← MCP servers · dagger
Container Use
CAUTIONgrade B · trust 89/100Development environments for coding agents. Enable multiple agents to work safely and independently with your preferred stack.
Overview
From the repository's own README, as read at the audited commit.
<div align="center"> <img src="./docs/images/container-use.png" align="center" alt="Container use: Development environments for coding agents." /> <h1 align="center">container-use</h2> <p align="center">Containerized environments for coding agents. (📦🤖) (📦🤖) (📦🤖)</p> <p align="center"> <img src="https://img.shields.io/badge/stability-experimental-orange.svg" alt="Experimental" /> <a href="https://opensource.org/licenses/Apache-2.0"> <img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg"> </a> <a href="https://container-use.com/discord"> <img src="https://img.shields.io/discord/707636530424053791?logo=discord&logoColor=white&label=Discord&color=7289DA" alt="Discord"> </a> <a href="https://github.com/clinebot/awesome-claude-code"> <img src="https://awesome.re/mentioned-badge.svg" alt="Mentioned in Awesome Claude Code"> </a> </p></div>**Container Use** lets coding agents do their work in parallel environments without getting in your way. Go from babysitting one agent at a time to enabling multiple agents to work safely and independently with your preferred stack. See the [full documentation](https://container-use.com).<p align='center'> <img src='./docs/images/demo.gif' width='700' alt='container-use demo'></p>It's an open-source MCP server that works as a CLI tool with Claude Code, Cursor, and other MCP-compatible agents. Powered by [Dagger](https://dagger.io).* 📦 **Isolated Environments**: Each agent gets a fresh container in its own git branch - run multiple agents without conflicts, experiment safely, discard failures instantly.* 👀 **Real-time Visibility**: See complete command history and logs of what agents actually did, not just what they claim.* 🚁 **Direct Intervention**: Drop into any agent's terminal to see their state and take control when they get stuck.* 🎮 **Environment Control**: Standard git workflow - just `git checkout <branch_name>` to review any agent's work.* 🌎 **Universal Compatibility**: Wor
Exposed tools (15) 9 read · 5 write · 1 destructive
Blast radius: 1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
env_single | read | desc |
env_test | read | desc |
environment_add_service | write | Add a service to the environment (e.g. database, cache, etc.) |
environment_checkpoint | read | Checkpoints an environment in its current state as a container. |
environment_config | read | Make environment config changes such as base image and setup commands. |
environment_diff | read | View the cumulative changes made in an environment from its creation point, showing all code modifications as a unified diff. |
environment_file_delete | destructive | Deletes a file at the specified path. |
environment_file_edit | write | Find and replace text in a file. |
environment_file_list | read | List the contents of a directory |
environment_file_read | read | Read the contents of a file, specifying a line range or the entire file. |
environment_file_write | write | Write the contents of a file. |
environment_log | read | View the development history of an environment, showing all commits made by the agent plus command execution notes. |
environment_open | read | Opens an existing environment. Return format is same as environment_create. |
environment_run_cmd | write | Run a terminal command inside a NEW container within the environment. |
environment_update_metadata | write | Update environment metadata such as title. This updates the descriptive information about what work is being done in the environment. |
Details
- Source
- dagger/container-use
- License
- Apache-2.0
- Stars
- 4,042 · pushed 6d ago
Trust audit
Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (14)
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.goosehints
.goosehints
Why it matters. link not followed
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
environment_file_delete
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.golangci.yml
.golangci.yml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.goreleaser.yaml
.goreleaser.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.symlink · CWE-1104
CLAUDE.md
CLAUDE.md
Why it matters. link not followed
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
environment/environment_test.go:25
"../../bin/sh",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
repository/git_test.go:244
"../../../etc/cron.d/evil",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
repository/git_test.go:245
"foo/../../etc/passwd",
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/quickstart.mdx:96
✅ App running at http://127.0.0.1:58455
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
docs/environment-configuration.mdx:139
Configure secure access to API keys and credentials. See the [complete secrets guide](/secrets) for all secret types and examples.
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
docs/secrets.mdx:33
Access secrets stored in 1Password vaults using the `op://` schema:
Why it matters. asks the agent to read credentials
LOWSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
README.md:48
curl -fsSL https://raw.githubusercontent.com/dagger/container-use/main/install.sh | bash
LOWSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
docs/quickstart.mdx:26
curl -fsSL https://raw.githubusercontent.com/dagger/container-use/main/install.sh | bash
INFOInventory / provenance · inv.oversize · CWE-1104
docs/images/demo.gif
docs/images/demo.gif
Why it matters. 1701320 bytes not read
Gates applied: no_behavioural_pass.
Audited 2026-09-14 · audit v0.4.0 · source sha 36f49f980073 · full audit: observations/trust-audit/mcp-server/dagger__container-use.json · Report an issue or request a re-scan
Audit history
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-14 | 36f49f980073 | CAUTION | B | 89 | first audit |
Also audited
Servers with a similar trust profile.
Questions
What is the Container Use MCP server?
Development environments for coding agents. Enable multiple agents to work safely and independently with your preferred stack.
What tools does Container Use expose?
15 in total: 9 read-only, 5 that write, and 1 that can delete or overwrite (environment_file_delete). Every one is listed on this page with its risk.
Is Container Use safe to connect to an agent?
With care. The audit graded it B (89/100) and found 14 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Container Use need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (36f49f980073), read on 2026-09-14. The repository is watched and re-audited when it changes.
Provenance: OBSERVED · read 2026-09-14 · job trust-audit-2026-09-14