Dockerfile build-cache and reproducibility lint

$0.005 USDC per call · Developer and security · POST /api/v1/dockerfile-cache-lint · Id dockerfile-cache-lint

Parses a Dockerfile (continuations, escape directive, heredocs, flags, stages) and reports instruction orderings that defeat the layer cache or make rebuilds drift, for agents writing or reviewing container builds. Cache: COPY of the whole context before a dependency or package install, apt-get update in its own RUN, per-build ARG/ENV values (build date, git sha) declared before later RUN steps. Reproducibility: FROM or COPY --from with no tag or :latest (or no digest with basePin=digest), ADD of a URL without --checksum, unpinned ADD/git clone, curl | sh. Optional hygiene: cd instead of WORKDIR, pipes without pipefail. Does not build the image, read .dockerignore, resolve registries or analyse shell inside $(...) or scripts invoked by name.

What you get

Cache-busting instruction order turns a 5-second rebuild into a full dependency install on every commit.

Call it

Send the JSON body below to https://agents.writerslogic.com/api/v1/dockerfile-cache-lint. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.

curl -i -X POST https://agents.writerslogic.com/api/v1/dockerfile-cache-lint \
  -H 'content-type: application/json' \
  -d '{"dockerfile":"FROM node:latest\nWORKDIR /app\nCOPY . .\nRUN npm ci\nCMD [\"node\", \"server.js\"]\n"}'

Input

Field	Type	Required	Description
`dockerfile`	string; length 0..100000	yes	Dockerfile text, at most 5000 lines and 128 stages.
`include`	array<string; one of "cache", "reproducibility", "hygiene">; max 3 items	no	Rule categories that decide the status. Default cache and reproducibility.
`basePin`	string; one of "tag", "digest"	no	tag (default): flag only missing or :latest tags. digest: flag every base image not pinned by @sha256.

Example request body

{
  "dockerfile": "FROM node:latest\nWORKDIR /app\nCOPY . .\nRUN npm ci\nCMD [\"node\", \"server.js\"]\n"
}

Result

The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.

Field	Type	Required	Description
`status`	string; one of "pass", "fail", "unknown", "unsupported"	no	pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass.
`instructionCount`	integer	no
`stages`	array<object>	no
`findings`	object	no	Finding counts per category among the included categories (hygiene counted only if included).
`witnesses`	array<object>	no
`versions`	object	no	Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile).
`limits`	array<string>	no
`deterministic`	boolean	no	Always true: pure code, no model.

Pay and connect

Available through: x402 (USDC on Base), MCP. MCP clients reach it through the code-preflight-kit package.

Machine-readable

This agent as JSON (schemas, example, OpenAPI operation)
Free signed sample response
OpenAPI 3.1 · Catalog · Index of every agent