Docker MCP Server
Docker MCP Server is a natural-language DevOps copilot that lets any MCP-capable AI assistant (Claude, Cursor, Continue, Zed) manage your Docker host and Compose stacks through conversation.
Insight & Monitoring
List containers (running or all) with status, image, ports, and uptime
Inspect full container configs: environment, mounts, network settings, restart policy, health checks
Live CPU/memory/network stats, disk usage breakdown, system info
Tail container logs with optional line count, time window, and timestamps
List images, networks, and volumes
Container Lifecycle Management
Start, stop, restart, and remove containers (with graceful timeouts and force options)
Docker Compose Orchestration
Validate and render fully-resolved Compose configs
List services and their health (
compose_ps)Deploy/update stacks (
up -d), tear down (down), restart services, pull latest images
Security & Safety Controls
Read-only mode — hides all state-changing tools for safe demos or production insight
Container allowlist — restrict operations to specific container names/prefixes
Opt-in exec —
exec_in_containerdisabled by default; no shell injection risk in Compose commands
Interactive Web Panel
Live monitoring with historical charts, AI-powered terminal with smart suggestions
File explorer/editor for container files, snapshot and scheduled backup (with webhook delivery)
Auto-restart watchdog with alerts and log watch
Terminal UI (TUI)
Keyboard-driven, lazydocker-style dashboard with live stats and one-key actions
Monitoring Integration
Exposes a Prometheus
/metricsendpoint for integration with Prometheus, Grafana, Zabbix, VictoriaMetrics
Other
Modular, toggleable plugin architecture
Supports local sockets, Windows named pipes, and remote TCP/TLS connections to Docker Engine
abouttool andlist_pluginsfor identity and capability discovery
Provides tools for managing Docker containers, images, networks, volumes, and Docker Compose stacks through natural language commands.
The /metrics endpoint can be used by Grafana to visualize the server's operational data.
Exposes a /metrics endpoint that can be scraped by Prometheus for monitoring server metrics.
The /metrics endpoint can be scraped by VictoriaMetrics for monitoring purposes.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Docker MCP ServerWhat containers are running?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
🐳 Docker MCP Server
Chat with your Docker host. A Model Context Protocol server that turns any MCP‑capable AI — Claude Desktop, Cursor, Continue, Zed — into a natural‑language DevOps copilot for Docker & Docker Compose.
“Restart the api container.” · “Why did web crash — show me the last 100 log lines.” · “Deploy the stack in ./prod and confirm it’s healthy.”
Designed, built & maintained by SoyRage Agency · https://soyrage.es/
⚡ New here? Install in one command → Quick install.
✨ New in this release
🌐 | Run it beside the daemon, not on your laptop | MCP normally means one server process per client, on the client's machine — backwards when the daemon you are managing lives on a server. Set |
🩺 | "Is anything wrong?" in one call |
|
💬 | Workflows your client offers you | MCP prompts — debug this container, audit my host, review my Compose file, free up disk. You no longer have to know which tool to ask for. → Guided workflows |
See the roadmap for what comes next.
Related MCP server: Docker MCP Server
📑 Table of contents
⚡ Quick install (one command)
Already use an MCP client? Point it at the published package — nothing to clone or build:
"docker": { "command": "npx", "args": ["-y", "@soyrageagency/docker-mcp"], "env": { "DOCKER_MCP_READONLY": "false" } }Or open the live web panel straight away:
npx -y -p @soyrageagency/docker-mcp docker-mcp-panel
Option A — standalone binary (no Node, no npm) · recommended for the CLI/TUI/panel
Since v1.1 you can install a single self-contained ragedocker executable — a Node runtime and the whole app fused into one file. Nothing else to install.
Windows (PowerShell):
irm https://raw.githubusercontent.com/soyrageagency/docker-mcp-server/main/scripts/install.ps1 | iexmacOS / Linux:
curl -fsSL https://raw.githubusercontent.com/soyrageagency/docker-mcp-server/main/scripts/install.sh | shThen just run ragedocker for an interactive menu, or ragedocker tui / ragedocker panel / ragedocker ia login. Re-run the installer any time to update. (How it's built and how to reuse this across repos: docs/DISTRIBUTION.md.)
Option B — via Node · configures Claude Desktop for you
Prefer the MCP-server-for-Claude-Desktop path? The installer clones the project, builds it, and configures Claude Desktop for you — no manual JSON editing. You need Git and Node.js ≥ 18.
Windows (PowerShell):
irm https://raw.githubusercontent.com/soyrageagency/docker-mcp-server/main/install.ps1 | iexmacOS / Linux:
curl -fsSL https://raw.githubusercontent.com/soyrageagency/docker-mcp-server/main/install.sh | bashAlready cloned the repo? Just run:
npm run setup # builds + configures Claude DesktopThen restart Claude Desktop and ask: “What Docker containers are running?” 🎉
The installer backs up your existing config and merges the entry, so any other MCP servers you have are preserved. Prefer to see the snippet without writing anything? node scripts/install.mjs --print.
🧭 What is this?
The Model Context Protocol (MCP) is an open standard that lets AI assistants talk to external tools through a well‑defined JSON‑RPC interface. Docker MCP Server is an MCP server that speaks that protocol over stdio and exposes your Docker host as a set of safe, richly‑described tools.
Point any MCP‑capable assistant at it and you can operate containers and Compose stacks in plain language — the model reads each tool’s schema, decides which to call, and reports the results back to you. No more memorising flags or copy‑pasting container IDs.
In one line: it’s the bridge between “I wish I could just tell my server what to do” and your actual Docker daemon.
💡 Why it exists
Day‑to‑day container work is a stream of small, repetitive commands:
docker ps -a
docker logs --tail 100 -f my-api
docker compose -f ./prod/compose.yaml up -d --build
docker stats my-apiEvery one of those is trivial once you remember the exact syntax. The friction is the memorisation and the context‑switching. This server removes that friction by letting the AI do the translation, while keeping you in control through:
Read‑only mode for safe demos and production insight.
A container allowlist so the assistant can only touch what you allow.
Opt‑in exec so arbitrary in‑container commands are never available by accident.
Confirmation‑friendly design — destructive tools are clearly described so the model asks before it acts.
Built by SoyRage Agency for the self‑hosting and home‑lab community — and equally at home on a CI runner or a production VM behind read‑only mode.
🚀 Feature overview
Area | Capabilities |
🔎 Insight | List containers · inspect full config · live CPU/memory/network stats · tail logs with time windows · list images / networks / volumes · host summary · disk usage. |
⚙️ Lifecycle | Start · stop · restart · remove containers — with graceful stop timeouts. |
📦 Compose | Validate config · list services & health · deploy ( |
🛡️ Safety | Global read‑only mode · container allowlist · opt‑in exec. |
🔌 Transport | Local Unix socket · Windows named pipe · secured remote TCP + TLS. |
🎨 Identity | ASCII welcome banner · |
🖥️ Interactive panel | Tabbed web dashboard: live monitoring, terminal with smart command suggestions, file explorer, snapshots & scheduled backups, networks/volumes, auto‑restart watchdog, alerts & log watch, inspect, search and lifecycle actions — with a demo mode. |
⌨️ Terminal UI | A creative, lazydocker‑style TUI with a SoyRage welcome, live gauges and one‑key actions — zero curses dependencies. |
📈 Monitoring | Built‑in Prometheus |
🧩 Modular | Every capability is a toggleable plugin; enable exactly the surface you want via config. |
🧱 Engineering | 100% TypeScript, strict mode · one module per concern · tiny dependency surface · stderr‑only logging. |
🖥️ The interactive panel
Beyond the conversational interface, the project ships a minimalist web dashboard (docker-mcp-panel) for when you want a fast, visual, point‑and‑click view of your host. It reuses the exact same configuration, Docker client and safety rails as the MCP server — so read‑only mode and the allowlist apply here too.
npm run build
ragedocker panel # → http://127.0.0.1:4600 (or: npm run panel)
npm run panel:demo # same, but with realistic mock data (no daemon needed)One command for everything. Since v1.1 a single
ragedockerlauncher fronts the whole toolkit — runragedockerwith no arguments for an interactive menu, or:ragedocker tui # the lazydocker-style terminal dashboard ragedocker panel # the web panel + monitoring API ragedocker mcp # the MCP server (Claude Desktop, Cursor, Continue…) ragedocker ia login # sign in to Claude or ChatGPT (see below) ragedocker doctor # check Docker, the AI and your configurationThe original
docker-mcp-tui/docker-mcp-panel/docker-mcp-serverbinaries still work as aliases.
🔑 AI copilot — sign in once with ragedocker ia login
The TUI copilot (press a) and the panel's AI terminal need a model. A short wizard sets one up — pick Claude (Anthropic, used natively) or ChatGPT (OpenAI), paste your key, and it's verified before saving:
ragedocker ia login # set up your main AI account
ragedocker ia secundaria # add a second account to switch to
ragedocker ia use secondary
ragedocker ia list # show what's configured (keys masked)
ragedocker ia test # call the model once and report backKeys are stored at ~/.ragedocker/ai.json, owner‑readable only (0600), and are never echoed or logged. The legacy DOCKER_MCP_AI_* environment variables still take precedence for unattended deployments.
Dashboard — live host stats, containers & images
One‑click log tailing
Terminal — run docker commands with smart suggestions (Tab / ↑↓ / Enter)
Snapshots & scheduled backups — with email/cloud delivery
File explorer + editor — view & edit files inside a container
Browse a container's filesystem
System — networks & volumes
Alerts & log watch — with a live auto‑restart watchdog
Read‑only mode — actions safely disabled
Screenshots rendered in demo mode · watermarked © SoyRage Agency · soyrage.es
Panel highlights
Tabbed layout — Overview, Terminal, Files, Backups, System and Alerts, with a live alert badge in the header.
Live monitoring + Trends — CPU‑load and memory‑used cards with meters, per‑container CPU % and memory bars, and historical sparkline charts (sampled every 5s) for CPU and memory over time.
⌨️ AI‑powered terminal — type
docker …for typo‑tolerant, context‑aware completions (Tab/↑↓/Enter), or type a request in plain English (“why did web crash”) and pick Ask AI — the copilot proposes a command you review, then run. Commands are parsed to an argv array and spawned without a shell; a deny‑list blocks dangerous verbs and write verbs respect read‑only mode. AI uses any OpenAI‑compatible endpoint (OpenAI, Ollama, LM Studio…); without one it falls back to rule‑based suggestions.📁 File explorer + editor — browse any container's filesystem (breadcrumbs, up‑navigation), open and edit text/
.sh/config files, and Save back into the container. An AI edit button rewrites the file from a plain‑English instruction. Safe, shell‑freeexec; edits are blocked in read‑only mode.📸 Snapshots & scheduled backups — snapshot a container as an image (
commit) or a filesystemexport(.tar) to a chosen directory; schedule a daily backup (time, containers, type); a webhook forwards each backup to email, Google Drive or S3 via Zapier / Make / n8n.🧩 System tab — networks and volumes at a glance; per‑container inspect details (env redacted, mounts, ports, restart policy) in the drawer.
♻️ Auto‑restart watchdog — flip the Auto toggle and a background watchdog restarts a container whenever it exits (respects read‑only mode).
🚨 Alerts & log watch — down/unhealthy containers, high CPU/memory, watchdog events, and error/warn lines scanned from recent logs.
Container grid — colour‑coded state dots, ports as chips, filter/search, auto‑refresh toggle, and per‑row actions (details · files · snapshot · start/stop/restart).
Prometheus
/metrics— footer link exposes the scrape endpoint (see Monitoring).Demo mode —
DOCKER_MCP_PANEL_DEMO=trueserves fabricated‑but‑realistic data (with gentle live jitter), perfect for previews and client demos with no daemon.Zero UI dependencies — hand‑written HTML/CSS/JS served by a Node‑core HTTP server.
Panel REST API (all local): /api/snapshot · /api/history · /api/containers · /api/images · /api/logs · /api/action · /api/run · /api/ai · /api/files · /api/file (GET read / POST save) · /api/inspect · /api/networks · /api/volumes · /api/backups · /api/backup · /api/schedule · /api/alerts · /api/autorestart · /metrics.
AI copilot (optional): set DOCKER_MCP_AI_ENDPOINT (+ DOCKER_MCP_AI_KEY, DOCKER_MCP_AI_MODEL) to power the AI terminal and AI file‑editing. Works with OpenAI, Ollama (http://localhost:11434/v1, free & local), LM Studio, or any OpenAI‑compatible API. Demo mode simulates it so you can try the UX offline.
🖼️ Regenerate the screenshots yourself with
npm run shots(requiresnpx playwright install chromium).
🔒 Panel security & networking (VPN, IPs, ports)
The panel and terminal can control your host, so treat access like SSH.
Bind locally by default — the panel listens on
127.0.0.1:4600. Reach a remote host by tunnelling over a VPN — WireGuard or Tailscale — and browsing to the host's VPN IP. Do not port‑forward the panel to the public Internet.If you must bind to the LAN, set
DOCKER_MCP_PANEL_HOST=0.0.0.0. On startup the server prints every IP address it is reachable on and a warning, e.g.:Panel ready at http://0.0.0.0:4600 reachable at http://127.0.0.1:4600 reachable at http://10.8.0.3:4600 ← your WireGuard IP reachable at http://192.168.1.42:4600 ← your LAN IP Panel is bound to ALL interfaces … keep it behind a VPN or an authenticated reverse proxy.Change the port with
DOCKER_MCP_PANEL_PORT(e.g.8443) to avoid clashes or sit behind a reverse proxy.Port‑forwarding / reverse proxy — if you expose it, put an authenticated proxy (Caddy/nginx/Traefik with Basic‑Auth or SSO + TLS) in front; never forward the raw port. Combine with
DOCKER_MCP_READONLY=truefor view‑only deployments, andDOCKER_MCP_PANEL_TERMINAL=falseto disable the command runner.
⌨️ The terminal UI (TUI)
Prefer the terminal? Launch docker-mcp-tui — a creative, lazydocker‑style dashboard that opens with a SoyRage Agency welcome and then drops you into a live, keyboard‑driven view. It’s hand‑rolled ANSI (no curses library), so it adds zero dependencies.
ragedocker tui # → interactive terminal dashboard (or: npm run tui)
npm run tui:demo # same, with realistic mock data (no daemon needed)A warm welcome — “thank you for using our repository ⭐”
Live dashboard — gauges, details & one‑key actions
AI copilot — give an order in plain English
AI copilot. Press a (or :) to open the copilot bar and type what you want — “restart the web container”, “stop the backup job”, “show every container”. The copilot turns it into the exact docker command, shows it to you, and runs it only after you confirm with y. It speaks to any OpenAI‑compatible endpoint (DOCKER_MCP_AI_ENDPOINT / DOCKER_MCP_AI_KEY / DOCKER_MCP_AI_MODEL) and falls back to a built‑in rule engine in demo mode, so you can try it with zero setup.
Action menu. Press Enter (or m) over any container to open a menu of everything you can do to it — logs, inspect, shell, start/stop/restart, snapshot, restore, attach a volume, edit compose, copy id — arrow‑key navigable, so you never have to memorise a key. Every action also has a one‑key shortcut for power users.
Animated status. Containers no longer show a plain red/green dot: healthy ones breathe (●↔◉), starting/restarting ones spin (⠋⠙⠹…), unhealthy ones blink (▲), paused show ⏸, exited ○ — a glance across the list reads like a heartbeat monitor.
Keys: Enter/m menu · ↑/↓ (or j/k) navigate · g/G top/bottom · / filter · o sort (O reverse) · space pause live updates · l logs (f follow, +/- tail) · i inspect · e shell · c edit compose · y copy id · n/v/A networks/volumes/alerts · a AI · S/s/R lifecycle · b snapshot · B restore · V attach volume · u what's new · ? help · q quit.
Live CPU/memory gauges refresh automatically; the details pane shows lazydocker‑level info (health, uptime, command, restart policy, networks, mounts, env), lifecycle actions play a spinner animation, and read‑only mode hides the mutating keys (the copilot still explains, but never runs a mutating command).
Update notices. When a new version is published, both the TUI (a banner + u for the changelog) and the web panel (a dismissable banner) tell you — read from a single updates.json in the repo. It's silent on any failure and can be turned off with DOCKER_MCP_NO_UPDATE_CHECK=1.
📈 Monitoring: Prometheus, Zabbix & more
The panel doubles as a metrics exporter. It serves a standard Prometheus text endpoint at /metrics, so your Docker host becomes a first‑class monitoring target with no extra agent.
npm run panel # metrics on by default
curl http://127.0.0.1:4600/metricsExposed series (labelled by name, state, image where relevant):
Metric | Type | Meaning |
| gauge | 1 when the exporter is running. |
| gauge | Build/author metadata (product, author = SoyRage Agency, version, url). |
| gauge | Logical CPUs on the host. |
| gauge | Total host memory. |
| gauge | Container counts. |
| gauge | Cached images. |
| gauge | Aggregate container CPU %. |
| gauge | Aggregate container memory. |
| gauge | 1 if a given container is running. |
| gauge | Per‑container CPU %. |
| gauge | Per‑container memory. |
| gauge | 1 if auto‑restart is enabled for it. |
| gauge | Count of containers with auto‑restart on. |
| gauge | Number of active state‑based alerts. |
Prometheus
# prometheus.yml
scrape_configs:
- job_name: docker-mcp
static_configs:
- targets: ["your-host:4600"]Zabbix
Use an HTTP agent item pointed at http://your-host:4600/metrics, then add
dependent items with the Prometheus pattern preprocessing step, e.g.
dockermcp_containers_running or
dockermcp_container_cpu_percent{name="api"}. Grafana, Grafana Agent,
VictoriaMetrics and Netdata can scrape the same endpoint.
Turn the exporter off with
DOCKER_MCP_PANEL_METRICS=falseif you only want the UI.
🧩 Modular plugin architecture
The server is assembled from independent plugins, each owning one capability group. Which plugins load is driven entirely by configuration, so you can expose exactly the surface you want — from insight only to the full toolbox — without touching code. This also makes the project easy to extend.
Plugin | Category | Type | Tools |
| identity | read |
|
| insight | read |
|
| insight | read |
|
| insight | read |
|
| system | read |
|
| compose | read/write |
|
| lifecycle | write |
|
🔒 The about plugin is locked — it carries the SoyRage Agency identity and cannot be disabled.
Toggle plugins via environment variables or the config file:
# Expose ONLY read-only insight (a safe, curated surface)
DOCKER_MCP_PLUGINS=containers,logs,images,system
# Load everything except container lifecycle
DOCKER_MCP_DISABLED_PLUGINS=lifecycleAsk the assistant “list the plugins” any time to see what’s enabled.
Config file
For a reproducible setup, drop a docker-mcp.config.json in the project root (or point DOCKER_MCP_CONFIG at one). Environment variables always override it. See examples/docker-mcp.config.json:
{
"readOnly": false,
"allowExec": false,
"containerAllowlist": ["web", "api"],
"plugins": { "enabled": [], "disabled": ["lifecycle"] },
"panel": { "host": "127.0.0.1", "port": 4600, "demo": false }
}Configuration precedence (lowest → highest): built‑in defaults → docker-mcp.config.json → .env → real environment variables.
🛠️ How it works
┌──────────────────────────────────────────────┐
You ◀──────▶ │ AI assistant (Claude / Cursor / Continue …) │
└───────────────────────┬──────────────────────┘
stdio · JSON‑RPC (MCP)
┌───────────────────────▼──────────────────────┐
│ Docker MCP Server │
│ │
│ 1. Client sends `initialize` → server │
│ replies with tool schemas + SoyRage │
│ `instructions` (identity & welcome). │
│ 2. Model picks a tool and sends `tools/call`.│
│ 3. Server executes it against Docker and │
│ returns human‑readable text. │
└───────────┬───────────────────────┬──────────┘
Engine API │ spawn │ docker compose
┌───────────▼───────────┐ ┌──────────▼──────────┐
│ Docker Engine │ │ Compose plugin │
└───────────────────────┘ └─────────────────────┘Engine operations (containers, images, stats, logs, system info) use the Docker Engine API through
dockerode.Compose operations shell out to the official
docker composeCLI with a shell‑free, fully argument‑quoted spawn (no string interpolation, no injection surface).stdout is sacred: it carries only the JSON‑RPC stream. Every log line goes to stderr.
✅ Requirements
Requirement | Notes |
Node.js ≥ 18 | ES modules + modern APIs. Node 20+ recommended. |
A reachable Docker Engine | Local socket by default; remote TCP/TLS supported. |
| Only needed for the Compose tools. Insight/lifecycle tools work without it. |
An MCP client | Claude Desktop, Cursor, Continue, Zed, or the MCP Inspector. |
📦 Installation
# 1. Clone
git clone https://github.com/<your-user>/docker-mcp-server.git
cd docker-mcp-server
# 2. Install dependencies
npm install
# 3. Build to dist/
npm run buildKick the tyres with the official MCP Inspector (no AI client required):
npm run inspectThis opens a UI where you can list tools and call them by hand — perfect for verifying your Docker connection before wiring up an assistant.
🔌 Connecting to your AI client
Claude Desktop
Edit your Claude Desktop config file:
Windows:
%APPDATA%\Claude\claude_desktop_config.jsonmacOS:
~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"docker": {
"command": "npx",
"args": ["-y", "@soyrageagency/docker-mcp"],
"env": {
"DOCKER_MCP_READONLY": "false",
"DOCKER_MCP_ALLOW_EXEC": "false",
"DOCKER_MCP_DEFAULT_LOG_TAIL": "200"
}
}
}
}A ready‑to‑edit copy lives in
examples/claude_desktop_config.json.
No install step needed: npx fetches the package on first run and keeps it up to date. Restart Claude Desktop and ask: “What containers are running?”
Cursor / Continue / Zed
Any MCP‑capable client works the same way — register a stdio server whose command is npx with the arguments -y @soyrageagency/docker-mcp, passing the same environment variables. Consult your client’s MCP documentation for the exact config location; the server block is identical.
🌐 Run it over the network (HTTP)
By default an MCP server talks over stdio: your AI client starts a copy of it as a child process, on your machine. That is fine for a laptop tool and awkward for a homelab, where the Docker daemon lives on a server — and where you probably want your desktop and your laptop talking to the same thing.
Set one variable and it serves Streamable HTTP instead:
DOCKER_MCP_HTTP=true DOCKER_MCP_HTTP_TOKEN="$(openssl rand -hex 32)" npx -y @soyrageagency/docker-mcpThen point any MCP client at it:
{
"mcpServers": {
"docker": {
"type": "http",
"url": "http://10.0.0.5:8620/mcp",
"headers": { "Authorization": "Bearer <the token you generated>" }
}
}
}Variable | Default | What it does |
|
| Serve over HTTP instead of stdio. |
|
| Interface to bind. Use |
|
| TCP port. |
|
| Endpoint path. |
| (none) | Bearer token required on every request. Set this. |
| derived |
|
| (none) |
|
Read this before you expose it. The Docker socket is root on your host, so
anyone who can reach this port can do anything to it. It binds loopback by
default and warns loudly if you start it without a token. Put it behind your
VPN, and consider pairing it with DOCKER_MCP_READONLY=true or a container
allowlist for anything you do not fully trust.
There is also GET /health, which needs no token, for container healthchecks.
🩺 Diagnostics
Three read-only tools aimed at the questions you actually ask, rather than at the API surface:
host_health — one call that answers is anything wrong? Failing
healthchecks, containers crash-looping, containers that are down despite a
restart policy (the failure nobody notices), and disk pressure from
reclaimable images and volumes. Findings ranked by severity, not a data dump.
find_restart_loops — the containers that keep dying, with the exit code
and the tail of their logs, which is where the reason almost always is. It
saves the usual ps → inspect → logs round trip that takes three messages.
find_unused_resources — what is safe to clean and what it would return,
split into images, volumes and long-dead containers. It refuses to be glib
about volumes: an unreferenced volume is very often the database of a stack you
stopped on purpose, and docker volume prune is not undoable.
All three are read-only, so they stay available with DOCKER_MCP_READONLY=true.
💬 Guided workflows (prompts & resources)
Tools only answer a question you already knew how to ask. MCP prompts are the other half: your client lists them, so the workflow is discoverable without knowing which tool to reach for or in what order.
Prompt | What it does |
debug-container | Works out why a container is unhealthy or restarting, from its logs, config and environment — and says so when the logs do not actually support a conclusion. |
audit-host | Read-only sweep of health, waste and risky configuration. Narrow it with |
review-compose | Reads your Compose file and points out what bites later: |
free-up-disk | Finds reclaimable space and ranks it by space returned ÷ risk. |
Each prompt also tells the assistant what a good answer looks like: verdict first, findings ranked, no padding, and an explicit instruction not to change anything.
Resources expose the host as attachable context, so the model can be handed the current picture instead of spending three tool calls rebuilding it:
docker://host/overview— containers, images and disk usage in one snapshot.docker://server/capabilities— which plugins are loaded, whether the server is read-only, whether exec is allowed, and what the allowlist permits.
⚙️ Configuration reference
Every setting is an environment variable. A local .env file (next to package.json) is loaded automatically at startup; values already present in the process environment always win, so your MCP client can override the file. See .env.example for a commented template.
Variable | Default | Description |
| platform socket | Engine endpoint. Accepts |
| — | Directory containing |
|
|
|
|
| When |
|
| When |
| — | Comma‑separated container names or prefixes the server may operate on. Empty = all. Prefix matching means |
|
| Default number of log lines returned by |
| process cwd | Base directory used to resolve relative Compose file paths. |
|
| Diagnostic verbosity written to stderr: |
| — | Load only these plugins (comma‑separated). Empty = all. |
| — | Disable these plugins (comma‑separated). |
|
| Bind address for the interactive panel. |
|
| Port for the interactive panel. |
|
| Serve fabricated demo data in the panel/TUI. |
|
| Expose the Prometheus |
|
| Enable the in‑panel command terminal. |
|
| Directory for container snapshots/exports. |
| — | Webhook called after each backup (email/cloud bridge). |
| — | OpenAI‑compatible base URL for the AI copilot (empty = off). |
| — | Bearer key for the AI endpoint. |
|
| Model name for the AI endpoint. |
|
| Path to the optional JSON config file. |
Boolean parsing: any of 1, true, yes, on (case‑insensitive) counts as true. A JSON config file provides defaults for all of the above — see Config file.
🌐 Connecting to remote / TLS daemons
Manage a Docker host over the network by pointing DOCKER_HOST at its TCP endpoint. For anything beyond localhost, always use TLS.
# Plain TCP (trusted networks only!)
DOCKER_HOST=tcp://192.168.1.50:2375
# Secured TCP with mutual TLS
DOCKER_HOST=tcp://docker.internal:2376
DOCKER_TLS_VERIFY=1
DOCKER_CERT_PATH=/home/you/.docker/certsWhen TLS is enabled the server reads ca.pem, cert.pem and key.pem from DOCKER_CERT_PATH and connects over HTTPS (default port 2376; plain TCP defaults to 2375).
🛡️ Security model
This server can control your infrastructure, so it ships with defence‑in‑depth defaults. You decide how much power to grant.
Control | What it does | Recommended for |
Read‑only mode ( | Hides every state‑changing tool. The model literally cannot see | Demos, dashboards, production insight. |
Container allowlist ( | Restricts all container tools to matching names/prefixes. Anything else returns a clear “not allowed” error. | Multi‑tenant hosts, “manage the app, never the database”. |
Opt‑in exec ( | The powerful | Keep disabled unless you specifically need it. |
Shell‑free Compose | Compose commands are spawned as argument arrays — no shell, no interpolation. | Always on. |
Graceful errors | A failing tool returns an | Always on. |
Safety recipes
# Give a live demo with zero risk of mutation
DOCKER_MCP_READONLY=true
# Let the AI manage only the app tier, never data stores
DOCKER_MCP_CONTAINER_ALLOWLIST=web,api,worker
# Never allow shelling into containers (this is the default)
DOCKER_MCP_ALLOW_EXEC=false⚠️ Principle of least privilege. Start read‑only, add an allowlist, and only enable writes/exec once you trust the setup. Treat the assistant as a very fast junior engineer: helpful, but you sign off on the destructive stuff.
🧰 Complete tool reference
Tools marked W change state and are hidden when DOCKER_MCP_READONLY=true.
exec_in_container is additionally hidden unless DOCKER_MCP_ALLOW_EXEC=true.
Identity
Tool | Parameters | Description |
| — | Returns the welcome banner, version and credits. |
| — | Lists the modular capability plugins and whether each is enabled. |
Insight (read‑only)
Tool | Parameters | Description |
|
| List containers with state, image, status and published ports. |
|
| Full low‑level config for one container (env, mounts, network, restart policy, health) plus a readable summary. |
|
| One‑shot snapshot of live CPU %, memory usage/limit and network RX/TX. |
|
| Tail stdout/stderr. |
| — | Locally cached images with |
| — | Engine version, host OS/arch, kernel, CPU/RAM, storage driver and object counts. |
| — | Reclaimable space across images/containers/volumes ( |
| — | Networks with driver and scope. |
| — | Named volumes with driver and mountpoint. |
Compose — read‑only
Tool | Parameters | Description |
|
| List a stack’s services and their state/health. |
|
| Validate and render the fully‑resolved Compose configuration (a non‑zero result means the file has errors). |
Lifecycle (W)
Tool | Parameters | Description |
|
| Start a stopped container (no‑op if already running). |
|
| Graceful stop (SIGTERM → SIGKILL after |
|
| Restart a container. |
|
| Remove a container. Destructive; |
|
| Run a one‑off command (argument array, no shell) inside a running container. Opt‑in only. |
Compose — state‑changing (W)
Tool | Parameters | Description |
|
|
|
|
| Stop and remove a stack. |
|
| Restart all or selected services. |
|
| Pull the latest images for a stack (pair with |
💬 Example conversations
Natural‑language prompts and the tools the model will typically reach for:
You say… | The assistant calls… |
“What’s running right now?” |
|
“Show me everything, including stopped ones.” |
|
“Why did |
|
“Anything in the |
|
“Is |
|
“Restart |
|
“Deploy the stack in |
|
“Which services are up in the demo stack?” |
|
“How much disk is Docker using?” |
|
“Who built this integration?” |
|
Want a stack to practise on? examples/demo-stack/compose.yaml spins up nginx + redis. Try: “Deploy the demo stack, then show me its services and the web logs.”
🗂️ Project structure
docker-mcp-server/
├── assets/
│ ├── soyrage-banner.svg # SoyRage Agency identity banner (this README)
│ └── screenshots/ # Watermarked panel screenshots
├── examples/
│ ├── claude_desktop_config.json
│ ├── docker-mcp.config.json # Reproducible config-file example
│ └── demo-stack/
│ └── compose.yaml # nginx + redis playground
├── install.sh / install.ps1 # One-command bootstrap for beginners
├── scripts/
│ ├── install.mjs # Cross-platform Claude Desktop configurator
│ ├── copy-public.mjs # Copies panel assets into dist/ after build
│ ├── shots.mjs # Regenerates the panel screenshots (Playwright)
│ └── tui-shot.mjs # Renders the TUI to PNG (ANSI→HTML→Playwright)
├── src/
│ ├── index.ts # MCP entry point: banner, wiring
│ ├── branding.ts # SoyRage identity, ASCII banner, MCP instructions
│ ├── plugins.ts # Modular plugin catalogue & selection loader
│ ├── config.ts # Layered config (defaults → file → .env → env)
│ ├── logger.ts # stderr‑only structured logger (stdout is sacred)
│ ├── docker/
│ │ ├── client.ts # Typed dockerode wrapper + allowlist enforcement
│ │ └── compose.ts # Safe, shell‑free `docker compose` driver
│ ├── tools/ # One module per plugin's tools
│ │ ├── context.ts # Shared dependency bundle + plugin metadata
│ │ ├── about.ts # about / list_plugins (identity, locked)
│ │ ├── containers.ts # list / inspect / stats
│ │ ├── logs.ts # log tailing with stream demultiplexing
│ │ ├── lifecycle.ts # start / stop / restart / remove / exec
│ │ ├── images.ts # image inventory
│ │ ├── system.ts # system_info / disk_usage / networks / volumes
│ │ └── compose.ts # deploy / down / restart / pull / ps / config
│ ├── panel/ # Interactive web dashboard
│ │ ├── index.ts # Panel entry point (docker-mcp-panel binary)
│ │ ├── server.ts # Node‑core HTTP server + REST API + /metrics
│ │ ├── service.ts # UI/monitoring data layer, stats & Prometheus
│ │ └── public/ # Hand‑written SPA (index.html, styles.css, app.js)
│ ├── tui/ # Terminal UI (docker-mcp-tui binary)
│ │ ├── index.ts # TUI entry point (+ --frame/--splash snapshots)
│ │ ├── app.ts # Interactive app: welcome, gauges, key handling
│ │ ├── box.ts # Rounded box renderer
│ │ └── ansi.ts # ANSI colours, cursor control, width-aware pads
│ └── utils/
│ ├── format.ts # tables, byte & time humanisers
│ └── result.ts # MCP result helpers + error guard
├── docker-mcp.config.json # (optional) your config file
├── .env.example # Commented configuration template
├── LICENSE # MIT License
└── README.md🧠 Design principles
stdout is reserved for the JSON‑RPC protocol stream; every diagnostic goes to stderr. Violating this corrupts the MCP connection — the logger enforces it.
No shell interpolation. Compose commands are spawned with an argument array, never a shell string, eliminating command‑injection risk.
Fail soft. A handler that throws returns a clean
isErrortext result the model can read and recover from, instead of tearing down the transport.One concern per module. Tools are grouped by capability; each group is a small, focused file that receives its dependencies explicitly (no globals).
Tiny dependency surface. A hand‑rolled
.envloader keepsdotenvout; only@modelcontextprotocol/sdk,dockerodeandzodare runtime dependencies.Safety by construction. Read‑only mode and the allowlist are checked at the boundary, so an unsafe call can’t slip through a forgotten branch.
🧪 Development
npm run dev # hot‑reload the MCP server with tsx
npm run typecheck # strict type check, no emit
npm run build # compile to dist/ and copy panel assets
npm run start # run the built MCP server
npm run inspect # launch the MCP Inspector against the built server
npm run panel # run the interactive panel (with /metrics)
npm run panel:dev # hot‑reload the panel with tsx
npm run panel:demo # run the panel with demo data
npm run tui # run the terminal UI
npm run tui:demo # run the terminal UI with demo data
npm run shots # regenerate panel screenshots (needs Playwright chromium)
npm run clean # remove dist/Coding standards: TypeScript strict with noUnusedLocals, noUnusedParameters, noImplicitReturns and noFallthroughCasesInSwitch.
Continuous integration: .github/workflows/ci.yml runs on every push/PR — install, type‑check, build, then the deep end‑to‑end suite (node scripts/deep-test.mjs, 70 checks) against a headless demo panel. Run it locally anytime:
npm run build
DOCKER_MCP_PANEL_DEMO=true DOCKER_MCP_PANEL_PORT=4600 node dist/panel/index.js &
node scripts/deep-test.mjs🩺 Troubleshooting & FAQ
The server started but couldn’t connect to Docker. Check that:
Docker Desktop / the daemon is running.
DOCKER_HOSTis correct for your platform (empty = default socket).On Linux, your user can access the socket (
dockergroup) or you’re running with sufficient permissions.
The server intentionally keeps running so tool calls return a friendly error inside your chat client instead of crashing.
The Compose tools shell out to docker compose. Install Docker Desktop or the docker-compose-plugin, and make sure docker is on the PATH of the environment your MCP client launches the server in.
You’re probably in read‑only mode. Set DOCKER_MCP_READONLY=false (the default) and restart your MCP client so it re‑reads the tool list.
DOCKER_MCP_CONTAINER_ALLOWLIST is set and the target doesn’t match. Add its name/prefix to the list, or clear the variable to allow all.
No. This server talks only to your Docker daemon and your MCP client over local stdio. It makes no outbound network calls of its own.
🗺️ Roadmap
The full roadmap — what is shipped, what is next, and what is deliberately not planned — lives in ROADMAP.md.
The short version: a multi-arch ghcr.io image and a socket-proxy recipe, then
finer-grained permissions than the current read-only/read-write switch. Image
update checking and metrics history are further out because doing them badly
means confidently wrong answers.
Explicitly not planned: replacing Portainer, autonomous action without confirmation, and telemetry of any kind.
🤝 Contributing
Contributions are welcome! Please:
Open an issue describing the change before large PRs.
Keep the stderr‑only logging and shell‑free Compose invariants intact.
Run
npm run typecheck && npm run buildbefore submitting.
🏢 About SoyRage Agency
SoyRage Agency is a full‑stack development & infrastructure studio based in Valencia, Spain, building tools where DevOps meets AI. We craft polished, production‑minded software for developers and the self‑hosting community.
🌐 Web: soyrage.es
🧑💻 Focus: full‑stack development · infrastructure engineering · AI tooling
📫 Work with us: soyrage.es
If this project is useful to you, a ⭐ on the repo and a link back to soyrage.es genuinely help us keep building in the open. Thank you! 🙌
🧰 More from the SoyRage self‑hosting suite
Docker MCP Server is part of a family of open‑source infrastructure tools built with the same care — same design language, same safety‑first defaults, same "chat with your infra" philosophy:
Project | What it does |
(you are here) Chat with your Docker host — containers, logs, Compose, a live panel & a TUI copilot. | |
Chat with your Proxmox VE cluster — nodes, VMs & LXC, snapshots and full guest CRUD, plus a tabbed terminal dashboard with an AI command bar. | |
Leaving vSphere after the Broadcom price hikes? Inventory vCenter, score compatibility, estimate cost & time, plan disk conversion and export a professional PDF assessment. | |
🗺️ NetAtlas | Living infrastructure documentation — agentless discovery that auto-generates a network diagram, inventory, VLAN & service-dependency maps, and tells you what changed since last time. |
🛡️ MailAegis | Corporate email threat analyzer — VirusTotal, ClamAV and an in-house phishing/BEC engine, inside a mail client. |
💙 Support the project
Docker MCP Server is free and MIT licensed. If it saves you time, you can support development on PayPal — a ⭐ on the repo helps just as much.
🖋️ Credits & License
Designed, built and maintained by SoyRage Agency — https://soyrage.es/
Released under the MIT License — use it, modify it, self-host it, ship it commercially.
If you build something on top of it, a link back to soyrage.es is appreciated but never required.
© 2026 SoyRage Agency — https://soyrage.es/
Made with ❤ in Valencia, Spain.
Available Tools
21 toolsaboutAbout this serverA
Show who built this Docker MCP Server and how it is licensed. Call this to greet the user with the SoyRage Agency welcome banner, or whenever they ask who made this integration.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description indicates a read-only info and greeting operation. It doesn't discuss side effects, but none are expected. Minor gap: doesn't explicitly state it's safe or idempotent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste. Front-loaded with primary purpose, then specific use case.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, no-output-schema, simple info tool, the description fully covers all needed context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist (100% schema coverage), so baseline is 4. Description adds no parameter details, which is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool shows who built the server and licensing, with an additional use case of greeting the user. This distinctly separates it from all Docker operation siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit scenarios: 'greet the user' or when asked about the integration. No ambiguity or need for alternative tools since no sibling serves this purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compose_configCompose: validate configA
Validate a Compose file and render its fully-resolved configuration (interpolated variables, merged overrides). A non-zero result means the file has errors.
| Name | Required | Description | Default |
|---|---|---|---|
| file | Yes | Path to a compose file, or a directory containing one (compose.yaml / docker-compose.yml). Relative paths resolve against the server's configured Compose working directory. | |
| project | No | Explicit Compose project name (defaults to the folder name). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that the tool validates and renders configuration, including behavior like variable interpolation and override merging. It also clarifies the meaning of a non-zero exit code. However, it does not explicitly confirm that the tool is non-destructive, though implied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with front-loaded purpose. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 parameters, no output schema, no annotations), the description provides sufficient detail: core functions, parameter context, and error indication. No gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds valuable meaning beyond the schema: it explains that relative paths in the 'file' parameter resolve against the server's working directory, and that the 'project' parameter defaults to the folder name. This enriches understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool validates a Compose file and renders its fully-resolved configuration. It uses specific verbs ('Validate', 'render') and resources ('Compose file', 'fully-resolved configuration'), distinguishing it from sibling tools like compose_down or container_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used for validation and rendering, but does not explicitly state when to use it vs alternatives or provide exclusions. It mentions the meaning of a non-zero result, offering some usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compose_downCompose: tear down stackA
Stop and remove a Compose stack (compose down). Set removeVolumes to also delete named volumes — destructive.
| Name | Required | Description | Default |
|---|---|---|---|
| file | Yes | Path to a compose file, or a directory containing one (compose.yaml / docker-compose.yml). Relative paths resolve against the server's configured Compose working directory. | |
| project | No | Explicit Compose project name (defaults to the folder name). | |
| removeVolumes | No | Also remove named volumes (default: false). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries burden. Warns that removeVolumes is destructive, but does not fully disclose other behaviors (e.g., whether it stops containers first, or any rollback implications).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the command and key warning. Every word earns its place; no extraneous content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple tool with 3 parameters and no output schema. Covers the main action and risky parameter, though could briefly mention that it stops containers as part of the process.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, baseline 3. Description adds value by highlighting that removeVolumes is destructive, giving practical warning. File and project parameters are standard without added meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Stop and remove a Compose stack', specifying verb (stop/remove) and resource (Compose stack). Distinguishes from sibling tools like compose_config or compose_ps by focusing on teardown.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for tearing down a stack but provides no explicit guidance on when to use vs alternatives (e.g., when to use compose_restart instead) or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compose_psCompose: list servicesA
List the services defined by a Compose stack and their current state/health. Point file at the compose file or its directory.
| Name | Required | Description | Default |
|---|---|---|---|
| file | Yes | Path to a compose file, or a directory containing one (compose.yaml / docker-compose.yml). Relative paths resolve against the server's configured Compose working directory. | |
| project | No | Explicit Compose project name (defaults to the folder name). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It clearly indicates a read-only operation (listing state/health) without any destructive hints. While adequate, it could add more context such as that no modifications are made.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the purpose, and contains no redundant information. Every word is meaningful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple nature of the tool (list services) and full schema coverage, the description is mostly complete. It explains what the tool does and how to specify the file. However, with no output schema, a brief note on the output format would make it more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds 'Point `file` at the compose file or its directory', which largely repeats the schema's description. It does not add significant new meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' and clearly identifies the resource 'services defined by a Compose stack and their current state/health'. This distinguishes it from sibling tools like compose_config (configuration) or compose_down (stopping).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating 'Point `file` at the compose file or its directory', giving context on how to use the file parameter. However, it does not explicitly state when to use this tool versus alternatives, nor does it exclude any conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compose_pullCompose: pull imagesA
Pull the latest images referenced by a stack without starting it. Pair with deploy_stack to perform a rolling update.
| Name | Required | Description | Default |
|---|---|---|---|
| file | Yes | Path to a compose file, or a directory containing one (compose.yaml / docker-compose.yml). Relative paths resolve against the server's configured Compose working directory. | |
| project | No | Explicit Compose project name (defaults to the folder name). | |
| services | No | Services to pull (default: all). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behaviors. It only states that the tool pulls without starting. Missing details on permissions, side effects, error handling, or return values. Minimal disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no fluff, front-loaded with core purpose. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description is adequate for basic usage but lacks details on prerequisites, error states, or post-pull behavior. Not fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 3 parameters have full schema descriptions, so the description adds no extra value beyond what the schema already provides. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'pull' and the resource 'latest images referenced by a stack', and explicitly distinguishes from sibling tools by noting 'without starting it' and pairing with `deploy_stack`. This provides specific, actionable purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: pull without starting, and suggests pairing with `deploy_stack` for rolling updates. It lacks explicit 'when not to use' guidance, but the context is sufficient for informed selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compose_restartCompose: restart servicesA
Restart all services in a stack, or only the ones you name.
| Name | Required | Description | Default |
|---|---|---|---|
| file | Yes | Path to a compose file, or a directory containing one (compose.yaml / docker-compose.yml). Relative paths resolve against the server's configured Compose working directory. | |
| project | No | Explicit Compose project name (defaults to the folder name). | |
| services | No | Services to restart (default: all). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears the full burden. It only states the basic restart behavior but does not disclose potential side effects (e.g., container recreation, downtime, or impact on running processes). More transparency is needed for a potentially destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence (13 words) with no wasted information. It efficiently conveys the core purpose and optional targeting of services.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity, the description is adequate but lacks completeness. It does not mention prerequisites (e.g., file must exist), error scenarios, or return values. Since there is no output schema, some hint about what the tool returns would be helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, so each parameter is already documented. The description adds no additional meaning beyond what the schema provides; for example, it does not explain the format of the 'services' list or expected values. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('restart'), the resource ('services in a stack'), and the ability to target specific services ('or only the ones you name'). It effectively distinguishes from sibling tools like restart_container (single container) and compose_down/compose_up (full lifecycle).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for restarting compose services, but it does not explicitly state when to use it versus alternatives (e.g., restart_container for individual containers) or when not to use it. No exclusions or context are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
container_logsRead container logsA
Fetch the most recent log lines from a container's stdout/stderr. Use this to diagnose crashes, watch startup output or confirm a deployment. Supports an optional time window via since.
| Name | Required | Description | Default |
|---|---|---|---|
| tail | No | Number of trailing lines to return (default from server config). | |
| since | No | Only return logs newer than this. Accepts a Unix timestamp (seconds) or a relative value like '10m' or '2h'. | |
| container | Yes | Container name, short id or full id. | |
| timestamps | No | Prefix each line with its timestamp (default: false). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries the full burden. It discloses that it fetches recent log lines from stdout/stderr and supports time filtering, but does not mention defaults (e.g., number of lines via 'tail'), error behavior (e.g., container not found), or whether it blocks or returns immediately.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise: two sentences that front-load the purpose, then add usage context and a key feature. No redundancy or unnecessary details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple log-fetching tool with 4 parameters and no output schema, the description covers the primary purpose and a key parameter. It could be slightly improved by mentioning the 'tail' limit or that timestamps can be added, but the schema fills those gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds some value by mentioning the 'since' parameter for time window, but does not elaborate on other parameters like 'tail', 'timestamps', or 'container' beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Fetch the most recent log lines from a container's stdout/stderr', using a specific verb and resource. It also provides specific use cases ('diagnose crashes, watch startup output or confirm a deployment'), which distinguishes it from sibling tools like container_stats or inspect_container.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear contexts for use (diagnose crashes, watch startup, confirm deployment) and mentions the optional 'since' parameter for time window filtering. However, it lacks explicit guidance on when not to use this tool or compare it to alternatives like container_stats or inspect_container.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
container_statsContainer resource statsA
Take a one-shot snapshot of a container's live CPU %, memory usage and network I/O. Useful to answer 'why is my server slow?'.
| Name | Required | Description | Default |
|---|---|---|---|
| container | Yes | Container name, short id or full id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It describes a 'one-shot snapshot' implying a read-only operation, but does not explicitly confirm non-destructiveness, rate limits, or potential performance impact. The behavior is fairly clear but could be improved.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose and a practical use case. Every word adds value; no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 param, no output schema, no annotations), the description is largely complete. It explains what metrics are captured and provides a use scenario. Missing details about return format or units, but for a snapshot tool, the agent can infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with a single parameter 'container' described as 'Container name, short id or full id.' The description adds no extra meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool captures a live snapshot of CPU%, memory usage, and network I/O for a container. The verb 'snapshot' is specific, and the resource is clearly the container's live stats. This distinguishes it from sibling tools like inspect_container or container_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions it is 'useful to answer why is my server slow?' which gives a use case but does not explicitly state when to use or avoid this tool versus alternatives. No comparisons to sibling tools or exclusions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deploy_stackCompose: deploy stackA
Deploy or update a Compose stack in the background (compose up -d). Optionally rebuild images and/or scope to specific services. This is the one-shot 'ship it' action.
| Name | Required | Description | Default |
|---|---|---|---|
| file | Yes | Path to a compose file, or a directory containing one (compose.yaml / docker-compose.yml). Relative paths resolve against the server's configured Compose working directory. | |
| build | No | Rebuild images before starting (default: false). | |
| project | No | Explicit Compose project name (defaults to the folder name). | |
| services | No | Limit the action to these services (default: all). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It notes the operation runs in the background and optionally rebuilds/scopes services, but omits side effects (e.g., state changes, destruction of previous stack versions) and any required permissions or prerequisites. For a mutation tool, more transparency is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two clear, front-loaded sentences with no filler. The essential information is delivered efficiently, earning its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool complexity (4 params, no output schema, no annotations), the description covers the main operation, optional flags, and positioning among siblings. It lacks return value info but that is not expected without an output schema. Sufficient for decision-making.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with all four parameters already described in the input schema. The description only echoes the optional rebuild and service scoping, adding no new semantic meaning beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the action ('Deploy or update a Compose stack') and the resource, using a specific verb. The mention of `compose up -d` grounds it in a familiar operation, and the 'one-shot ship it' phrase distinguishes it from other compose tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is the primary deployment action ('one-shot ship it'), giving clear context for use. However, it doesn't explicitly mention when not to use it or point to alternatives like compose_restart or compose_down, which would strengthen guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
disk_usageDisk usageA
Report Docker disk usage across images, containers and volumes (equivalent to docker system df), highlighting reclaimable space.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It mentions the tool is equivalent to `docker system df` and highlights reclaimable space, which gives a good sense of behavior. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the key purpose and additional detail. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description could elaborate on the return format. It mentions reclaimable space but not the structure of the report. Still, it's adequate for a simple report tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so baseline is 4. The description adds meaning by explaining the tool reports reclaimable space, which goes beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reports Docker disk usage across images, containers, and volumes, and highlights reclaimable space. It distinguishes itself from sibling tools like list_containers and system_info by focusing on disk usage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for checking disk usage and reclaimable space, but does not explicitly state when not to use or provide alternatives. However, the context of sibling tools makes the purpose clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inspect_containerInspect containerA
Return the full low-level configuration of a single container (environment, mounts, network settings, restart policy, health, …). Accepts a container name, short id or full id.
| Name | Required | Description | Default |
|---|---|---|---|
| container | Yes | Container name, short id or full id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It correctly implies a read operation via 'inspect' and lists configuration items, but it does not explicitly state that the tool is read-only or has no side effects. Given the verb and context, it is adequate but not explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences, no wasted words, front-loaded with the main purpose. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool without an output schema, the description covers the input and the type of output (full low-level configuration with examples). It could mention the output format (JSON) explicitly, but it is sufficiently complete for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the parameter description already states 'Container name, short id or full id.' The description repeats this information, adding no new semantic value beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns the full low-level configuration of a single container, listing specific details (environment, mounts, etc.). It is distinct from siblings like list_containers (which lists all) and container_logs (logs), though no explicit differentiation is given.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that the tool accepts container name, short id, or full id, which is helpful for usage. However, it does not provide guidance on when to use this tool versus alternatives (e.g., when you need detailed config vs. a summary).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_containersList containersA
List Docker containers with their status, image, ports and uptime. By default only running containers are shown; set all to include stopped ones. This is the best starting point to understand what is deployed on the host.
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | Include stopped/exited containers (default: false). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses the default filtering behavior of showing only running containers and the option to include stopped ones. This is adequate for a read-only tool, but no further behavioral traits (e.g., rate limits, auth) are mentioned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the core purpose. The second sentence adds value by explaining default behavior and parameter usage. No wasted words, though slightly more detail could be added without harming conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional boolean parameter and no output schema, the description covers the key aspects: what the tool does, what columns are shown, default filtering, and the parameter. It provides sufficient context for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, providing a baseline of 3. The description mentions the `all` parameter and its effect (include stopped containers), which aligns with the schema description. No additional semantic context beyond the schema is added.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the verb 'List' and the resource 'Docker containers', lists the displayed columns (status, image, ports, uptime), and distinguishes itself from siblings by positioning as the best starting point for understanding deployments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states it is the best starting point to understand what is deployed, implying primary usage for overview. It mentions the default behavior (only running containers) and when to use the `all` parameter, but does not explicitly exclude alternative tools like container_logs or inspect_container.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_imagesList imagesA
List Docker images cached on the host, including repository:tag, size and how long ago they were created. Handy for spotting stale or oversized images before a cleanup.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only describes the output content but does not disclose any behavioral traits such as read-only nature, authentication needs, or side effects. While listing is inherently safe, the description adds minimal transparency beyond purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words: the first states the action and output fields, the second provides a usage hint. Every word adds value, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with no output schema, the description adequately explains what the tool returns (repo:tag, size, creation time) and suggests a use case (cleanup). It could mention default ordering or behavior with no images, but overall it is fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters with 100% schema description coverage (since no parameters exist). Baseline is 4, and the description adds no additional parameter information because there are none to describe.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists Docker images cached on the host, specifies the included fields (repository:tag, size, creation time), and the resource 'images' distinguishes it from siblings like list_containers or list_networks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for spotting stale/oversized images before cleanup, but does not explicitly state when not to use it or suggest alternatives among siblings. The guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_networksList networksA
List Docker networks with their driver and scope. Useful to understand how containers can reach one another.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries the full burden. It implies a read-only operation but does not disclose any potential side effects, authentication needs, or error conditions. For a simple list tool, it is minimally adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, no fluff, and front-loads the action. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and no output schema, the description is fairly complete. It explains what the tool does and why it is useful, though it could mention the format or ordering of results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the baseline is 4. The description does not need to explain parameters, but it also does not add extra context about the output.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists Docker networks and specifies the information returned (driver and scope). This distinguishes it from other list tools like list_containers or list_images.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a usage context ('useful to understand how containers can reach one another') but lacks explicit when-not-to-use or comparisons with siblings. No guidance on prerequisites or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_pluginsList pluginsA
Show the modular capability plugins this server exposes and whether each is currently enabled. Handy to understand what the AI can do.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Though no annotations are present, the description implies a non-destructive read operation with 'Show'. It adds useful context about understanding AI capabilities but does not detail side effects or preconditions, which are minimal for a no-parameter tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences. The first defines the action and resource, the second provides value context. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is mostly complete for a simple list with no parameters. It could be slightly improved by specifying the output format, but given the context, it adequately covers the tool's purpose and utility.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so the input schema is fully covered (100%). The description adds no parameter-specific info, but the baseline for zero parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool shows modular capability plugins and their enabled status. The verb 'Show' is specific and the resource is well-defined. It distinguishes itself from siblings by focusing on plugins, not general system info.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool vs siblings like 'about'. Only implicit context 'understand what the AI can do' but no alternatives or exclusions mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_volumesList volumesA
List named Docker volumes and their storage driver. These persist data beyond a container's lifecycle.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses that volumes persist beyond container lifecycle, but does not reveal other behaviors such as read-only nature, authentication needs, or potential side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences with no extraneous information. The key action and purpose are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters or output schema, the description covers the main purpose and a key characteristic. However, it lacks details about the output format or any additional context that might be useful for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and schema description coverage is 100%. The description does not need to add parameter details; the baseline of 4 applies because the description is clear about what the tool does.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' and identifies the resource 'named Docker volumes' and includes the detail 'their storage driver'. It clearly distinguishes from sibling tools like list_containers or list_images.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating what it lists, but it does not provide explicit guidance on when to use this vs. alternatives, nor does it mention any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
remove_containerRemove containerA
Remove a container. Requires force to remove a running one. This is destructive and cannot be undone — prefer stopping first.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | Remove even if running (default: false). | |
| container | Yes | Container name or id. | |
| removeVolumes | No | Also remove anonymous volumes (default: false). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Explicitly states 'This is destructive and cannot be undone', which is critical behavioral info. Also notes force requirement. No annotations, so description carries full burden; largely sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences, key action first, no redundancy. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers usage, destructiveness, force requirement. Missing mention of removeVolumes parameter, but overall adequate for a removal tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers parameters fully. Description adds context for force (needed for running containers) but not for container or removeVolumes. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Remove a container' (specific verb+resource) and distinguishes from siblings by advising 'prefer stopping first', implying stop_container as an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context: 'Requires `force` to remove a running one' and recommends 'prefer stopping first'. Does not explicitly list when not to use, but offers implicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
restart_containerRestart containerC
Restart a container. This is the go-to fix for 'turn it off and on again' style requests.
| Name | Required | Description | Default |
|---|---|---|---|
| timeout | No | Seconds to wait before force-killing (default: 10). | |
| container | Yes | Container name or id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so description must cover behaviors. It lacks details on side effects (downtime, force-kill behavior), required permissions, or that restart stops then starts the container. The timeout parameter hints at force-kill but is not explained in text.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very concise (two sentences) but omits critical details. It is front-loaded with purpose but lacks structure for readability. Every sentence earns its place, but content is sparse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description should explain return values and effects. It does not mention what happens post-restart, nor does it differentiate from sibling tools like start_container or compose_restart.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, providing adequate parameter meanings (container name/id, timeout). The description adds no extra value beyond the schema, achieving baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the verb 'restart' and resource 'container'. The phrase 'go-to fix for turn it off and on again style requests' adds context but does not explicitly distinguish from siblings like stop_container or compose_restart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies use for standard rebooting scenarios but provides no explicit guidance on when not to use it, or alternatives (e.g., stop->start, compose restart). Missing context for decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_containerStart containerA
Start a stopped container. No-op if it is already running. Returns the resulting state.
| Name | Required | Description | Default |
|---|---|---|---|
| container | Yes | Container name or id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Given no annotations, the description carries the full burden. It discloses that the tool is a mutation (starts a container), that it is idempotent (no-op if running), and that it returns the resulting state. It does not detail the return format or potential side effects, but for a simple tool this is sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: one sentence covering purpose, behavior, and return. Every piece of information is essential and there is no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema or nested objects, the description adequately covers the core behavior. It addresses the no-op case and return value. Minor omissions like error cases or permissions do not significantly detract.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers the single 'container' parameter with a clear description. Schema description coverage is 100%, so the description adds no additional meaning beyond the schema. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Start' and the resource 'container'. It explicitly says it starts a stopped container, and distinguishes behavior from siblings like restart_container by noting it is a no-op if already running.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: start a stopped container. It also notes that it is a no-op if already running, which guides the agent not to use it redundantly. However, it does not explicitly mention alternatives or when not to use it compared to neighboring tools like restart_container.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stop_containerStop containerA
Gracefully stop a running container (SIGTERM, then SIGKILL after a grace period). No-op if it is already stopped.
| Name | Required | Description | Default |
|---|---|---|---|
| timeout | No | Seconds to wait before force-killing (default: 10). | |
| container | Yes | Container name or id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the two-step termination process and the no-op behavior. With no annotations, this provides adequate transparency about side effects (stopping processes, eventual kill). However, it does not specify whether the timeout is a hard wait or if the call returns before the grace period ends.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words. The first sentence states the core action and method; the second covers idempotency. Information is front-loaded and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (stop a container, two parameters), the description is largely complete. It lacks explicit mention of error conditions (e.g., container not found) or return behavior, but these are often inferred. No output schema needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%. The description adds context by linking 'grace period' to the timeout parameter, enhancing understanding beyond the schema's default value. The container parameter is self-explanatory from its name and schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the action (stop a container), the method (SIGTERM then SIGKILL after a grace period), and idempotency (no-op if already stopped). It distinguishes from siblings like restart_container or remove_container.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (to stop a container gracefully) and notes safe reuse via no-op. It does not explicitly mention when not to use or compare to alternatives, but the context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_infoSystem infoA
Summarise the Docker daemon: engine version, host OS/architecture, CPU and memory available, and how many containers/images exist. Use this to answer 'what does this server look like?'.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It discloses the exact information returned (version, OS, CPU, memory, counts) and implies it is a read-only operation. It does not mention permissions or side effects, but these are not expected for a system info tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that covers purpose, content, and usage in a concise manner. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple nature (no parameters, no output schema), the description is fully complete. It tells the user exactly what to expect and when to use it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100% (empty). The description implicitly indicates no parameters are needed by stating what it summarizes. A baseline of 4 is appropriate since no parameter description is required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool summarizes Docker daemon details (engine version, host OS/architecture, CPU/memory, container/image counts) and explicitly ties it to answering 'what does this server look like?'. It distinguishes from sibling tools like list_containers or disk_usage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear use-case: answering a system overview question. It lists the data returned but does not explicitly exclude alternative tools or mention when not to use it. However, the context signals and sibling tools make it clear this is a high-level info tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
21 tool updates
v1.0.0- First observed
about - First observed
compose_config - First observed
compose_down - First observed
compose_ps - First observed
compose_pull - First observed
compose_restart - First observed
container_logs - First observed
container_stats - First observed
deploy_stack - First observed
disk_usage - First observed
inspect_container - First observed
list_containers - First observed
list_images - First observed
list_networks - First observed
list_plugins - First observed
list_volumes - First observed
remove_container - First observed
restart_container - First observed
start_container - First observed
stop_container - First observed
system_info
TDQS
Scored across 21 tools
Each tool has a clear, distinct purpose. Compose tools (e.g., compose_config, compose_down) handle separate stack operations, and container lifecycle tools (list_containers, start_container, stop_container, etc.) are each focused on specific tasks. No two tools overlap in function.
Naming is mixed: some tools follow a verb_noun pattern (list_containers, start_container), while others are noun_verb (compose_down, container_logs) or atypical (about, disk_usage). This inconsistency may cause confusion for agents trying to predict tool names.
21 tools is well-scoped for a Docker management server. It covers container lifecycle, Compose stacks, system info, and utilities without being overly numerous or sparse.
Core container and Compose operations are covered, but notable gaps exist: no volume create/remove, no network create/remove, no image build or generic pull, and no exec/run command. This limits the ability to perform some common Docker workflows.
Maintenance
Related MCP Connectors
Your AI Agent's Infrastructure Layer. Connect Claude, Copilot, Codex, or ChatGPT to 200+ managed open source services. Start databases, pipelines, and applications through natural language.
Deploy, monitor, and manage your OpenClaw AI assistants via natural language.
Hosting for AI agents: your AI client deploys Docker apps to live HTTPS URLs over MCP.
201Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
Related MCP Servers
- AlicenseBqualityDmaintenanceEnables natural language interaction with Docker commands and operations. Supports container management, image operations, system information, and Docker Compose through conversational requests.1475 npm1MIT
- AlicenseNot gradedqualityDmaintenanceEnables natural language management of Docker containers, images, networks, and volumes with support for both local and remote Docker engines. Features automated container composition, debugging capabilities, and persistent data management through an intuitive conversational interface.GPL 3.0
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to manage Docker containers, deploy stacks, and monitor services across multiple Docker hosts from one centralized location. Supports container lifecycle management, Docker Compose operations, and infrastructure orchestration through natural language commands.6MIT
- AlicenseNot gradedqualityNot gradedmaintenanceEnables AI assistants to interact with Docker containers through safe, permission-controlled access to inspect, manage, and diagnose containers, images, and compose services with built-in timeouts and AI-powered analysis.-