feat: add Pinecone MCP server by JAORMX · Pull Request #509 · stacklok/dockyard

JAORMX · 2026-04-20T07:59:01Z

Adds packaging for @pinecone-database/mcp v0.2.1 (Apache-2.0).

The Pinecone MCP server exposes nine capabilities:

search-docs — query Pinecone documentation
list-indexes, describe-index, describe-index-stats
create-index-for-model — provision integrated-embedding indexes
upsert-records, search-records — data operations
cascading-search — cross-index dedup + rerank
rerank-documents — standalone reranking

Without PINECONE_API_KEY only search-docs is exposed; the rest require authentication.

Source: https://github.com/pinecone-io/pinecone-mcp

Why

Unblocks follow-up packaging of pinecone-mcp, pinecone-query, and pinecone-quickstart skills from pinecone-io/skills (excluded from #507 pending this MCP being in the catalog). Also lets the Pinecone MCP itself be distributed as a signed, provenance-attested container.

Test plan

task build -- npx/pinecone-mcp generates a valid Dockerfile
task scan -- npx/pinecone-mcp passes (1 tool scanned without creds)
CI: Build Containers workflow succeeds
Post-merge: container published at ghcr.io/stacklok/dockyard/npx/pinecone-mcp:0.2.1
Follow-up: register in toolhive-catalog under registries/official/servers/pinecone/

Adds packaging for @pinecone-database/mcp v0.2.1 (Apache-2.0). The Pinecone MCP server exposes nine capabilities — search-docs, list-indexes, describe-index, describe-index-stats, create-index-for-model, upsert-records, search-records, cascading-search, and rerank-documents. Without PINECONE_API_KEY only search-docs is exposed; the rest require authentication. Source: https://github.com/pinecone-io/pinecone-mcp Package: https://www.npmjs.com/package/@pinecone-database/mcp Unblocks follow-up packaging of pinecone-mcp, pinecone-query, and pinecone-quickstart skills from pinecone-io/skills (#495). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds the Pinecone MCP server (@pinecone-database/mcp) to both the official and toolhive tiers. Pinecone publishes the server themselves (tier: Official). The server exposes nine tools: - search-docs — query Pinecone docs - list-indexes, describe-index, describe-index-stats - create-index-for-model — provision integrated-embedding indexes - upsert-records, search-records - cascading-search — cross-index dedup + rerank - rerank-documents — standalone reranking Without PINECONE_API_KEY only search-docs is exposed; with a valid key the server exposes all nine index and search tools. Source: https://github.com/pinecone-io/pinecone-mcp Container (pending): ghcr.io/stacklok/dockyard/npx/pinecone-mcp:0.2.1 (see stacklok/dockyard#509 for packaging PR) Unblocks packaging of MCP-dependent Pinecone skills — pinecone-mcp, pinecone-query, pinecone-quickstart — from pinecone-io/skills. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The Pinecone MCP server is now being registered in the toolhive catalog (stacklok/toolhive-catalog PR) and packaged in dockyard (#509), satisfying the skill-criteria.md requirement that 'every referenced MCP server must already be included in the catalog'. These three previously-excluded skills are therefore eligible for inclusion: - pinecone-mcp — Pinecone MCP server tools reference - pinecone-query — natural-language query via search-records - pinecone-quickstart — two-path onboarding (Database via MCP, Assistant) Pinned to upstream 787cd27 (same as the other 4 Pinecone skills). Security: all 3 pass with only MANIFEST_MISSING_LICENSE. Refs #495 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-advanced-security · 2026-04-20T08:04:08Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

github-actions · 2026-04-20T08:04:35Z

🔒 MCP Security Scan Results

✅ pinecone-mcp

Status: Passed
Tools scanned: 0
Result: No security issues detected

Summary: Scanned 1 MCP server(s), all passed security checks. ✅

Medium-severity vulnerabilities in base images and transitive deps routinely block container builds (e.g. PR #509 Pinecone MCP) even when no fix is available upstream. Only fail the build on high/critical findings; medium and below still upload to the Security tab via SARIF. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Medium-severity vulnerabilities in base images and transitive deps routinely block container builds (e.g. PR #509 Pinecone MCP) even when no fix is available upstream. Only fail the build on high/critical findings; medium and below still upload to the Security tab via SARIF. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(skills): package 4 Pinecone skills Packages 4 non-MCP-dependent skills from pinecone-io/skills (MIT). - pinecone-assistant — managed RAG service (create, upload, sync, chat) - pinecone-cli — terminal-based index and vector management (pc CLI) - pinecone-docs — curated docs reference - pinecone-help — skills overview and getting-started essentials Pinned to upstream 787cd27. Skills intentionally excluded (MCP server dependency): Per skill-criteria.md MCP-server-dependency rule, three upstream skills depend on the Pinecone MCP server (@pinecone-database/mcp — npx-distributed, stdio) which is NOT YET packaged in either the toolhive catalog or dockyard: - pinecone-mcp - pinecone-query - pinecone-quickstart Follow-up: packaging npx/pinecone-mcp in dockyard and registering it in the toolhive catalog would unlock these three skills in a later PR. Security: all 4 pass with only MANIFEST_MISSING_LICENSE. Refs #495 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(skills): add 3 MCP-dependent Pinecone skills The Pinecone MCP server is now being registered in the toolhive catalog (stacklok/toolhive-catalog PR) and packaged in dockyard (#509), satisfying the skill-criteria.md requirement that 'every referenced MCP server must already be included in the catalog'. These three previously-excluded skills are therefore eligible for inclusion: - pinecone-mcp — Pinecone MCP server tools reference - pinecone-query — natural-language query via search-records - pinecone-quickstart — two-path onboarding (Database via MCP, Assistant) Pinned to upstream 787cd27 (same as the other 4 Pinecone skills). Security: all 3 pass with only MANIFEST_MISSING_LICENSE. Refs #495 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds the Pinecone MCP server (@pinecone-database/mcp) to both the official and toolhive tiers. Pinecone publishes the server themselves (tier: Official). The server exposes nine tools: - search-docs — query Pinecone docs - list-indexes, describe-index, describe-index-stats - create-index-for-model — provision integrated-embedding indexes - upsert-records, search-records - cascading-search — cross-index dedup + rerank - rerank-documents — standalone reranking Without PINECONE_API_KEY only search-docs is exposed; with a valid key the server exposes all nine index and search tools. Source: https://github.com/pinecone-io/pinecone-mcp Container (pending): ghcr.io/stacklok/dockyard/npx/pinecone-mcp:0.2.1 (see stacklok/dockyard#509 for packaging PR) Unblocks packaging of MCP-dependent Pinecone skills — pinecone-mcp, pinecone-query, pinecone-quickstart — from pinecone-io/skills. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rdimitrov · 2026-04-21T15:28:10Z

Heads-up: main now carries a .grype.yaml (#539) that suppresses base-image Grype findings. Rebasing this branch onto main should drop the false-positive CI failures from build-containers. Any remaining failures after the rebase are real runtime-dep issues in pinecone-mcp's own node_modules and will need to be looked at individually.

JAORMX mentioned this pull request Apr 20, 2026

feat(server): add Pinecone MCP server stacklok/toolhive-catalog#1103

Merged

2 tasks

JAORMX mentioned this pull request Apr 20, 2026

feat(skills): package 7 Pinecone skills #507

Merged

4 tasks

JAORMX mentioned this pull request Apr 20, 2026

ci: raise grype severity cutoff from medium to high #518

Merged

3 tasks

Merge branch 'main' into mcp/pinecone

6ef157a

JAORMX mentioned this pull request Apr 21, 2026

ci: set only-fixed on grype scan to skip unfixable CVEs #536

Merged

2 tasks

Merge branch 'main' into mcp/pinecone

48f3435

Merge branch 'main' into mcp/pinecone

83eee00

rdimitrov approved these changes Apr 21, 2026

View reviewed changes

rdimitrov merged commit 66a6eb2 into main Apr 21, 2026
13 checks passed

rdimitrov deleted the mcp/pinecone branch April 21, 2026 16:15

Navigation Menu

Uh oh!

feat: add Pinecone MCP server - #509

feat: add Pinecone MCP server#509
rdimitrov merged 4 commits into
mainfrom
mcp/pinecone

JAORMX commented Apr 20, 2026

Uh oh!

github-advanced-security AI commented Apr 20, 2026

Uh oh!

github-actions Bot commented Apr 20, 2026 •

edited

Loading

Uh oh!

rdimitrov commented Apr 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

JAORMX commented Apr 20, 2026

Why

Test plan

Uh oh!

github-advanced-security AI commented Apr 20, 2026

What Enabling Code Scanning Means:

Uh oh!

github-actions Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 MCP Security Scan Results

✅ pinecone-mcp

Uh oh!

rdimitrov commented Apr 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Apr 20, 2026 •

edited

Loading