21-check audit.
Full 21-check audit.
No parameter schema in public metadata yet.
check_secrets_ghaLeaked tokens, secret in run: blocks.
Leaked tokens, secret in run: blocks.
No parameter schema in public metadata yet.
check_permissions_ghaOverly broad write-all permissions.
Overly broad write-all permissions.
No parameter schema in public metadata yet.
check_action_pinning_ghaUnpinned action refs (not SHA-pinned).
Unpinned action refs (not SHA-pinned).
No parameter schema in public metadata yet.
check_runner_security_ghaSelf-hosted runner risks.
Self-hosted runner risks.
No parameter schema in public metadata yet.
check_workflow_config_ghapull_request_target misuse, script injection.
pull_request_target misuse, script injection.
No parameter schema in public metadata yet.
check_supply_chain_advanced_ghaTeamPCP-class supply-chain patterns (GHA-201..208).
TeamPCP-class supply-chain patterns (GHA-201..208).
No parameter schema in public metadata yet.
list_checks_github_actionsCheck catalog.
Check catalog.
No parameter schema in public metadata yet.
validate_postcodeSettlement + county for a HU postcode.
Settlement + county for a HU postcode.
No parameter schema in public metadata yet.
lookup_postcodeAlias for validate_postcode.
Alias for validate_postcode.
No parameter schema in public metadata yet.
lookup_cityAll postcodes for a city (diacritic-insensitive).
All postcodes for a city (diacritic-insensitive).
No parameter schema in public metadata yet.
validate_addressPostcode/city pairing validation.
Postcode/city pairing validation.
No parameter schema in public metadata yet.
list_postcodes_in_countyAll postcodes in a county.
All postcodes in a county.
No parameter schema in public metadata yet.
budapest_district_lookupBudapest I-XXIII to postcodes.
Budapest I-XXIII to postcodes.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
Unbearable IaC Audit Pack
Unbearable IaC Audit Pack — all four audit Actors under one MCP endpoint. Snyk-comparable scope at a fraction of the cost. Pay-per-event — only billed when a tool is actually called.
64 checks. 20 categories. 4 audit engines. 1 MCP endpoint.
What's included
| Package | Checks | Categories | Primary tool |
|---|---|---|---|
| Docker Compose audit | 25 | 9 | audit_compose |
| Dockerfile audit | 19 | 5 | audit_dockerfile |
| GitHub Actions audit | 21 | 6 | audit_github_actions |
| HU Postcode Validator | 5 tools | — | validate_postcode, lookup_city, … |
Plus two bundle-only tools:
audit_all— paste a dict of filenames → content; auto-detects Dockerfile, compose, and workflow files and runs the right audit on eachlist_all_checks— full cross-package check catalog in one call
Quick start (Claude Desktop)
{
"mcpServers": {
"iac-audit-pack": {
"type": "http",
"url": "https://unbearable-dev--iac-audit-pack.apify.actor/mcp",
"headers": {
"Authorization": "Bearer <your-apify-token>"
}
}
}
}
---
[View the full README on GitHub](https://github.com/unbearabledev/iac-audit-pack)
Details
- Repository
- github.com/unbearabledev/iac-audit-pack
- Categories
- Cloud & Infrastructure, Developer Tools
- Transport
- HTTP
- Auth
- Required
- Registry
- MCP registry, active
More from unbearabledev
Related Cloud & Infrastructure MCP servers
View all
OrgXuseorgx/orgx-mcpOrgX is coordination infrastructure for AI-native teams. It gives your LLM a persistent organizational layer: initiatives with milestones and tasks, human-in-th0stars
Global Sentinel Mcpykshah1309/global-sentinel-mcpPolymarket, GDELT, OpenSky, Cloudflare Radar unified as one MCP server.0stars
PALbeehiveinnovations/pal-mcp-serverThe power of Claude Code / GeminiCLI / CodexCLI + [Gemini / OpenAI / OpenRouter / Azure / Grok / Ollama / Custom Model / All Of The Above] working as one.11.5Kstars
Radar Kubernetes MCP Serverskyhook-io/radarKubernetes MCP server for diagnosis, resource management, GitOps, and RBAC-enforced operations.4.1Kstars
Seo Monsteravansaber/seo-monsterLocal-first SEO MCP: track AI citations, Search Console, GA4, PageSpeed, Cloudflare, IndexNow, CrUX.511stars
Ori Memoryaayoawoyemi/ori-mnemosPersistent memory infrastructure for AI agents. Identity, knowledge graph, and search.0stars