lintai docs

Appearance

Rule Reference

SEC346lintai-ai-securitystablejsonwarn

MCP config: mutable registry refresh

MCP configuration forces Docker to refresh from a mutable registry source

Provider
lintai-ai-security
Surface
json
Scope
per_file
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message_only

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

basemembership
mcpmembership

Lifecycle

Stable Lifecycle Contract

State

stable_gated

Graduation rationale

Checks committed MCP config Docker launch paths for explicit --pull always refresh policies that force a mutable registry fetch at runtime.

Deterministic signal basis

JsonSignals docker run argument analysis over ArtifactKind::McpConfig objects, limited to explicit --pull=always or --pull always forms.

Malicious corpus
gemini-mcp-docker-pull-always
Benign corpus
gemini-mcp-docker-digest-pinned-safe
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC301MCP config: shell trampolineMCP configuration shells out through sh -c or bash -cjsonstable
SEC302Config: insecure HTTP endpointConfiguration contains an insecure http:// endpointjsonstable
SEC303MCP config: credential env passthroughMCP configuration passes through credential environment variablesjsonstable
SEC304Config: TLS verification disabledConfiguration disables TLS or certificate verificationjsonstable
SEC305Config: hardcoded auth materialConfiguration embeds static authentication material in a connection or auth valuejsonstable
SEC309Config: literal secrets in configConfiguration commits literal secret material in env, auth, or header valuesjsonstable

Why It Matters ​

Forcing Docker to refresh from the registry at runtime weakens reproducibility even when the image name itself looks reviewed. In committed MCP config, --pull always turns the launch path back into a mutable registry fetch.

What Triggers ​

SEC346 applies to committed MCP config Docker launch paths and triggers on explicit:

  • --pull=always
  • --pull always

forms in docker run command arguments.

Examples that trigger:

json
{"command":"docker","args":["run","--pull","always","ghcr.io/acme/server@sha256:..."]}
{"command":"docker","args":["run","--pull=always","ghcr.io/acme/server:1.2.3"]}

Example that stays clean:

json
{"command":"docker","args":["run","ghcr.io/acme/server@sha256:0123456789abcdef"]}

False Positives ​

The rule is structural and only looks for explicit forced-pull policies in actual MCP Docker launch paths. It does not treat every mutable image reference as the same class of finding.

Remediation ​

Remove the forced Docker pull policy from the committed config and prefer pinned, reproducible image references.