Geekflare
Open coreMITTested by Geekflare

Docker MCP Gateway review

Docker CLI plugin that runs MCP servers from a catalog in isolated containers and serves their tools to clients through one gateway

Website GitHub Docs
Data refreshedMethodologyHow we tested
Founder of Geekflare

Chandan Kumar is a founder of Geekflare. He is a technology enthusiast and entrepreneur who loves to help businesses and people around the world. Chandan has worked at BNP Paribas, Citibank, Deutsche Bank, Motorola, and HP. He’s got an in-depth understanding of business software and IT infrastructure.

Verdict

Docker MCP Gateway is a simple way to run local MCP servers with less risk, since each one starts in its own container with CPU and memory limits, no host environment and secrets scanned in tool calls. The catch is that the free version has one shared token and no users, so per-user access, policy and audit trails mean buying Docker's Enterprise Gateway.

Best for

Developers and small teams running catalog MCP servers in containers

Not for

Companies that need per-user access control without a Docker contract

Pros

  • Each server runs in its own container with limits and no host environment
  • Secret blocking and image signature checks are on by default
  • Docker MCP Catalog with signed images, plus private catalogs as OCI artifacts
  • One command connects Claude, Cursor, VS Code and other clients to a profile

Cons

  • No users or roles in the free version, only one shared bearer token
  • Outside Docker Desktop you need feature flags, a .env or credential helper for secrets
  • Two critical advisories in July 2026, and every release is still marked pre-release
Ask Sparkian

Is Docker MCP Gateway right for your project?

Describe what you need and AI will check the fit against this review.

Or try:

Docker MCP Gateway features and capabilities

Servers in locked-down containers

Each MCP server starts in its own container without the host environment, with CPU and memory limits and optional network blocking, so a bad server can reach less.

Profiles shared through registries

A team can group the servers it uses into a profile, push it to a container registry and have everyone connect their clients to the same set.

Secret blocking and interceptors

Tool arguments and results are scanned for secret-like values by default, and your own scripts or HTTP services can check or block calls before and after they run.

Tool allowlists

Only the tools you enable from each server are exposed, which keeps the tool list short and leaves out risky actions.

Catalogs of approved servers

Teams can start from Docker's catalog of signed server images or publish their own catalog of approved servers as an OCI artifact.

One endpointCombines tools from several MCP servers behind one URL
Yes
Client authOAuth, OIDC or keys for the agents and users calling the gateway
PartlyOne shared bearer token; user SSO is in the Enterprise Gateway
Per-tool accessAllows or denies individual tools per user, team or key
PartlyAllowlist per profile, not per user; group policy is paid
Server catalogA registry of approved MCP servers that teams can pick from
YesDocker MCP Catalog and custom OCI catalogs
API to MCPTurns existing REST or OpenAPI APIs into MCP tools
No
Sandboxed serversRuns local MCP servers in containers or another sandbox
YesContainers with CPU and memory limits; network blocking optional
GuardrailsChecks tool calls for prompt injection, secrets or PII
YesSecret scanning by default; custom checks via interceptors

At a glance

Type
MCP gateway and server runner
Stack
Go
Databases
SQLite
Licence terms
The gateway and CLI plugin are MIT. Per-user sign-in, per-call policy and audit events sent to a SIEM are in Docker MCP Enterprise Gateway and Docker AI Governance, which are sold separately.
SSO
Paid only
Roles and permissions
Paid only
Audit logs
Paid only

Free vs paid editions

What you get when you self-host, and what needs a paid plan.

The MIT gateway runs catalog servers in containers with secret blocking, signature checks and tool allowlists, and works with Docker Desktop or a plain Docker Engine. The MCP Toolkit interface comes with Docker Desktop, which needs a paid subscription in companies with 250 or more staff or $10 million or more in revenue. Docker MCP Enterprise Gateway adds SSO, group policy per tool and SIEM audit events, runs in your cloud or air-gapped, and is priced on request.

Self-hosting Docker MCP Gateway

Docker gives no minimum requirements for the gateway; the Toolkit needs Docker Desktop 4.59 or later, and each MCP server container gets 1 CPU and 2 GB of memory by default.

New cloud server to ready

5 s

Memory in use at idle

11 MB of 4 GB

Median tool call

4.6 ms

Calls/s, 8 sessions

276

Peak memory

245 MB

Version tested

0.44.3 · Oct 30, 2026

  • Docker's remote-server Compose example ran on a plain Linux server without Docker Desktop. It was ready in 5 seconds and used 11 MB at idle, but it would not start until I mounted the Docker socket, even with only remote servers, which gives the container full control of Docker on the host.
  • It rejected my reference server over plain HTTP, since remote servers must use HTTPS, and it refused to run the mcp/everything image until I pinned it by digest, after which it checked the image's signature.
  • With the reference server running in a container it started, tool calls took a median of 4.6 ms and 8 sessions made 276 calls a second. It started one server container per session, so memory reached about 245 MB across 9 containers, and with --long-lived those containers stayed up after the sessions ended.
  • Requests without the bearer token got 401, and --tools limited the list to the two tools I named.
Compose file and catalog we ran
# catalog.yaml (in ~/.docker/mcp/catalogs/)
registry:
  everything:
    name: everything
    type: server
    image: mcp/everything@sha256:330885a0…   # images must be pinned by digest
  geekflare:
    remote:
      url: "https://mcp.geekflare.com/<API_KEY>/mcp"   # remote servers must use HTTPS
      transport_type: http

# compose.yaml
services:
  gateway:
    image: docker/mcp-gateway:v0.44.3
    ports: ["127.0.0.1:8811:8811"]
    env_file: gw.env                                   # MCP_GATEWAY_AUTH_TOKEN
    volumes:
      - ./catalog.yaml:/root/.docker/mcp/catalogs/test.yaml:ro
      - /var/run/docker.sock:/var/run/docker.sock     # needed even for remote servers
    command: ["--catalog=/root/.docker/mcp/catalogs/test.yaml", "--servers=everything,geekflare",
              "--transport=streaming", "--port=8811", "--long-lived", "--tools=echo,dnsRecord"]
OutputPassed0.44.3 · 26 tools · 1.1 s
Request: tools/call dnsRecord with {"url": "geekflare.com"}, through the gateway to Geekflare's hosted MCP server
{
  "timestamp": 1793384963300,
  "apiStatus": "success",
  "apiCode": 200,
  "meta": {
    "url": "geekflare.com",
    "test": {
      "id": "4c10c9b3-2d43-4085-a6c3-a988aaf6214b"
    }
  },
  "data": {
    "A": [
      "104.26.1.30",
      "172.67.72.144",
      "104.26.0.30"
    ],
    "AAAA": [
      "2606:4700:20::681a:1e",
      "2606:4700:20::ac43:4890",
      "2606:4700:20::681a:11e"
    ],
    "MX": [ … ],
    …

What you can do with Docker MCP Gateway

Safe local MCP servers for developers

Give developers catalog MCP servers that run in containers with limits instead of npx or uvx processes on their laptops.

Shared server profiles for a team

Publish a profile of approved servers to the company registry so every developer's Claude, Cursor or VS Code uses the same tools.

MCP tools for agents in Compose

Run the gateway as a Compose service next to an agent so it can call containerised MCP servers over streaming HTTP.

Docker MCP Gateway alternatives

agentgatewayRust proxy for LLM, MCP and agent-to-agent traffic, with per-key budgets, guardrails and a built-in UIContextForgePython gateway and registry that puts MCP servers, A2A agents and REST or gRPC APIs behind one endpoint, with teams, SSO and pluginsToolHiveRuns each MCP server in its own container, locally or on Kubernetes, with a virtual MCP gateway, a registry server and Cedar policies per toolObotSelf-hosted control plane with an MCP gateway, a Git-backed server catalog, hosted MCP servers, an LLM gateway and audit logsMCPHubSelf-hosted MCP gateway that puts many MCP servers behind one endpoint, with groups, scoped keys, per-user credentials and a web dashboardUnlaGo gateway that turns REST APIs into MCP servers through YAML config and proxies existing MCP servers, with a web UI for managing them