UNPKG

mcp-server-semgrep

Version:

MCP Server for Semgrep Integration - static code analysis with AI

github.com/Szowesgad/mcp-server-semgrep

Szowesgad/mcp-server-semgrep

76 lines (75 loc) • 1.95 kB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
rules: - id: exposing-docker-socket-volume patterns: - pattern-inside: | version: ... ... - pattern-either: - pattern: | volumes: - ... - /var/run/docker.sock:/var/run/docker.sock - ... - pattern: | volumes: - ... - /run/docker.sock:/run/docker.sock - ... - pattern: | volumes: - ... - /var/run/docker.sock:/run/docker.sock - ... - pattern: | volumes: - ... - /run/docker.sock:/var/run/docker.sock - ... - pattern: | volumes: - ... - /var/run/docker.sock - ... - pattern: | volumes: - ... - /run/docker.sock - ... - pattern: | volumes: - ... - ... source: /var/run/docker.sock ... - ... - pattern: | volumes: - ... - ... source: /run/docker.sock ... - ... message: >- Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this. metadata: references: - https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers category: security technology: - docker-compose cwe: - 'CWE-250: Execution with Unnecessary Privileges' owasp: - A06:2017 - Security Misconfiguration - A05:2021 - Security Misconfiguration subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW languages: [yaml] severity: WARNING