dockyard

Dockyard

A centralized repository for packaging Model Context Protocol (MCP) servers into secure, verified containers.

Dockyard automatically builds, scans, and publishes container images for MCP servers. Every container is security-scanned, signed with Sigstore, and includes full build provenance.

Quick Start

# Pull a container
docker pull ghcr.io/stacklok/dockyard/npx/context7:2.1.0

# Verify its signature
cosign verify \
  --certificate-identity-regexp "https://github.com/stacklok/dockyard/.github/workflows/build-containers.yml@refs/heads/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/stacklok/dockyard/npx/context7:2.1.0

# Run it
docker run -it ghcr.io/stacklok/dockyard/npx/context7:2.1.0

Documentation

Supported Protocols

Browse available servers: npx/ | uvx/ | go/

Add Your MCP Server

Create a spec.yaml in the appropriate directory and submit a PR:

metadata:
  name: your-server
  description: "What your server does"
  protocol: npx  # or uvx, go

spec:
  package: "your-package-name"
  version: "1.0.0"

Our CI/CD pipeline will automatically:

1. Scan for security vulnerabilities (blocking)
2. Verify package provenance (informational)
3. Build multi-arch containers
4. Sign and attest with Sigstore
5. Publish to ghcr.io/stacklok/dockyard

See Adding MCP Servers for the full guide.

Security

Every container includes:

• MCP Security Scan - Scanned with mcp-scanner before build
• Container Scan - Trivy vulnerability scanning
• Signed Images - Sigstore/Cosign keyless signatures
• Attestations - SBOM, build provenance, and security scan results

See Security Overview for details.

Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

To add an MCP server, see Adding MCP Servers.

License

Apache 2.0 - see LICENSE for details.

Links

• ToolHive - Container building technology
• MCP Documentation - Model Context Protocol
• Sigstore - Container signing