Docker MCP Gateway: open-source container gateway for MCP servers
Docker MCP Gateway is an open-source container gateway for MCP servers from Docker. It is released under the MIT license and is offered as: CLI, Self-hosted.
Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection
Teams that want to share an approved set of MCP servers and tools as a profile or catalog pushed to an OCI registry
Consider instead if
You want a gateway with a registry, role-based access control and plugin hooks that also covers A2A agents and REST APIs.
See ContextForge.
You need checks on tool descriptions or prompt injection in server responses, which Docker's security doc places out of scope.
See Lasso MCP Gateway or mcp-context-protector.
What Docker MCP Gateway does
Docker MCP Gateway is the MIT-licensed engine behind the docker mcp CLI plugin, and its security model is isolation first. Each MCP server runs as its own container with no-new-privileges, CPU and memory limits and read-only host mounts, and Docker's own mcp/ images are signature-checked by default. That sets it apart from agentgateway and ContextForge, which concentrate on routing and policy across several protocols. On top of isolation it filters which servers and tools a client sees, scopes secrets per server, blocks secret-like values in tool traffic and logs calls without argument values. Its own security doc puts prompt injection and tool-description poisoning out of scope, so pair it with a content scanner. Every GitHub release so far is a 0.x pre-release, and network egress stays open unless you restrict it.
This summary is our own wording of the sourced facts on this page.
Key facts
Each value links to the page that states it, with the date we checked it.
Where Docker MCP Gateway fits in our AI security layers
Our analysis
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document.
How the model works.
AI security layers that Docker MCP Gateway covers, with the role, how each applies and what it rests on
Servers and tools can be limited per gateway run or profile, so a client reaches only the tools you enable.
Lets you choose which servers and tools a client can use, with the --servers and --tools options and per-profile tool lists; Profiles of selected servers and tools can be exported or pushed and pulled as OCI artifacts, and catalogs can import from the MCP community registry
Not mapped in our analysis: LLM01, LLM05, LLM07.
These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.
Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.
Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked
Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.
Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails
Routes agent traffic through a gateway with per-agent tool access, prompt inspection and audit trails.
Best for: Teams that want a gateway in front of agents, models and MCP tools with per-tool access and audit, and that can start on a free plan or self-host the gateway
68Coverage Score 68 out of 100
LLM01 Prompt Injection
LLM06 Excessive Agency
Reviewed
Docker MCP Gateway FAQ
Is Docker MCP Gateway open source?
Yes. The README names the MIT License, and the code is on GitHub at docker/mcp-gateway.
Does it need Docker Desktop?
Not always. The README says the CLI can work in Docker Desktop or independently, and the Docker docs say Docker Engine users download the binary from GitHub and place it in the CLI plugins directory.
How are MCP servers isolated?
Docker's docs say the gateway runs MCP servers in isolated Docker containers with restricted privileges, network access and resource usage. The security doc lists CPU and memory limits and read-only bind mounts by default.
Does it detect prompt injection or poisoned tool descriptions?
No. The project's security doc lists prompt injection, tool-description poisoning and malicious tool content as out of scope unless they bypass a gateway boundary. Its content check is limited to blocking secret-like values in tool arguments and responses, so a separate scanner or guardrail is needed for injection.
Key facts you can cite
Docker MCP Gateway is released under the MIT license.
Last reviewed . We compile from the vendors' own public
pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.
We may use analytics and, later, show ads. They stay off until you choose, wherever you are. Declining
never limits what you can read. See our privacy policy and
cookie policy.
Privacy settings
Choose what you allow. Your choice is stored on this device for 13 months. You can change it later from the
"Privacy choices" link in the footer.