StacklokLabs/ocireg-mcp

An MCP (Model Context Protocol) server that provides tools for querying OCI
registries and image references.
Overview
This project implements an SSE-based MCP server that allows LLM-powered
applications to interact with OCI registries. It provides tools for retrieving
information about container images, listing tags, and more.
Features
- Get information about OCI images
- List tags for repositories
- Get image manifests
- Get image configs
MCP Tools
The server provides the following MCP tools:
get_image_info
Get information about an OCI image.
**Input:**
- image_ref: The image reference (e.g., docker.io/library/alpine:latest)
**Output:**
- Image information including digest, size, architecture, OS, creation date, and
number of layers
list_tags
List tags for a repository.
**Input:**
- repository: The repository name (e.g., docker.io/library/alpine)
**Output:**
- List of tags for the repository
get_image_manifest
Get the manifest for an OCI image.
**Input:**
- image_ref: The image reference (e.g., docker.io/library/alpine:latest)
**Output:**
- The image manifest
get_image_config
Get the config for an OCI image.
**Input:**
- image_ref: The image reference (e.g., docker.io/library/alpine:latest)
**Output:**
- The image config
Usage
Running with ToolHive (Recommended)
The easiest way to run the OCI Registry MCP server is using
ToolHive, which provides secure,
containerized deployment of MCP servers:
The server will be available to your MCP-compatible clients and can query OCI
registries for image information.
Authentication with ToolHive
If you need to access private registries, you can provide authentication
credentials using ToolHive's secret management:
Development
Prerequisites
- Go 1.21 or later
- Access to OCI registries
Authentication
The server supports the following authentication methods for accessing private
OCI registries (in order of priority):
1. **HTTP Authorization Header** (Highest Priority): Include a bearer token in
the HTTP request's Authorization header:
- Authorization: Bearer
- This method takes precedence over all other authentication methods
- When present, environment variables and Docker config are ignored
2. **Bearer Token Environment Variable**: Set the following environment variable:
- OCI_TOKEN: Bearer token for registry authentication
3. **Username and Password**: Set the following environment variables:
- OCI_USERNAME: Username for registry authentication
- OCI_PASSWORD: Password for registry authentication
4. **Docker Config** (Lowest Priority): If no other authentication is provided,
the server will use the default Docker keychain, which reads credentials from
~/.docker/config.json.
Examples:
Port Configuration
The server can be configured to listen on a specific port using either: