What is Docker MCP Gateway?
Docker MCP Gateway is the open-source code behind the docker mcp CLI plugin and the MCP Toolkit in Docker Desktop. It is not an MCP server for managing your containers. It is a proxy that sits between an MCP client such as Claude Desktop, Claude Code, Cursor or VS Code and many MCP servers, starts each server in its own Docker container when one of its tools is called, injects that server's secrets or OAuth tokens, and exposes all of them through a single stdio, SSE or Streamable HTTP endpoint. Servers come from Docker's MCP Catalog (300+ servers, according to Docker's docs), any OCI image, the official MCP registry or a local YAML file, grouped into profiles that can be pushed to a registry and shared.
That makes it a different thing from mcp-server-docker (reviewed here as docker), a community server that hands an agent create, run and remove tools over your Docker daemon. The gateway uses the daemon to run tool servers in isolation; it gives the model no general container-management tools of its own.
The repository is MIT-licensed, written in Go and has about 1,630 GitHub stars and 293 forks. Releases are frequent: v0.44.3 shipped on 26 October 2026, after v0.44.2 on 21 October. It ships inside Docker Desktop, and Docker's docs also document a manual install on Docker Engine without Desktop.
How to install Docker MCP Gateway
docker mcp gateway run (bundled with Docker Desktop; on Docker Engine, install the docker-mcp binary from GitHub releases into ~/.docker/cli-plugins)Is Docker MCP Gateway worth it?
Its main value is containment. Each server runs in its own container with 1 CPU and 2 GB of memory by default, no-new-privileges, none of your host environment variables and no access to the host filesystem unless you grant a mount, which defaults to read-only and must sit under an allow-listed path. Secrets are scoped to the server that declares them, and --block-secrets, on by default, scans tool arguments and responses for secret-like values. Docker builds and signs the local servers in its catalogue and publishes an SBOM for each; signature verification is on by default for images in the mcp/ namespace. Call logging is also on by default and records the tool name and the shape of its arguments, not their values.
Those defaults were not always there. The repository has published 10 security advisories. In July 2026 alone it disclosed two critical ones, unauthenticated access to proxied tools in container mode and an unvalidated bind mount through the dynamic tools, plus a high-severity finding that signature verification was off by default; all were fixed in 0.43.1. A DNS-rebinding flaw in the HTTP transports was fixed in v0.28.0 in December 2025, and the two most recent, both medium, in 0.44.1. The record shows a project that is being audited and answers quickly, and it also means a pinned old version is a real risk.
Some exposure remains by design. Network egress is open unless a server declares limits or you run with --block-network, and the security document puts prompt injection and poisoned tool descriptions out of scope unless they break a gateway boundary. Dynamic MCP, on by default with the Toolkit, gives the agent mcp-find and mcp-add to pull servers from the catalogue in the middle of a session; that saves set-up but lets the model widen its own tool list, and docker mcp feature disable dynamic-tools turns it off. Code mode, which writes JavaScript that chains tools, is marked by Docker as not yet reliable.
The gateway runs without Docker Desktop, but as a second-class path. On Docker Engine you download the binary into ~/.docker/cli-plugins yourself, set DOCKER_MCP_IN_CONTAINER=1 if it complains that Desktop is not running, enable profiles by hand, keep secrets in a .env file instead of Desktop's store, and set DOCKER_MCP_USE_CE=true plus a credential helper before OAuth works. Every server must be a container image; a request to run plain npx or uvx servers has been open since September 2025, among 122 open issues. On Desktop, companies with 250 or more staff or $10 million or more in revenue need a paid seat, from $9 a month.
Against the alternatives, it sits between the do-it-yourself and the hosted. Stacklok's ToolHive gives a similar container-per-server model with more emphasis on team policy; Composio and Pipedream host the tools and the OAuth for you, which means their servers see your data. Docker's gateway keeps everything on your machine, and for a developer who already runs Docker it removes most of the risk of installing servers from strangers.
Where it earns its place
A developer using Claude Code and Cursor on the same laptop
Stop configuring GitHub, Notion and Postgres servers twice and keeping API keys in plain JSON
Create one profile with docker mcp profile create, add the three catalogue servers, store their keys with docker mcp secret and run docker mcp client connect for each client. Both editors then call the same gateway, and the keys never sit in either client's config file.
A security lead at a 40-person software company
Let staff use MCP servers without letting them install arbitrary npm packages on their machines
Publish a custom catalogue of approved servers with docker mcp catalog create and push it to the company registry; staff pull it, and tool allow-lists in each profile trim what agents can call. Desktop seats at this size are free only if revenue is under $10 million.
A platform engineer building an internal agent service on a Linux VM
Expose a fixed set of MCP tools to agents over HTTP without Docker Desktop
Run the docker/mcp-gateway image under Docker Compose with the Docker socket mounted, --servers naming the allowed servers, --transport streaming and a token in MCP_GATEWAY_AUTH_TOKEN. No Desktop licence applies; secrets come from a .env file and --block-network tightens egress.
Before you commit
- Setup
- On Docker Desktop (the README asks for 4.59 or later) enable MCP Toolkit, add servers from the catalogue and connect a client; the client config is just docker mcp gateway run. On Docker Engine, download docker-mcp from the GitHub releases into ~/.docker/cli-plugins, or run the docker/mcp-gateway image with /var/run/docker.sock mounted. Docs cover Claude Desktop, Claude Code, Cursor and VS Code.
- Integrations
- The gateway's own tools are management ones: mcp-find, mcp-add, mcp-config-set, mcp-remove, mcp-exec and the experimental code-mode. Everything else comes from the servers you enable, from the 300+ in Docker's catalogue, any OCI image or the MCP registry; --tools and per-profile allow-lists select individual tools. Interceptors can run your own scripts before or after calls.
- Data and privacy
- Runs locally. The gateway reaches whatever the enabled servers and their secrets reach, and the gateway itself needs the Docker socket, which is root-equivalent on a standard Linux install. Under Desktop, gateway metrics go to Docker's usage analytics and can be switched off in Desktop settings; without Desktop, the telemetry docs say nothing is exported. Tool output from remote services reaches the model unfiltered apart from secret scanning.
- Cost at scale
- Free software. Desktop licences apply at 250 staff or $10 million revenue: Pro $9, Team $15, Business $24 per user/month billed annually. Each running server reserves up to 1 CPU and 2 GB by default, so ten servers kept alive with --long-lived can claim a large share of a laptop.
- Limits
- 122 open issues and 52 open pull requests. Open requests include non-container npx and uvx servers, passing secrets from environment variables, disabling the default catalogue and OAuth in Engine mode. Servers added through dynamic tools last only for the session. Code mode is experimental.
What’s good
- Each server isolated in a container with CPU, memory and mount limits
- Secret blocking, signature checks and HTTP bearer tokens on by default
- One endpoint and one profile shared across Claude, Cursor and VS Code
- Active releases and a published security model with fast fixes
What’s not
- 10 advisories so far, two critical in July 2026
- Docker Engine use needs manual install and workarounds
- Network egress open by default
- Every server must be a container image; no plain npx or uvx
Best for
Developers and small teams who already run Docker and want many MCP servers behind one isolated, logged endpoint on their own machines.
Docker MCP Gateway alternatives
Docker MCP Gateway: common questions
- Is Docker MCP Gateway worth it?
- A sound default for running a dozen local MCP servers without trusting each one with your laptop, as long as you stay on a current release and accept that it is built around Docker Desktop. We rate it 4.0 out of 5.
- How much does Docker MCP Gateway cost?
- The gateway is free and open source (MIT). Docker Desktop, which bundles it as the MCP Toolkit, is free for personal use, education, non-commercial open source and businesses under 250 employees and $10 million revenue; otherwise Pro $9, Team $15 or Business $24 per user/month billed annually. Running it on Docker Engine alone avoids the Desktop terms.
- What are the downsides of Docker MCP Gateway?
- 10 advisories so far, two critical in July 2026; docker Engine use needs manual install and workarounds; network egress open by default; every server must be a container image; no plain npx or uvx.
- Who is Docker MCP Gateway best for?
- Developers and small teams who already run Docker and want many MCP servers behind one isolated, logged endpoint on their own machines.
- How much does Docker MCP Gateway cost for a team or in production?
- Free software. Desktop licences apply at 250 staff or $10 million revenue: Pro $9, Team $15, Business $24 per user/month billed annually. Each running server reserves up to 1 CPU and 2 GB by default, so ten servers kept alive with --long-lived can claim a large share of a laptop.
- Is Docker MCP Gateway safe for company data?
- Runs locally. The gateway reaches whatever the enabled servers and their secrets reach, and the gateway itself needs the Docker socket, which is root-equivalent on a standard Linux install. Under Desktop, gateway metrics go to Docker's usage analytics and can be switched off in Desktop settings; without Desktop, the telemetry docs say nothing is exported. Tool output from remote services reaches the model unfiltered apart from secret scanning.
- What are the best Docker MCP Gateway alternatives?
- The closest alternatives we have reviewed are Composio, Pipedream MCP and Connect and mcp-server-docker.
Answers checked Nov 11, 2026.
Make Docker MCP Gateway? Show this rating on your site
