Chainguard AI Docs MCP Server – Secure Image Guidance
The Chainguard AI Documentation MCP server gives AI assistants searchable access to official Chainguard container image documentation, security guides, package mappings, and tool references. Use it when an agent needs current Chainguard guidance for secure container migration, CVE management, Wolfi, melange, apko, or image-selection workflows.
Overview
The Chainguard AI Documentation MCP server connects MCP-compatible AI clients
to Chainguard's official documentation corpus. It is designed for developers,
platform teams, and security engineers who want an assistant to answer
questions using Chainguard's container image docs, security guides, migration
material, and tool references instead of relying only on model training data.
The hosted endpoint is the fastest path for clients with HTTP transport, while
the Chainguard ai-docs container supports local stdio and self-hosted HTTP
deployments.
What the MCP server enables
The server exposes documentation-focused tools rather than direct access to a
customer's Chainguard account. Available tools include search_docs,
get_image_docs, list_images, get_security_docs, get_tool_docs,
find_package_equivalent, and check_image_freshness. These tools let an
agent search across Chainguard documentation, retrieve docs for a specific
container image, inspect security and CVE guidance, look up Wolfi, apko,
melange, and chainctl documentation, map Debian, Fedora, or Alpine packages to
Wolfi equivalents, and check image tag freshness from the bundled image
catalog.
When to use it
Use this MCP server when an AI assistant is helping migrate Dockerfiles to
Chainguard Images, choose production or development image variants, answer
CVE-management questions, explain Wolfi package equivalents, or draft secure
container build patterns. It is especially useful inside IDEs and agentic coding
workflows where the assistant needs precise Chainguard-specific context while a
developer edits container manifests, Dockerfiles, Kubernetes workloads, or CI
configuration.
Connection and authentication
Chainguard hosts a public HTTP MCP endpoint at
https://mcp.edu.chainguard.dev/mcp/. Clients that support HTTP transport can
connect directly. Clients that only launch local processes can use a bridge such
as mcp-remote. For local execution, pull ghcr.io/chainguard-dev/ai-docs:latest
and run serve-mcp over stdio. For self-hosted HTTP, run the same container
with serve-mcp-http, which exposes /mcp/ on the configured host and port.
No Chainguard API token is documented as required for the public docs server.
Key considerations
The MCP server is for documentation retrieval and image/catalog lookup, not for
managing Chainguard accounts or private registries. The container distribution
is recommended by Chainguard and is built on wolfi-base, runs as a non-root
user, includes verification checks, is signed with Cosign, and is rebuilt
regularly. Treat any self-hosted HTTP deployment as an internal service unless
you intentionally expose it, because it is meant to provide documentation tools
to trusted MCP clients.
Supported Transports
streamable_http
URL: https://mcp.edu.chainguard.dev/mcp/
stdio
Command: docker
Args:
run--rm-ighcr.io/chainguard-dev/ai-docs:latestserve-mcp
Frequently Asked Questions
- When should an AI agent use the Chainguard AI Docs MCP server?
- Use it when an agent needs official Chainguard context for secure container images, CVE guidance, migration from traditional base images, Wolfi package equivalents, apko, melange, chainctl, or supply-chain security documentation.
- What does this MCP server add to an AI agent's capabilities?
- It gives the agent searchable access to Chainguard's compiled documentation bundle and image catalog through tools such as search_docs, get_image_docs, get_security_docs, get_tool_docs, find_package_equivalent, list_images, and check_image_freshness.
- What can the AI agent access or manage through this server?
- The agent can access public Chainguard documentation sections, container image documentation, security guidance, package mappings, and catalog-based image metadata. It does not manage a user's Chainguard account, private registry access, projects, or billing.
- How is authentication configured for this MCP server?
- Chainguard documents a public hosted MCP endpoint for the AI documentation server and does not document a required API token for that endpoint. Local stdio usage runs the signed ai-docs container, so access control is handled by the local MCP client and host environment.
- Which transport should be used for this MCP server?
- Use streamable_http with the hosted endpoint for clients that support HTTP MCP transport. Use stdio with the Docker command when running the Chainguard ai-docs container locally or when a client launches MCP servers as local processes.