What is mcp-server-docker?
mcp-server-docker, written by Christian Kreiling (GitHub user ckreiling) and published on PyPI under the same name, lets an agent manage a Docker engine through the Python Docker SDK. It exposes 19 tools across containers, images, networks and volumes, two resource templates for container logs and live stats, and a docker_compose prompt that has the model plan and apply a set of labelled containers, Terraform-style. It runs over stdio only.
It connects with the Docker SDK's from_env method, so it uses the local socket at /var/run/docker.sock by default and honours DOCKER_HOST, DOCKER_TLS_VERIFY and DOCKER_CERT_PATH. Setting DOCKER_HOST to an ssh:// URL reaches a remote engine over SSH, added in v0.2.0 in May 2025. It does not edit or read docker-compose.yml files, and there is no tool to exec into a running container; a pull request adding one has been open since July 2025.
The repo is licensed GPL-3.0 and has about 750 GitHub stars and 98 forks. It has one GitHub release, v0.3.0 on 7 August 2026, which moved it to version 2 of the MCP Python SDK; before that the last PyPI release was 0.2.1 in June 2025. The package was downloaded about 7,900 times in the month to 28 October. It is not listed in the official MCP registry.
It should not be confused with docker/mcp-gateway, Docker's own MCP Toolkit, which runs MCP servers from Docker's catalogue in containers rather than letting an agent manage your containers. QuantGeekDev/docker-mcp, still recommended in some roundups, has had no commit since 14 December 2024.
How to install mcp-server-docker
uvx mcp-server-dockerIs mcp-server-docker worth it?
Access to the Docker socket is access to the host, and this server passes that on to the model in full. Docker's own security guide says only trusted users should control the daemon, because a container can mount the host's root directory and change it without restriction; its install docs say the docker group grants root-level privileges. The server's README notes that it refuses --privileged and capability flags, but the volumes argument on create_container, run_container and recreate_container takes any host path. A prompt-injected agent can therefore ask for a container with / mounted at /host, or with the Docker socket itself mounted inside, and get the same result without either flag.
There is no way to narrow that. Of the 19 tools, five read (list_containers, list_images, list_networks, list_volumes and fetch_container_logs) and the other 14 write: create, run, start, stop and recreate containers; pull, push, build and remove images; and create and remove networks and volumes. The server sets MCP tool annotations, marking five remove and recreate tools as destructive so clients can ask for confirmation, but it has no read-only flag, no allow-list and no mount restrictions. An open pull request from March 2026 would block mounts of /proc, /sys, /dev and runtime sockets; it has not been merged.
The inputs an agent reads are also the ones an attacker controls. Container logs, image labels and the state blocks returned by the list tools all flow back into the model, so a log line in a container you pulled from a public registry is a plausible injection route. A disclosure request filed in April 2026 says the reporter emailed details of host filesystem access and container escape in March and got no reply; a second request for a private security contact was filed on 26 October. No GitHub security advisories have been published.
Maintenance is slow rather than dead. The August 2026 release was a careful rewrite onto the version 2 Python SDK with tests for every tool, but it came 14 months after the previous one, and 39 issues and pull requests are open, 15 of them pull requests, including fixes for unbounded log output and a list_containers result one user measured at about 103 KB for 22 containers. Paramiko, used for SSH, is pinned below 4.0, which an open issue says leaves a known advisory unpatched.
SSH support is the feature that sets it apart from running the Docker CLI through a shell tool, and the plan-and-apply prompt is a thoughtful touch. Neither changes the core trade-off: it suits a disposable VM or a dedicated Docker host with nothing on it worth stealing, and the Kubernetes server, with its read-only and allow-list modes, is the better-guarded way to let an agent near shared infrastructure.
Where it earns its place
A developer trying out self-hosted apps on a spare Linux VM
Bring up WordPress and a MySQL container from a plain-English description
Invoke the docker_compose prompt with a project name; the model proposes a plan, waits for apply, then calls run_container and create_volume with a project label so it can resume or destroy the set later. Free, and on a VM you can rebuild the root-level exposure costs little.
A solo founder running a marketing site on one rented Docker host
Check why the site container keeps restarting and restart it from a chat window
Set DOCKER_HOST to ssh://user@host and the agent can read restart counts with list_containers and the last 100 log lines with fetch_container_logs. The same session can also remove volumes or mount the host filesystem, so it belongs on a host holding nothing beyond that site.
A platform lead at a 30-person company reviewing which MCP servers staff may install
Decide whether the Docker server is acceptable on developer laptops
The answer turns on the socket: on Linux any tool call can create a container that mounts the home directory or /, and the server has no switch to prevent it. A policy limiting it to a separate VM or a rootless Docker daemon is cheaper than auditing every prompt.
Before you commit
- Setup
- Add uvx mcp-server-docker to the client config (the README documents Claude Desktop); it needs uv and Python 3.12 or later. A Dockerfile is provided, but you build the image yourself and mount /var/run/docker.sock into it. If docker ps works for your user, the first tool call works in minutes.
- Integrations
- 19 tools: five read-only (list_containers, list_images, list_networks, list_volumes, fetch_container_logs) and 14 that write, from run_container and recreate_container to build_image, push_image and remove_volume. Two resources serve container logs and stats; one prompt, docker_compose, runs a plan-and-apply loop over labelled resources.
- Data and privacy
- It can do whatever the Docker daemon can, which on a standard install is root on the host, and over SSH the same on the remote host. Logs, labels and container state from untrusted images reach the model. Everything runs locally; no advisories are published, and two public requests to report vulnerabilities privately are unanswered.
- Cost at scale
- Free; the cost is context. list_containers returns full inspect-level state, which one user measured at about 103 KB for 22 containers, and fetch_container_logs accepts tail=all with no byte limit.
- Limits
- No exec into running containers, no Docker Compose file support, no secrets handling (the README says not to pass sensitive data) and no --privileged or capability options. Stdio only. recreate_container does not carry over the old container's settings.
What's good
- 19 tools cover containers, images, networks and volumes
- Remote engines over SSH by setting DOCKER_HOST
- Destructive tools carry MCP annotations clients can gate
- Tests for every tool since the v0.3.0 rewrite
What's not
- No read-only mode, allow-list or mount restrictions
- Any host path can be mounted, including / and the socket
- Security disclosure requests unanswered since April 2026
- One release in the 16 months to October 2026
Best for
Developers and home-lab users who want an agent to run containers on a disposable or dedicated Docker host they would be happy to rebuild.
mcp-server-docker alternatives
mcp-server-docker: common questions
- Is mcp-server-docker worth it?
- A tidy Docker server for a throwaway machine, but it gives an agent root-equivalent control of the host with no read-only mode, and the maintainer has not answered two security reports. We rate it 3.3 out of 5.
- How much does mcp-server-docker cost?
- Free and open source (GPL-3.0). You pay only for the hosts running Docker.
- What are the downsides of mcp-server-docker?
- No read-only mode, allow-list or mount restrictions; any host path can be mounted, including / and the socket; security disclosure requests unanswered since April 2026; one release in the 16 months to October 2026.
- Who is mcp-server-docker best for?
- Developers and home-lab users who want an agent to run containers on a disposable or dedicated Docker host they would be happy to rebuild.
- How much does mcp-server-docker cost for a team or in production?
- Free; the cost is context. list_containers returns full inspect-level state, which one user measured at about 103 KB for 22 containers, and fetch_container_logs accepts tail=all with no byte limit.
- Is mcp-server-docker safe for company data?
- It can do whatever the Docker daemon can, which on a standard install is root on the host, and over SSH the same on the remote host. Logs, labels and container state from untrusted images reach the model. Everything runs locally; no advisories are published, and two public requests to report vulnerabilities privately are unanswered.
- What are the best mcp-server-docker alternatives?
- The closest alternatives we have reviewed are MCP Server Kubernetes, Filesystem (reference server) and Terraform MCP Server.
Answers checked Oct 28, 2026.