Docker MCP Guardian
A Docker MCP server: agents inspect containers and logs, restarts need a flag and a deny list, variable values stay hidden.
- 108 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Access to the system Docker socket equals host administrator rights, so a rootless daemon is used by default.
- With `GUARDIAN_ALLOW_WRITE=true` the agent restarts containers not on the deny list.
- Container logs reach the model context together with any secrets they contain.
Install
- Works in
Manual install
git clone https://github.com/SivaSaiKrishnaSuryadevara/docker-mcp-guardian.gitThe first README command. Then a virtual environment, `pip install -r requirements.txt` and `claude mcp add docker-guardian -- "$PWD/.venv/bin/python" "$PWD/server.py"`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Access to the system Docker socket equals host administrator rights, so a rootless daemon is used by default.
- With `GUARDIAN_ALLOW_WRITE=true` the agent restarts containers not on the deny list.
- Container logs reach the model context together with any secrets they contain.
This is third-party code. Review the repository files before installing.
What it does
Docker MCP Guardian is a Python and FastMCP server that connects Claude Desktop, Claude Code and other MCP clients to the Docker daemon. Tools: `list_containers`, `inspect_container`, `get_container_logs` and `safe_restart_container`. Logs are scanned with a regular expression for errors and exceptions (`GUARDIAN_ANOMALY_REGEX`). Protection is on by default: restarts do nothing until `GUARDIAN_ALLOW_WRITE=true` is set; names are checked against the `GUARDIAN_RESTART_DENY_REGEX` deny list (by default `prod`, `db`, `kube`, `vault`) after the ID is resolved to its canonical name; `inspect_container` returns environment variable names without values.
Who it is for. Developers and administrators who want to give an agent local container diagnostics without the power to break anything.
Good fit when
- A container keeps crashing and the agent reads the log tail and highlights errors.
- A container configuration must be shown to a model with environment values hidden.
- Restarts are allowed only for containers whose names match `dev-.*`.
- Docker runs rootless and the client starts without `XDG_RUNTIME_DIR`.
Not a fit when
- The agent needs to create and delete containers, images and networks; such tools do not exist.
- You need full Docker API access, while this server narrows it on purpose.
- Containers run on a remote Kubernetes cluster.
Example request
List containers, find the one that keeps restarting, read the last 200 log lines and highlight the errors.MCP
- Transport
- stdio
- Authentication
- not required
Environment variables
GUARDIAN_ALLOW_WRITE- Enables container restarts, `false` by default
DOCKER_HOST- Docker daemon endpoint when a non-default one is needed
Limitations
Needs Python 3.10+, Docker Engine or Docker Desktop, and `mcp>=1.0.0,<2`. Installation clones the repository and creates a virtual environment; the README has no ready package. The socket is chosen in order: `DOCKER_HOST`, then a rootless socket, and the system `/var/run/docker.sock` only with `GUARDIAN_ALLOW_ROOTFUL=true`; earlier versions connected to it silently. A Docker call is capped by `GUARDIAN_DOCKER_TIMEOUT` (5 seconds by default) and a log scan by `GUARDIAN_REGEX_TIMEOUT` (1 second).
How to disable. Remove the server from the client configuration with `claude mcp remove docker-guardian` or by editing `mcpServers`. Delete the virtual environment and the cloned directory separately.
FAQ
How do I allow restarts?
Set `GUARDIAN_ALLOW_WRITE=true` in the server environment. Containers matching `GUARDIAN_RESTART_DENY_REGEX` still cannot be restarted.
How do I limit restarts to an allow list?
Set `GUARDIAN_RESTART_ALLOW_REGEX`: then only matching containers restart, and the deny list still wins.
What about rootless Docker?
The server looks for the socket at `$XDG_RUNTIME_DIR/docker.sock` and `/run/user/<uid>/docker.sock`. If the client passes no environment, set `DOCKER_HOST` with a full path.
Will the model see passwords from the container environment?
No, `inspect_container` returns variable names only. The filter does not remove secrets printed in the container logs.
Which tools does the server have?
Four: `list_containers`, `inspect_container`, `get_container_logs` and `safe_restart_container`.
Discussion
No questions or reviews yet.
Related
MCP serversmaintenant monitoring MCP server: an agent reads container logs, check history and alerts but never touches the containers
Official Docker MCP server: image search, tags, repositories and Docker Hardened Images on Docker Hub
Docker MCP by QuantGeekDev
docker-mcp
Docker MCP: an agent creates containers, deploys Docker Compose stacks from YAML, reads logs and lists containers. Runs through uvx for Claude Desktop
The docker mcp CLI plugin and gateway: MCP servers from Docker's catalog in isolated containers behind one connection point
MCP server for managing Docker in natural language: containers, images, networks and volumes, including remote hosts over SSH
Podman MCP Server: Podman and Docker containers
Podman MCP Server
An MCP server for Podman and Docker containers: list, run, stop and read logs of containers, build and pull images
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Docker MCP Guardian (this card) | no | not required | 108 | |
| Docker MCP server | no | not required | 756 | a general set of Docker operations; Guardian keeps reads and one restricted restart |
| Docker MCP by QuantGeekDev | no | not required | 504 | container and image management; here writes are off by default and variable values are hidden |
README in short
All logging goes to stderr to keep the JSON-RPC stream intact. The protection design is documented in `docs/SECURITY_ARCHITECTURE.md`, and the repository has tests and a GHCR image build.