MCP server · Org-owned · Audited from source

Container Use MCP server

by dagger/container-useApache-2.0 licenceAudited 21 Sep 2026 · source 36f49f980073

★ 4,046

!CAUTIONGrade B · 89/100 · 21 Sep 2026 · 36f49f9

4,046GitHub stars

Is it safe? With care — CAUTION, grade B (89/100). It exposes 15 tools: 9 read, 5 write and 1 destructive. The audit recorded 14 findings (0 critical, 0 high, 2 medium, 11 low). Maintainer's description: Development environments for coding agents. Enable multiple agents to work safely and independently with your preferred stack.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Container Use MCP server (dagger/container-use)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/dagger/container-use

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score89/100!CAUTION B

0 critical0 high2 medium11 low1 info

14 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared3 observations
NetworkDeclared5 observations
ShellNone observedNothing seen in the source
DependenciesPinnedNothing floats
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	WARN 5 findings
`L1` Static source	Secrets, path traversal, supply chain	PASS 4 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS 4 findings
`L3` Inventory	Declared tools match the source	WARN 1 finding
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner daggerOrganizationAccount type recorded when we read the repository.
PackageNo packageRuns from a repository checkout or a hosted URL.
LicenceApache-2.0From the repository, as read at the audited commit.
Last push6 days agoActivity of the repository when we read it.
Source commit read36f49f980073The audit covers exactly this commit, read on 21 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory15 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (14)

Sorted by severity

MEDIUMInventory / provenanceinv.symlink · .goosehints

F-13 Inventory / provenanceCWE-1104Layer L0

.goosehints

Why: link not followed
Fix: —

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

environment_file_delete

Why: 1 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenanceinv.hidden_file · .golangci.yml

F-13 Inventory / provenanceCWE-1104Layer L0

.golangci.yml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .goreleaser.yaml

F-13 Inventory / provenanceCWE-1104Layer L0

.goreleaser.yaml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.symlink · CLAUDE.md

F-13 Inventory / provenanceCWE-1104Layer L0

CLAUDE.md

Why: link not followed
Fix: —

LOWFilesystem / pathfs.traversal · environment/environment_test.go:25

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"../../bin/sh",

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · repository/git_test.go:244

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"../../../etc/cron.d/evil",

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · repository/git_test.go:245

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"foo/../../etc/passwd",

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/quickstart.mdx:96

F-04 Network egressCWE-200 · CWE-319Layer L1

✅ App running at http://127.0.0.1:58455

Why: No further detail recorded for this rule.
Fix: —

LOWPrompt injectionprompt.credential_read · docs/environment-configuration.mdx:139

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

Configure secure access to API keys and credentials. See the [complete secrets guide](/secrets) for all secret types and examples.

Why: asks the agent to read credentials
Fix: —

LOWPrompt injectionprompt.credential_read · docs/secrets.mdx:33

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

Access secrets stored in 1Password vaults using the `op://` schema:

Why: asks the agent to read credentials
Fix: —

LOWSupply chainprompt.pipe_to_shell · README.md:48

F-08 Supply chainCWE-829 · CWE-1357Layer L2

curl -fsSL https://raw.githubusercontent.com/dagger/container-use/main/install.sh | bash

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainprompt.pipe_to_shell · docs/quickstart.mdx:26

F-08 Supply chainCWE-829 · CWE-1357Layer L2

curl -fsSL https://raw.githubusercontent.com/dagger/container-use/main/install.sh | bash

Why: No further detail recorded for this rule.
Fix: —

INFOInventory / provenanceinv.oversize · docs/images/demo.gif

F-13 Inventory / provenanceCWE-1104Layer L0

docs/images/demo.gif

Why: 1701320 bytes not read
Fix: —

Tools it exposes

15 declared in source · 1 destructive

9 read5 write1 destructive

1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	Risk	What it does
`environment_file_delete`	destructive	Deletes a file at the specified path.
`environment_add_service`	write	Add a service to the environment (e.g. database, cache, etc.)
`environment_file_edit`	write	Find and replace text in a file.
`environment_file_write`	write	Write the contents of a file.
`environment_run_cmd`	write	Run a terminal command inside a NEW container within the environment.
`environment_update_metadata`	write	Update environment metadata such as title. This updates the descriptive information about what work is being done in the environment.
`env_single`	read	desc
`env_test`	read	desc
`environment_checkpoint`	read	Checkpoints an environment in its current state as a container.
`environment_config`	read	Make environment config changes such as base image and setup commands.
`environment_diff`	read	View the cumulative changes made in an environment from its creation point, showing all code modifications as a unified diff.
`environment_file_list`	read	List the contents of a directory
`environment_file_read`	read	Read the contents of a file, specifying a line range or the entire file.
`environment_log`	read	View the development history of an environment, showing all commits made by the agent plus command execution notes.
`environment_open`	read	Opens an existing environment. Return format is same as environment_create.

Install

audited commit 36f49f9

Read the findings first. The most severe is Inventory / provenance (medium) at .goosehints.

No connect command is recorded for this server yet. Follow the repository's own instructions, and read the findings above first.

Audit history

2026-09-21
!CAUTION B 89 / 100
Source changed, verdict held · 36f49f980073

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/mcp/dagger/container-use/badge.svg)](https://modelsatlas.com/mcp/dagger/container-use/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Container Use MCP server

What is the Container Use MCP server?

Development environments for coding agents. Enable multiple agents to work safely and independently with your preferred stack.

What tools does Container Use expose?

15 in total: 9 read-only, 5 that write, and 1 that can delete or overwrite (environment_file_delete). Every one is listed on this page with its risk.

Is Container Use safe to connect to an agent?

With care. The audit graded it B (89/100) and found 14 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Container Use need?

No credential environment variables were found in its source, so it appears to need none.

How current is this page?

The grade is for one exact copy of the source (36f49f980073), read on 2026-09-21. The repository is watched and re-audited when it changes.

Sources

dagger/container-use on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit 36f49f980073Observed · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Container Use MCP server?
GChatGPT CClaude PPerplexity
What tools does Container Use expose?
GChatGPT CClaude PPerplexity
Is Container Use safe to connect to an agent?
GChatGPT CClaude PPerplexity