MCP Index
DevOpsFreeactiveReviewed by MCPIndex

Docker MCP Gateway

Official Docker MCP Catalog and Toolkit — a security gateway that runs MCP servers as isolated, signed containers with scoped secrets.

View on GitHubView on NPMBrowse all tools

Looking for more MCP servers? Browse the full MCP tools directory or explore more tools in DevOps.

OverviewConfigSetupFAQRelated

Quick overview

The Docker MCP gateway is not a convenience wrapper — it is a privilege boundary. The dirty secret of the MCP gold rush is that every stdio server runs with the full ambient authority of your user account: your SSH keys, your cloud credentials, your Docker socket. Docker Catalog and Toolkit architecture fixes this at the runtime layer: the gateway brokers every tool call through an isolated, signed OCI container with per-server network and volume constraints, so a compromised or hallucinating server cannot read ~/.aws or bind-mount the host filesystem. The command surface is deceptively simple — docker mcp gateway run — but behind it sits a secrets store that injects credentials at call time without ever serializing them into the agent context window. That single property, secrets never entering the prompt, eliminates the entire prompt-injection-to-credential-exfiltration attack class that plagued early MCP deployments. The engineering verdict: if you run more than three MCP servers without routing them through a gateway, you are executing unvetted code with root-adjacent privileges and hoping the model behaves.

What this MCP server is best for

  • Docker MCP Gateway is useful when you want to extend an AI assistant with real tools and live system access.
  • It helps move from chat-only answers to real actions such as reading data, managing systems, or retrieving current information.
  • It is best for developer and technical workflows where AI needs controlled access to external tools or services.

When to choose it

Choose Docker MCP Gateway when you want an MCP server focused on DevOps and need tighter integration with your existing tools.

Good fit

dockercontainerssecuritygatewayisolationdevops

Docker MCP Gateway Configuration

Use the following configuration as a starting point for Claude Desktop or any compatible MCP client, then replace placeholder credentials with your own values.

claude_desktop_config.json
{
  "mcpServers": {
    "docker": {
      "command": "docker",
      "args": ["mcp", "gateway", "run"]
    }
  }
}

How to set up Docker MCP Gateway

These setup steps cover the typical installation flow for this MCP server.

  1. 1

    Upgrade to Docker Desktop 4.42+ (or install the MCP plugin on a Linux CLI) and enable the MCP Toolkit under Settings, Beta features.

  2. 2

    Open the MCP Catalog via docker mcp catalog show or the Desktop UI and enable only the servers you actually need — each one runs as a signed, OCI-distributed container with a declared permission set.

  3. 3

    Pro-Tip: Never, under any circumstances, expose /var/run/docker.sock to an agent-reachable container or server config — socket access IS root on the host, and one successful prompt injection turns your agent into a container escape kit. The gateway exists precisely to broker these calls with per-server volume and network constraints; if a community server demands the raw socket, fork it and scope the API calls instead.

  4. 4

    Store credentials in the gateway secrets store: docker mcp secret set GITHUB_TOKEN=... — secrets are injected at call time and never enter the model context window.

  5. 5

    Point your client at the gateway endpoint: it exposes a single stdio interface aggregating all enabled servers, so one config block replaces N separate entries and N separate attack surfaces.

  6. 6

    Audit before connecting an agent: docker mcp server list and docker mcp tools show the exact exposed tool surface — verify it matches your intent, because whatever you see there is what a prompt injection can reach.

Frequently asked questions

Common questions for Docker MCP Gateway.

The gateway starts and tools are listed, but every tool call hangs or returns empty — with no error anywhere. Why?

The signature silent failure of gateway architectures: the gateway process itself is healthy (exit code 0, tools enumerated), but the per-server containers behind it failed to pull their images — usually a corporate proxy, a stale catalog, or a registry auth gap. On Linux there is a second variant: DOCKER_HOST pointing at a rootless socket while the gateway runs in the root context, which makes servers silently vanish from the listing. The engineering fix: run docker mcp gateway run --verbose to surface pull errors, pre-pull the server images manually, and verify docker context ls matches between your shell and the gateway.

How much latency does the gateway add?

Roughly 10-30ms per tool call for the broker hop, with container startup amortized through pooling. Against multi-second model latency, it is noise — and it buys you isolation that no amount of prompt engineering can replicate.

Can I run my own custom servers through the gateway?

Yes — package the server as an OCI image, add it to a custom catalog, and you inherit signing, secrets injection, and network scoping for free. This is the correct way to run internal proprietary MCP servers.

How is this different from running servers directly with npx?

An npx server inherits your full user authority: every file you can read, it can read; every credential in your environment, it can leak. A gateway container receives only the volumes, networks, and secrets you explicitly declare. The difference is not convenience — it is the blast radius of a single hallucinated tool call.

Docker MCP Gateway vs Competitors

FeatureDocker MCP GatewayCompetitor
Secret handling✅ Injected at call time; never serialized into the context window❌ Env vars in config files, fully visible to the model
Isolation per server✅ Signed OCI container with scoped volumes and networks❌ Shared user account with ambient authority
Tool surface audit✅ docker mcp tools lists exact exposure on demand❌ Discover the surface by reading source code
Prompt-injection blast radius✅ Contained inside the container boundary❌ The entire workstation
Setup friction for a single server❌ Requires Docker Desktop plus catalog concepts✅ One npx line and you are running

Related Guides

How to Install MCP Servers

Cross-client installation guide for Claude Desktop, Cursor, and VS Code.

Claude Desktop MCP Setup

Beginner-friendly setup guide for Claude Desktop MCP.

Best Open Source MCP Tools on GitHub

Compare popular open source MCP tools by use case and setup difficulty.