vscode — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vscode (MCP Server) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
Model Context Protocol Server for [Komodo](https://github.com/moghtech/komodo)
Manage your Docker or Podman deployments through Komodo with AI assistants and automation tools.
Komodo MCP Server enables seamless interaction between AI assistants (like Claude, GitHub Copilot) and Komodo (Container Management Platform) for efficient container management, server orchestration, and deployment operations. The MCP-Server gives you the ability to control your Komodo-managed infrastructure by using natural language or automated workflows.
Features • Quick Start • Authentication • Documentation
</div>
amd64, arm64, arm/v7, and arm/v6 (Raspberry Pi). Non-root, multi-stage builds with tini init.*_FILE variants.komodo_configure without restarting the server./health and /ready endpoints. komodo_health_check reports server version, connectivity, and auth status.Built on [mcp-server-framework](https://github.com/MP-Tool/mcp-server-framework) — a production-ready TypeScript MCP server framework with structured logging, OpenTelemetry, and session management.
| Category | Tools |
|---|---|
| Configuration | komodo_configure, komodo_health_check |
| Containers | komodo_container_list, komodo_container_inspect, komodo_container_logs, komodo_container_search_logs, komodo_container_action (start/stop/restart/pause/unpause) |
| Servers | komodo_server_list, komodo_server_info, komodo_server_stats, komodo_server_apply (create/update), komodo_server_delete, komodo_server_action (start_all/restart_all/pause_all/unpause_all/stop_all\_containers, prune\_\, delete\_network/image/volume)* |
| Stacks | komodo_stack_list, komodo_stack_info, komodo_stack_apply (create/update), komodo_stack_delete, komodo_stack_action (deploy/pull/start/restart/pause/unpause/stop/destroy) |
| Deployments | komodo_deployment_list, komodo_deployment_info, komodo_deployment_apply (create/update), komodo_deployment_delete, komodo_deployment_action (deploy/pull/start/restart/pause/unpause/stop/destroy) |
| Builds | komodo_build_list, komodo_build_info, komodo_build_action (run/cancel), komodo_build_logs, komodo_build_apply (create/update), komodo_build_delete |
| Repos | komodo_repo_list, komodo_repo_info, komodo_repo_action (clone/pull/build/cancel_build), komodo_repo_apply (create/update), komodo_repo_delete |
| Procedures | komodo_procedure_list, komodo_procedure_info, komodo_procedure_action (run), komodo_procedure_apply (create/update), komodo_procedure_delete |
| Actions | komodo_action_list, komodo_action_info, komodo_action_action (run/cancel), komodo_action_apply (create/update), komodo_action_delete |
| Alerters | komodo_alerter_list, komodo_alerter_info, komodo_alerter_apply (create/update), komodo_alerter_delete |
| Swarms | komodo_swarm_list, komodo_swarm_info, komodo_swarm_apply (create/update), komodo_swarm_delete, komodo_swarm_nodes_list, komodo_swarm_services_list, komodo_swarm_action (update_node/remove_nodes/remove_services/remove_stacks) |
| Resource Syncs | komodo_resource_sync_list, komodo_resource_sync_info, komodo_resource_sync_action (run/refresh), komodo_resource_sync_apply (create/update), komodo_resource_sync_delete |
| Variables | komodo_variable_list, komodo_variable_info, komodo_variable_apply (create/update — value/description/is_secret), komodo_variable_delete |
| Updates | komodo_update_list (filterable, paginated), komodo_update_info |
| Terminal | komodo_exec (target: server / container / deployment / stack_service) |
| API Keys | komodo_user_list_api_keys, komodo_user_create_api_key, komodo_user_delete_api_key |
Tip: Every tool carries_meta.category(one ofconfig,container,server,stack,deployment,build,repo,procedure,action,alerter,swarm,resource-sync,variable,update,terminal,user) and arequiredScopesarray (komodo:read/komodo:operate/komodo:admin), so MCP clients and gateways can filter or gate tools by category and three-tier RBAC.
>
List/info/logs tools support cursor pagination via{ cursor, page_size }(1–100, default 50) and emit_meta.page.next_cursorwhen more items are available.inspect,info,logs, andsearch_logsresponses also include a session-scopedephemeral://…resource link so large payloads can be fetched out-of-band viaresources/read; passinline_full: trueto force inlining.
Deploy as a persistent HTTP server — connect from any MCP client.
mkdir komodo-mcp && cd komodo-mcp
curl -O https://raw.githubusercontent.com/MP-Tool/komodo-mcp-server/main/docker/compose.yaml
curl -O https://raw.githubusercontent.com/MP-Tool/komodo-mcp-server/main/docker/docker.env
cp docker.env .env # Edit with your credentials
docker compose up -d→ [Full Docker Guide](docker/README.md)
Add to your claude_desktop_config.json (Settings → Developer → Edit Config):
"komodo-mcp-server": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "KOMODO_URL=https://komodo.example.com:9120",
"-e", "KOMODO_API_KEY=api-key",
"-e", "KOMODO_API_SECRET=api-secret",
"ghcr.io/mp-tool/komodo-mcp-server:latest"
]
}→ [Full Claude Guide](examples/claude/README.md)
Add to .vscode/mcp.json in your workspace:
{
"servers": {
"Komodo MCP Server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "KOMODO_URL=https://komodo.example.com:9120",
"-e", "KOMODO_API_KEY=api-key",
"-e", "KOMODO_API_SECRET=api-secret",
"ghcr.io/mp-tool/komodo-mcp-server:latest"
]
}
}
}→ [Full VS Code Guide](examples/vscode/README.md) · [Node.js / npx (no Docker)](examples/node/README.md) · [All Integrations](examples/README.md)
Once connected, ask Claude, Copilot, or any MCP-compatible assistant:
"List all my Komodo servers"
"Show containers on production-server"
"Start the nginx container"
"Deploy my-app to staging"
"Get stats for dev-server"npx @modelcontextprotocol/inspector --url http://localhost:8000/mcpUse /mcp for Streamable HTTP or /sse for legacy SSE transport (if enabled). Adjust host and port to match your setup.
Three methods are supported — use whichever fits your setup:
| Method | Environment Variables | Best For |
|---|---|---|
| API Key (recommended) | KOMODO_API_KEY + KOMODO_API_SECRET | Service accounts, automation |
| Username / Password | KOMODO_USERNAME + KOMODO_PASSWORD | Interactive users |
| JWT Token | KOMODO_JWT_TOKEN | Browser-based SSO (OIDC, GitHub, Google OAuth) |
KOMODO_URL is always required. All credentials also support Docker secrets via *_FILE variants (e.g. KOMODO_API_KEY_FILE).
For the full configuration reference (env vars, config files, Docker secrets), see the [Configuration Guide](config/README.md).
AI tools (GitHub Copilot, Claude) are used as part of the development workflow — for code generation, architecture exploration, and documentation drafting. Every line of code and documentation is manually reviewed to ensure quality, correctness, and compliance with established engineering standards.
This software is provided under the GPL-3.0 License. If you find bugs or have ideas, issues and contributions are always welcome.
Contributions are welcome! See our Contributing Guide for details.
# Clone and install
git clone https://github.com/MP-Tool/komodo-mcp-server.git
cd komodo-mcp-server
npm install
# Build and run
npm run build
npm start| Guide | Description |
|---|---|
| [Configuration](config/README.md) | All environment variables, config file formats, priority chain, Docker secrets |
| [Docker Deployment](docker/README.md) | Docker Compose setup, health checks, production deployment |
| [Client Integrations](examples/README.md) | Claude Desktop, VS Code, Node.js/npx setup guides |
| [Contributing](CONTRIBUTING.md) | Development setup, coding standards, PR guidelines |
| [Security](SECURITY.md) | Vulnerability reporting, security best practices |
| [Changelog](CHANGELOG.md) | Version history and release notes |
GPL-3.0 License - see LICENSE for details.
Report security vulnerabilities via GitHub's Private Vulnerability Reporting (see SECURITY.md).
Best practices:
<div align="center">
Built with ❤️ for the Komodo community 🦎
Report Bug · Request Feature · Discussions
</div>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.