portainer-agentBLOCK
Portainer - Manage your Portainer instance through the Portainer Agent/MCP!
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
CLI or API | MCP | Agent
Version: 2.1.0
Documentation — Installation, deployment, usage across the API, CLI, and MCP interfaces, and guidance for provisioning the Portainer platform are maintained in the official documentation.
Overview
Portainer Agent is a production-grade Agent and Model Context Protocol (MCP) server designe
5c20e8459674OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add portainer-agent --env GITLAB_TOKEN=${GITLAB_TOKEN} --env PORTAINER_GIT_TOKEN=${PORTAINER_GIT_TOKEN} --env PORTAINER_TOKEN=${PORTAINER_TOKEN} -- uvx portainer-agent{
"mcpServers": {
"portainer-agent": {
"command": "uvx",
"args": [
"portainer-agent"
],
"env": {
"GITLAB_TOKEN": "${GITLAB_TOKEN}",
"PORTAINER_GIT_TOKEN": "${PORTAINER_GIT_TOKEN}",
"PORTAINER_TOKEN": "${PORTAINER_TOKEN}"
}
}
}
}Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
portainer_ingest_containers | read | Natively ingest an environment |
portainer_ingest_environments | read | Natively ingest Portainer environments (+ stacks) into epistemic-graph. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (17)
| **Prompt Injection Defense** | ✅ Built-in | 25+ pattern scanner + jailbreak taxonomy (CONCEPT:AU-OS.config.secrets-authentication) |
module = importlib.import_module(module_name)
return importlib.import_module(module_name)
spec.md
tasks.md
.bumpversion.cfg
.codespellignore
.pre-commit-config.yaml
mod = importlib.import_module(pkg_name)
mod = importlib.import_module(pkg_name)
mod = importlib.import_module(pkg_name)
"PORTAINER_URL": "http://127.0.0.1:9000",
assert client.base_url == "http://127.0.0.1:9000"
"PORTAINER_URL": "http://127.0.0.1:9000",
base_url="http://127.0.0.1:9000",
agent-utilities
* **Environment administrator** has full access within a given environment, but cannot make any changes to the infrastructure that underpins an environment (i.e. no host management), nor are they able
Gates applied: instruction_override, no_behavioural_pass.
5c20e8459674full audit observations/trust-audit/mcp-server/knuckles-team__portainer-agent.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 5c20e8459674 | BLOCK | D | 69 | first audit |
Questions
What is the portainer-agent MCP server?
Portainer - Manage your Portainer instance through the Portainer Agent/MCP!
What tools does portainer-agent expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is portainer-agent safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does portainer-agent need?
It reads GITLAB_TOKEN, PORTAINER_GIT_TOKEN and PORTAINER_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does portainer-agent run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as portainer-agent.
How current is this page?
The grade is for one exact copy of the source (5c20e8459674), read on 2026-10-11. The repository is watched and re-audited when it changes.