Run MCP Server in a Docker sandbox

MCP is a hot protocol in the AI development industry this year, but its Client/Server (C/S) architecture requires users to run the MCP Server locally.

Common ways to run MCP Server include stdio methods like npx (NPM ecosystem), uvx (Python ecosystem), Docker, and HTTP (SSE/Streaming) methods. However, running commands with npx and uvx carries significant risks. Accidentally executing a malicious package could lead to sensitive data exposure, posing a major security threat. For details, you can refer to Invariant’s article MCP Security Notification: Tool Poisoning Attacks.

As a software industry professional, I have a high degree of concern for security. I asked ChatGPT to compile a list of NPM and PyPI supply chain attack incidents from the past 5 years, and it was chilling.

I complained a bit on Twitter, and while complaining, I saw a tweet from a friend who had just encountered a supply chain attack incident.

Fortunately, @TBXark recommended his MCP Proxy project, which makes it very convenient to run MCP Server in Docker. His initial goal was to run MCP Server on a server to reduce client load and facilitate mobile client calls. However, Docker’s inherent isolation features perfectly aligned with my requirement for a sandbox.

MCP Proxy runs MCP Servers in Docker and converts the protocol to MCP SSE, allowing users to make all calls via the SSE protocol from the MCP client. This can significantly reduce the risk of arbitrary file reading caused by directly running npx and uvx. If deployed on an overseas server, it can also help solve network issues.

However, it is currently still possible to read the /config/config.json configuration file of MCP Proxy, but the risk is manageable. I have also raised a feature request with the developer to configure the config file with 400 permissions and run the npx and uvx commands as the nobody user. If this can be implemented, it will perfectly solve the arbitrary file reading issue.

Running MCP Proxy

If you have your own VPS with Docker deployed, you can use the following command to run MCP Proxy.

docker run -d -p 9090:9090 -v /path/to/config.json:/config/config.json ghcr.io/tbxark/mcp-proxy:latest

If you don’t have your own VPS, you can use the free container service provided by claw.cloud ($5 credit per month, GitHub registration must be older than 180 days).

Since Claw has container size limitations, we need to use the following environment variables to configure the cache directories for npx and uvx to prevent container crashes.

UV_CACHE_DIR=/cache/uv
npm_config_cache=/cache/npm

Simultaneously mount 10GB of storage under the /cache path. Refer to my configuration: 0.5c CPU, 512M Memory, 10G Disk.

The final configuration is as follows:

Configuring MCP Proxy

The configuration file needs to be mounted at the /config/config.json path. For the complete configuration, please refer to https://github.com/TBXark/mcp-proxy?tab=readme-ov-file#configurationonfiguration.

Below is my configuration, for your reference.

{
    "mcpProxy": {
        "baseURL": "https://mcp.miantiao.me",
        "addr": ":9090",
        "name": "MCP Proxy",
        "version": "1.0.0",
        "options": {
          "panicIfInvalid": false,
          "logEnabled": true,
          "authTokens": [
            "miantiao.me"
          ]
        }
    },
    "mcpServers": {
        "github": {
            "command": "npx",
            "args": [
                "-y",
                "@modelcontextprotocol/server-github"
            ],
            "env": {
                "GITHUB_PERSONAL_ACCESS_TOKEN": "<YOUR_TOKEN>"
            }
        },
        "fetch": {
            "command": "uvx",
            "args": [
                "mcp-server-fetch"
            ]
        },
        "amap": {
            "url": "https://mcp.amap.com/sse?key=<YOUR_TOKEN>"
        }
    }
}

Calling MCP proxy

Taking ChatWise calling fetch as an example, just configure the SSE protocol directly.

Isn’t it simple? When ChatWise releases its mobile version, calling it this way will also be fully usable.