Skip to content

Conversation

@qodesmith
Copy link


name: Add a new MCP server
about: Requests for adding a new MCP server to the Docker Catalog
title: ""
labels: submission
assignees: ""

MCP Server Information

Server Name:
Repository URL:
Brief Description:

Basic Requirements

  • Open Source: Uses acceptable license (Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause or other permissive license)
  • MCP Compliant: Implements MCP API specification
  • Active Development: Recent commits and maintained
  • Docker Artifact: Dockerfile
  • Documentation: Basic README and setup instructions
  • Security Contact: Method for reporting security issues

Submitter Checklist

  • This server meets the basic requirements listed above
  • I understand this will undergo automated and manual review.
  • I have tested the MCP Server using task validate -- --name SERVER_NAME
  • I have built the MCP Server using task build -- --tools SERVER_NAME

Comment on lines +27 to +33
- name: Fetch PR refs
run: |
git fetch --no-tags origin \
+refs/pull/${{ github.event.pull_request.number }}/merge:pr-merge \
+refs/pull/${{ github.event.pull_request.number }}/head:pr-head

- name: Compute changed files (base..head)

Check warning

Code scanning / CodeQL

Checkout of untrusted code in trusted context Medium

Potential unsafe checkout of untrusted pull request on privileged workflow.

Copilot Autofix

AI 11 days ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.


- name: Run Codex
id: run_codex
uses: openai/codex-action@v1

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Add Server Instructions' step
Uses Step: run_codex
uses 'openai/codex-action' with ref 'v1', not a pinned commit hash
Comment on lines 67 to 75
- name: Pre-fetch base/head refs (for context only)
run: |
git fetch --no-tags origin \
${{ github.event.pull_request.base.ref }} \
+refs/pull/${{ github.event.pull_request.number }}/head

# OPTIONAL: Pre-fetch docs that Codex can read (Codex sandbox blocks network).
# If your YAML has source.project URLs, you can curl README.md and place in ./_docs
- name: (Optional) Fetch referenced READMEs for context

Check warning

Code scanning / CodeQL

Checkout of untrusted code in trusted context Medium

Potential unsafe checkout of untrusted pull request on privileged workflow.

Copilot Autofix

AI 11 days ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

Comment on lines +60 to +67
- name: Checkout PR merge ref (read-only)
uses: actions/checkout@v5
with:
ref: refs/pull/${{ github.event.pull_request.number }}/merge
# persist-credentials: false
# clean: true

- name: Pre-fetch base/head refs (for context only)

Check warning

Code scanning / CodeQL

Checkout of untrusted code in trusted context Medium

Potential unsafe checkout of untrusted pull request on privileged workflow.

Copilot Autofix

AI 11 days ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants