container-mcp

Run AI agents in VM-isolated sandboxes on your Mac.

An MCP server for Apple containers — every container gets its own lightweight VM, which makes it the right isolation boundary for code an AI agent wrote five seconds ago.

Part of a larger toolkit: a native macOS "mission control" GUI for agent sandboxes is in development.

Why

• VM-per-container isolation — stronger than Docker's shared-kernel model

• Safe by default — agents can only mount the project directory and temp; everything else requires an explicit allowlist

• Self-healing errors — every failure tells the agent how to fix it

• Agent-labeled — every container is tagged with which agent created it

Related MCP server: CUA MCP Server

Install

Requires an Apple silicon Mac, macOS 26 or newer, and the container CLI.

claude mcp add container -- npx -y container-mcp

Or in any MCP client config:

{
  "mcpServers": {
    "container": { "command": "npx", "args": ["-y", "container-mcp"] }
  }
}

Tools

Safety model

Mount sources, build contexts, and dockerfiles must exist and are fully canonicalized (symlinks resolved) before allowlist checks — a path cannot be swapped for a symlink after validation. A launch directory of / or your home directory is never used as an implicit allowlist root. Lifecycle tools (stop, remove, exec, logs, copy) only operate on containers this server created (tagged dev.container-mcp.managed=true) unless CONTAINER_MCP_ALLOW_UNMANAGED is set. Every agent-supplied value that reaches the CLI is guarded against flag injection, and commands are executed with execFile (no shell), so there is no shell injection surface.

Known assumptions

Built against apple/container docs without a live CLI on the dev machine:

• container exec is invoked with a -- terminator before the agent's command (standard swift-argument-parser convention, not explicitly documented).

• container cp is used (documented alias of the canonical container copy).

• container inspect label layout is undocumented; managed-label checks parse it tolerantly and fail closed (override: CONTAINER_MCP_ALLOW_UNMANAGED).

License

MIT