Container MCP Server

Container MCP server is a locally run integration for AI assistants that speak the Model Context Protocol. A podman ubuntu 24.04 container that serves a MCP server; with file, code execution, bash shell, knowledgebase, and more.

What you get

A secure, container-based implementation of the Model Context Protocol (MCP) for executing tools on behalf of large language models.

Container-MCP provides a sandboxed environment for safely executing code, running commands, accessing files, and performing web operations requested by large language models. It implements the MCP protocol to expose these capabilities as tools that can be discovered and called by AI systems in a secure manner.

• Multi-layered Security —
• Container isolation using Podman/Docker
• AppArmor profiles for restricting access
• Firejail sandboxing for additional isolation
• Resource limits (CPU, memory, execution time)
• Path traversal prevention

What the assistant can call

Once Container is connected, these are the calls the assistant has available:

• system_run_command — The system_run_command tool exposed by this server
• system_run_python — The system_run_python tool exposed by this server
• system_env_var — The system_env_var tool exposed by this server
• health_check — The health_check tool exposed by this server
• fs_read — The fs_read tool exposed by this server
• fs_write — The fs_write tool exposed by this server
• fs_list — The fs_list tool exposed by this server
• fs_delete — The fs_delete tool exposed by this server
• fs_move — The fs_move tool exposed by this server
• fs_apply_diff — Applies a unified diff patch to a file in the sandbox filesystem
• web_search — The web_search tool exposed by this server
• web_scrape — The web_scrape tool exposed by this server

Configuration and credentials

You will need 2 environment variables: MCP_PORT, SANDBOX_ROOT. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

Setting it up

Setup follows the usual MCP pattern — install or clone the server, register it in your client's configuration file, restart the client.

Choosing this one

Among the browser automation options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Container's toolset — system_run_command, system_run_python, system_env_var and 11 more — is a fair guide to whether it matches your workflow. It is maintained by 54rt1n; worth a glance at recent repository activity before you build anything load-bearing on it.

SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.

Before you rely on it

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Container.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the container mcp server does with a few real requests.