Docs/MCP Server

MCP Server

reel runs as a Model Context Protocol server, exposing its container-extraction tools to Claude Code, Cursor, Continue, and other MCP-aware AI clients. Local-only, stdio transport.

Install

Install the CLI, then add reel to your MCP client's config.

# macOS

brew install getreeldev/tap/reel

# Verify

reel start mcp --help

Claude Desktop / Claude Code

Add reel to ~/.claude/mcp_servers.json (Claude Desktop) or your project's .mcp.json (Claude Code):

{
  "mcpServers": {
    "reel": {
      "command": "reel",
      "args": ["start", "mcp"]
    }
  }
}

Cursor / Continue

Same JSON shape. Both read the standard MCP server config. Restart the client after editing.

Seven tools

Artifact tools take destination=inline|local|s3. inline is capped at 1 MB so a big SBOM won't flood the model's context. Discovery tools take summary=true for counts only.

Tool	Group	What it does
whoami	Identity	Mode, version, available tools, runtime.
health	Identity	Liveness probe for the running server.
list_workloads	Discovery	Local runtime containers. Supports summary=true.
list_images	Discovery	Local images. Supports summary=true.
sbom	Extraction	CycloneDX SBOM. Scanners: vuln, secret, license, config, vex.
cbom	Extraction	Crypto Bill of Materials: algorithms, certs, keys.
malware	Extraction	ClamAV scan of the container or image rootfs.

Vendor VEX in the AI loop

Pass scanners: ["vuln", "vex"] on the sbom tool and the AI gets Trivy's findings already annotated with vendor verdicts (not_affected / fixed / affected), pulled live from vex.getreel.dev. So the model sees which CVEs the vendor already ruled out, not just the raw list.