Running MCP Servers in a Docker Sandbox

The Model Context Protocol (MCP) has been one of the biggest talking points in AI tooling this year. But because of its client/server architecture, users are usually instructed to run MCP servers directly on their local development machines.

Common ways to run MCP servers include stdio runners like npx (npm) and uvx (Python/uv), alongside Docker or direct HTTP (SSE/streaming). However, invoking arbitrary commands with npx and uvx directly on your host machine carries real risk. If a malicious or poisoned package slips in, an attacker gets read access to your local files and environment secrets. Invariant highlighted this danger well in their write-up: MCP Security Notification: Tool Poisoning Attacks.

I asked ChatGPT to compile prominent npm and PyPI supply chain attacks over the past five years. The list is sobering:

Right around the time I was venting about this on Twitter, a friend posted about running into an active supply chain attack incident:

Fortunately, @TBXark pointed me to his project: MCP Proxy, which lets you isolate MCP servers inside Docker containers. His original motivation was hosting MCP servers on remote boxes to offload local CPU cycles and let mobile clients connect. But Docker’s filesystem and process isolation also makes it an ideal security sandbox.

MCP Proxy runs your MCP servers inside Docker and exposes them via Server-Sent Events (SSE). Your local MCP client connects to the proxy over SSE, meaning npx and uvx run inside an isolated container rather than on your workstation. (Hosting it on an overseas VPS also happens to solve package download latency).

One minor caveat: inside the container, processes can still read /config/config.json. I opened a feature request with the author to tighten permissions (e.g. chmod 400 on configs, and running npx/uvx as an unprivileged nobody user).

Running MCP Proxy

If you have a VPS running Docker, start the proxy with:

docker run -d -p 9090:9090 -v /path/to/config.json:/config/config.json ghcr.io/tbxark/mcp-proxy:latest

If you don’t have a spare VPS, you can run it on claw.cloud ($5 monthly free tier for GitHub accounts older than 180 days).

Because Claw limits root container storage, redirect the npm and uv cache paths to an attached volume so the container doesn’t run out of disk space:

UV_CACHE_DIR=/cache/uv
npm_config_cache=/cache/npm

Attach a 10GB volume to /cache. My setup uses: 0.5 CPU cores, 512MB RAM, and 10GB disk:

Configuring MCP Proxy

Mount your config at /config/config.json. (See the official documentation for options).

Here is my setup:

{
    "mcpProxy": {
        "baseURL": "https://mcp.miantiao.me",
        "addr": ":9090",
        "name": "MCP Proxy",
        "version": "1.0.0",
        "options": {
          "panicIfInvalid": false,
          "logEnabled": true,
          "authTokens": [
            "miantiao.me"
          ]
        }
    },
    "mcpServers": {
        "github": {
            "command": "npx",
            "args": [
                "-y",
                "@modelcontextprotocol/server-github"
            ],
            "env": {
                "GITHUB_PERSONAL_ACCESS_TOKEN": "<YOUR_TOKEN>"
            }
        },
        "fetch": {
            "command": "uvx",
            "args": [
                "mcp-server-fetch"
            ]
        },
        "amap": {
            "url": "https://mcp.amap.com/sse?key=<YOUR_TOKEN>"
        }
    }
}

Connecting an MCP Client

Taking ChatWise connecting to the fetch server as an example: select the SSE transport and enter the proxy endpoint URL:

Simple enough. Once ChatWise ships its mobile apps, this SSE proxy setup means they can connect to MCP servers from phones and tablets without needing local runtimes: