Pinner MCP is an MCP server designed to pin 3rd party dependencies to immutable digests to prevent supply chain attacks. It supports Docker base images and GitHub Actions. The server runs in a container and exposes stdio transport, enabling integration with development tools via standard input/output. In VS Code, configure the pinner-mcp stdio server in .vscode/mcp.json and interact with prompts such as "Pin GitHub Actions to their commit hash" or "Pin container base images to digests", with an option to "Update pinned versions" to refresh pins. Cursor users can similarly configure .cursor/mcp.json and enable the MCP server in settings, using prompts to pin specific commits or update versions. Tool updates are published to the latest tag on the GitHub Container Registry, and users must manually pull the latest image to refresh locally. For development, you can build a local image with "docker build -t pinner-mcp:local ." and run it in the same workflow as described in the usage section. The project emphasizes using prompts to manage pins and updates for Docker bases and GitHub Actions across environments.