IAC Audit Pack

Unbearable IaC Audit Pack

Unbearable IaC Audit Pack — all four audit Actors under one MCP endpoint. Snyk-comparable scope at a fraction of the cost. Pay-per-event — only billed when a tool is actually called.

64 checks. 20 categories. 4 audit engines. 1 MCP endpoint.

---

What's included

| Package | Checks | Categories | Primary tool | |---------|--------|------------|--------------| | Docker Compose audit | 25 | 9 | audit_compose | | Dockerfile audit | 19 | 5 | audit_dockerfile | | GitHub Actions audit | 21 | 6 | audit_github_actions | | HU Postcode Validator | 5 tools | — | validate_postcode, lookup_city, … |

Plus two bundle-only tools:

• audit_all — paste a dict of filenames → content; auto-detects Dockerfile, compose, and workflow files and runs the right audit on each
• list_all_checks — full cross-package check catalog in one call

Quick start (Claude Desktop)

{
  "mcpServers": {
    "iac-audit-pack": {
      "type": "http",
      "url": "https://unbearable-dev--iac-audit-pack.apify.actor/mcp",
      "headers": {
        "Authorization": "Bearer <your-apify-token>"
      }
    }
  }
}

Tool catalog

Aggregation (bundle-only)

| Tool | Description | |------|-------------| | audit_all(files, min_severity?) | Multi-file detection + combined audit report | | list_all_checks() | All 64 checks across all three audit packages |

Docker Compose (25 checks, 9 categories)

| Tool | Description | |------|-------------| | audit_compose(compose_yaml?, compose_url?, min_severity?) | Full 25-check audit | | check_privilege | Privileged mode, cap_add, user namespace | | check_network | Host networking, exposed dangerous ports | | check_secrets | Hardcoded passwords, tokens in env vars | | check_filesystem | Docker socket mounts, host path mounts | | check_resources | Missing memory/CPU limits | | check_image_hygiene | Unpinned tags, latest usage | | check_runtime_lifecycle | Restart policies, healthchecks | | check_logging | Logging driver config | | check_compose_hygiene | Version field, service naming | | list_checks_compose(category?) | Check catalog |

Dockerfile (19 checks, 5 categories)

| Tool | Description | |------|-------------| | audit_dockerfile(dockerfile_content?, dockerfile_url?, min_severity?) | Full 19-check audit | | check_base_image_dockerfile | Unpinned base, latest, root user in FROM | | check_instructions_dockerfile | ADD vs COPY, COPY ordering, ENV secrets | | check_security_dockerfile | USER root, privilege escalation patterns | | check_efficiency_dockerfile | Layer count, cache busting | | check_secrets_dockerfile | Hardcoded secrets in RUN/ENV/ARG | | list_checks_dockerfile(category?) | Check catalog |

GitHub Actions (21 checks, 6 categories)

| Tool | Description | |------|-------------| | audit_github_actions(workflow_yaml?, workflow_url?, min_severity?) | Full 21-check audit | | check_secrets_gha | Leaked tokens, secret in run: blocks | | check_permissions_gha | Overly broad write-all permissions | | check_action_pinning_gha | Unpinned action refs (not SHA-pinned) | | check_runner_security_gha | Self-hosted runner risks | | check_workflow_config_gha | pull_request_target misuse, script injection | | check_supply_chain_advanced_gha | TeamPCP-class supply-chain patterns (GHA-201..208) | | list_checks_github_actions(category?) | Check catalog |

HU Postcode Validator (5 tools)

| Tool | Description | |------|-------------| | validate_postcode(postcode) | Settlement + county for a HU postcode | | lookup_postcode(postcode) | Alias for validate_postcode | | lookup_city(city) | All postcodes for a city (diacritic-insensitive) | | validate_address(postcode, city) | Postcode/city pairing validation | | list_postcodes_in_county(county_name) | All postcodes in a county | | budapest_district_lookup(district_number) | Budapest I-XXIII → postcodes |

Pricing

| Event | USD | |-------|-----| | audit_all or any single-domain audit call | $0.10 | | Single-domain audit (audit_compose, audit_dockerfile, audit_github_actions) | $0.05 | | list_checks / discovery calls | $0.005 |

Pay-per-event — no subscription, no monthly minimums. You pay only when a tool is invoked.

Architecture

Package-import (not proxy): all four sub-packages are bundled directly into the Actor image. Single cold start, single billing rail, no cross-Actor latency. See DESIGN.md for the full rationale.

---

Built by Noel @ Unbearable Labs — more like this in the weekly newsletter.