Docker MCP Sandbox
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| DOCKER_HOST | No | Explicit Docker host configuration for remote or custom Docker socket connections. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| create_sandboxB | Spawns a new isolated Docker container sandbox with a dedicated /workspace directory, resource quotas, and bash/sh environment. |
| write_fileA | Safely creates or overwrites a file at a relative path inside the sandbox /workspace directory. Includes path traversal security checks. |
| read_fileA | Safely reads the contents of a file inside the sandbox /workspace directory. Enforces path traversal security checks. |
| execute_commandA | Executes a shell command inside the sandbox container at /workspace with timeout enforcement (default 30s) and captures demuxed stdout, stderr, and exitCode. |
| destroy_sandboxA | Stops and permanently removes an ephemeral Docker sandbox container and frees associated resources. |
| list_sandboxesA | Lists all active Docker sandbox instances managed by this MCP server. |
| git_initB | Initializes a Git repository in the sandbox workspace and sets default author configs. |
| git_statusB | Shows the working tree status in the sandbox repository. |
| git_diffC | Shows changes between commits, commit and working tree, etc. |
| git_commitC | Stages specified files and creates a Git commit in the sandbox. |
| git_logC | Returns recent commit history in the sandbox repository. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Each tool maps to a distinct resource+action pair: sandbox lifecycle (create/list/destroy), workspace file IO (read/write), command execution, and a clearly delimited git_* family. The only soft overlap is that execute_command can perform anything the git_* tools do, so an agent may bypass the structured git wrappers, but the intent of each tool is still clear.
Ten tools follow a clean verb_noun snake_case pattern (create_sandbox, write_file, read_file, execute_command, destroy_sandbox, list_sandboxes), and the git group consistently uses a shared git_ prefix. The git_ prefix group is noun_verb rather than verb_noun, a minor convention shift but internally predictable and readable.
Eleven tools is well within a comfortable range and each earns its place: five sandbox/file primitives plus five git operations that provide structured, safer alternatives to raw shell calls. No redundant or filler tools are present.
Sandbox lifecycle is fully covered (create, list, destroy) and the git surface covers init/status/diff/commit/log, which handles the core workflow. File handling lacks delete_file and list_directory/preview operations, and git lacks branching/checkout, but an agent can work around these via execute_command.