A centralized repository for packaging Model Context Protocol (MCP) servers and agent skills into secure, verified OCI artifacts.

Dockyard automatically builds, scans, and publishes container images for MCP servers, and OCI skill artifacts for agent skills. Every artifact is security-scanned, signed with Sigstore, and includes full build provenance.

# Pull a container
docker pull ghcr.io/stacklok/dockyard/npx/context7:2.1.0

# Verify its signature
cosign verify \
  --certificate-identity-regexp "https://github.com/stacklok/dockyard/.github/workflows/build-containers.yml@refs/heads/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/stacklok/dockyard/npx/context7:2.1.0

# Run it
docker run -it ghcr.io/stacklok/dockyard/npx/context7:2.1.0

Browse available servers: npx/ | uvx/ | go/

Browse available skills: skills/

Create a spec.yaml in the appropriate directory and submit a PR:

metadata:
  name: your-server
  description: "What your server does"
  protocol: npx  # or uvx, go

spec:
  package: "your-package-name"
  version: "1.0.0"

Our CI/CD pipeline will automatically:

1. Scan for security vulnerabilities (blocking)
2. Verify package provenance (informational)
3. Build multi-arch containers
4. Sign and attest with Sigstore
5. Publish to ghcr.io/stacklok/dockyard

See Adding MCP Servers for the full guide.

Every container includes:

• MCP Security Scan - Scanned with mcp-scanner before build
• Container Scan - Trivy vulnerability scanning
• Signed Images - Sigstore/Cosign keyless signatures
• Attestations - SBOM, build provenance, and security scan results

See Security Overview for details.

We welcome contributions! See CONTRIBUTING.md for guidelines.

To add an MCP server, see Adding MCP Servers.

Apache 2.0 - see LICENSE for details.

• ToolHive - Container building technology
• MCP Documentation - Model Context Protocol
• Sigstore - Container signing