container-manager-mcpBLOCK
Manage containers on docker, podman, compose, and docker swarm through an MCP Server for Agentic AI
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
CLI or API | MCP | Agent
Version: 3.1.0
Documentation — Installation, deployment, usage across the API, CLI, MCP, and A2A agent interfaces, and the multi-host control plane are maintained in the official documentation.
bfaa54059b52OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add container-manager-mcp --env LLM_API_KEY=${LLM_API_KEY} -- uvx container-manager-mcp{
"mcpServers": {
"container-manager-mcp": {
"command": "uvx",
"args": [
"container-manager-mcp"
],
"env": {
"LLM_API_KEY": "${LLM_API_KEY}"
}
}
}
}Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
cm_list_hosts | read | List the host aliases you can pass as ``host`` to any cm_* operation |
list_specialist_containers | read | Lists all containers managed by Agent OS (filtered by managed-by=agent-os label). |
Trust audit
BLOCKgrade D · trust 67/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (8 observation(s))
- Network
- declared (12 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
kubeconfig = os.environ.get("KUBECONFIG") or os.path.expanduser("~/.kube/config")"Place a kubeconfig at ~/.kube/config or set KUBECONFIG; for multiple clusters set "
return os.path.expanduser("~/.kube/config")"~/.kube/config), so it can be reused later. Supports importing an "
help="Target kubeconfig file to write (default: $KUBECONFIG first entry, else ~/.kube/config).",
"--insecure-skip-tls-verify",
| **Prompt Injection Defense** | ✅ Built-in | 25+ pattern scanner + jailbreak taxonomy (CONCEPT:AU-OS.config.secrets-authentication) |
module = importlib.import_module(module_name)
return importlib.import_module(module_name)
description="save_context (explicit): API server URL, e.g. https://10.0.0.10:6443",
`https://10.0.0.13:6443`).
.bumpversion.cfg
.codespellignore
.pre-commit-config.yaml
.vulture_ignore
mod = importlib.import_module(pkg_name)
mod = importlib.import_module(pkg_name)
mod = importlib.import_module(pkg_name)
container-manager-save-context --name prod --server https://10.0.0.10:6443 \
container-manager-save-context --name rke2 --server https://10.0.0.10:6443 \
container-manager-save-context --name oidc-dev --server https://10.0.0.10:6443 \
insecure_skip_tls_verify=False,
insecure_skip_tls_verify=False,
"--insecure-skip-tls-verify",
"--insecure-skip-tls-verify",
Gates applied: instruction_override, no_behavioural_pass.
bfaa54059b52full audit observations/trust-audit/mcp-server/knuckles-team__container-manager-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | bfaa54059b52 | BLOCK | D | 67 | first audit |
Questions
What is the container-manager-mcp MCP server?
Manage containers on docker, podman, compose, and docker swarm through an MCP Server for Agentic AI
What tools does container-manager-mcp expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is container-manager-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (67/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does container-manager-mcp need?
It reads LLM_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does container-manager-mcp run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as container-manager-mcp.
How current is this page?
The grade is for one exact copy of the source (bfaa54059b52), read on 2026-10-11. The repository is watched and re-audited when it changes.