Skip to content

README.md

Latest commit

 

History

History
97 lines (68 loc) · 3.41 KB

README.md

File metadata and controls

97 lines (68 loc) · 3.41 KB
Raw

Dockyard

Build Status License

A centralized repository for packaging Model Context Protocol (MCP) servers and agent skills into secure, verified OCI artifacts.

Dockyard automatically builds, scans, and publishes container images for MCP servers, and OCI skill artifacts for agent skills. Every artifact is security-scanned, signed with Sigstore, and includes full build provenance.

Quick Start

# Pull a container
docker pull ghcr.io/stacklok/dockyard/npx/context7:2.1.0

# Verify its signature
cosign verify \
  --certificate-identity-regexp "https://github.com/stacklok/dockyard/.github/workflows/build-containers.yml@refs/heads/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/stacklok/dockyard/npx/context7:2.1.0

# Run it
docker run -it ghcr.io/stacklok/dockyard/npx/context7:2.1.0

Documentation

I want to... Go here
Use Dockyard containers Getting Started
Add my MCP server Adding MCP Servers
Package an agent skill Adding Skills
Understand the security model Security Overview
Verify attestations Container Attestations
Check package provenance Package Provenance

Supported Protocols

Protocol Registry Example
npx:// npm ghcr.io/stacklok/dockyard/npx/context7:2.1.0
uvx:// PyPI ghcr.io/stacklok/dockyard/uvx/aws-documentation-mcp-server:1.1.16
go:// Go modules ghcr.io/stacklok/dockyard/go/netbird:0.1.0

Browse available servers: npx/ | uvx/ | go/

Browse available skills: skills/

Add Your MCP Server

Create a spec.yaml in the appropriate directory and submit a PR:

metadata:
  name: your-server
  description: "What your server does"
  protocol: npx  # or uvx, go

spec:
  package: "your-package-name"
  version: "1.0.0"

Our CI/CD pipeline will automatically:

  1. Scan for security vulnerabilities (blocking)
  2. Verify package provenance (informational)
  3. Build multi-arch containers
  4. Sign and attest with Sigstore
  5. Publish to ghcr.io/stacklok/dockyard

See Adding MCP Servers for the full guide.

Security

Every container includes:

  • MCP Security Scan - Scanned with mcp-scanner before build
  • Container Scan - Trivy vulnerability scanning
  • Signed Images - Sigstore/Cosign keyless signatures
  • Attestations - SBOM, build provenance, and security scan results

See Security Overview for details.

Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

To add an MCP server, see Adding MCP Servers.

License

Apache 2.0 - see LICENSE for details.

Links