38 tools for everyday container work.
MCP Docker gives your agent 38 tools for everyday container work, grouped here by what you do with them.
The tools operate on the Docker Engine you choose with DOCKER_HOST. Several tools take a discriminator argument that picks the action, such as container_control with action and system with query. Read tools that return lists accept a fields argument to return only the fields you name. This page lists the tools that matter for each job; the full parameter lists, including options the schema does not list, are in the tools reference.
Create, start, stop and remove containers.
| Tool | Use it to | Key parameters |
|---|---|---|
run_container | Create a container and, by default, start it. It is recorded as owned by your connection, so you can manage and clean it up later; folders are shared as bind mounts. | image (required), name, command, env, ports, mounts, network_mode, restart_policy, auto_remove, resources (cpu_limit, memory_mb and others), tags, start, keep |
container_control | Start, stop, restart, kill, pause or unpause a container with one tool. You can act only on containers you created or have taken over. | action and container_id (required), timeout, signal |
remove_container | Remove a container, optionally forcing it or deleting its volumes too. | container_id (required), force, remove_volumes |
wait_container | Wait for a container to stop and get its exit code. It returns at once for a container that has already stopped. | container_id (required) |
list_containers | List the containers managed by your kind of caller, stopped ones included. This is wider than your own connection: it includes containers from every connection of the same kind of client, but not containers this service does not manage. | filters, fields |
inspect_container | Read the full record of one container, or only the fields you pick. | container_id (required), fields |
Why: a container you start is yours to control and remove; one you did not start needs an explicit adopt first. Verify container state with inspect_container and published bindings with container_port; check resource usage with container_stats and application readiness separately. Ports published without host_ip bind on every host interface, so pass 127.0.0.1 when a service should stay local; keep: true on run_container, build_image and create_volume excludes the resource from automatic cleanup in the managed environment; the default is off. Check it with inspect_volume. A successful new adoption reports whether the container was already protected.
Logs, statistics, processes, commands and files.
| Tool | Use it to | Key parameters |
|---|---|---|
container_logs | Read a container's output. In follow mode it gathers five seconds of output and returns one reply, not a live feed. Give exact times, not relative ones such as ten minutes ago. | container_id (required), tail, since, until (Unix seconds as strings), timestamps, follow |
container_stats | Read a container's CPU, memory and network use. In streaming mode it gathers up to a minute of samples and returns them together. | container_id (required), stream, duration_seconds |
container_top | List the processes running inside a container. | container_id (required), ps_options |
container_port | See which container ports are published and where they are reachable. | container_id (required), private_port |
exec_command | Run a command inside a running container and get its output, error output and exit code. It is not interactive (no terminal, no input), it runs as the container's own user, and a failing command still comes back as a completed result. | container_id and command as an array (required), workdir, env |
container_copy | Copy files between the machine running the service and a container, in either direction. The host side is the server’s filesystem; choose approved paths and give its account the required permissions. | direction (to or from), container_id, host_path, container_path (all required) |
Why: read logs and statistics before changing anything. For a real interactive shell use MCP Console, and approve the exact container_copy source and destination before copying; an existing destination may be replaced.
Pull, build, tag, inspect and push images.
| Tool | Use it to | Key parameters |
|---|---|---|
pull_image | Pull an image from a registry. Only registries on the approved list are accepted. | image (required), auth (username, password, server, for this one call) |
build_image | Build an image from a folder that holds its build files. Supply one tag; add additional tags with tag_image. | context_path and tags (required), dockerfile, build_args, target, platform, no_cache, keep |
push_image | Push an image to an approved registry. | image (required), auth |
tag_image | Add another tag to an existing image. | image, tag (required) |
list_images / inspect_image | List the images on the host or read one in detail. Images are not tied to your connection, so every image on the host is visible. | filters, fields; image (required) for inspect |
remove_image | Remove an image from the host. | image (required), force, no_prune |
Why: registry credentials go in auth for one call; MCP Docker does not persist them. Protect client request history and diagnostic capture as well. Because images belong to the host rather than to a connection, removing or tagging one affects everyone who uses that daemon.
Connect containers and keep data.
| Tool | Use it to | Key parameters |
|---|---|---|
create_network | Create a network so containers can talk to each other, choosing its driver, address range or whether it is internal. | name (required), driver, internal, subnet, gateway, tags |
connect_network / disconnect_network | Attach a container to a network or detach it. | network and container (required), aliases; force |
list_networks / inspect_network / remove_network | List networks, read one in detail or remove one. | network (required), filters, fields |
create_volume | Create a named volume for data that should outlive a container. | name (required), driver, driver_opts, tags, keep |
list_volumes / inspect_volume / remove_volume | List volumes, read one in detail or remove one. | volume (required), filters, fields, force |
Why: an internal network requests restricted external connectivity; a volume keeps data that should outlive a container. Removing a volume deletes its data, so confirm with the person before asking for it.
Adopt, find, clean up and watch the daemon.
| Tool | Use it to | Key parameters |
|---|---|---|
adopt | List containers you could take over, or take ownership of one so you can manage it. A container owned by another session can be adopted too; networks and volumes cannot. | action (container or list), container_id, resource_type |
list_by_tags | Find resources by the tags you gave them. A resource matches only if it has every tag you list. | tags (required), resource_type |
cleanup_session | Attempt removal of this connection’s tracked containers, networks and volumes, including adopted containers; review errors and remaining inventory. It is available from a client connection, not from the command line. | force (default true) |
prune | Reclaim space from stopped containers, unused images or unused volumes. What is eligible is decided by the service's own labels, not by adoption. | target (containers, images, volumes, all), all, volumes |
system | Read information about the Docker host, its versions or its disk use. | query (info, version, df) |
stream_events | Collect a batch of Docker daemon events over a period. You get one reply, not a live stream. | since, until, filters, follow, duration_seconds |
get_info / get_session_info / get_health | Read the service's own version, this connection's state and its health. | verbose; none; detailed |
Why: plan retention before ending a task. After preserving required output, use granular removal or deliberate cleanup_session for disposable tracked resources. Disconnecting removes nothing, and cleanup also includes adopted containers and tracked volumes. Use adopt only after coordinating with the existing controller.
What to expect when a call fails.
A tool failure comes back as a tool error with a message. The limits that matter:
| Limit | Value |
|---|---|
| Registries | Pulls and pushes only to ALLOWED_REGISTRIES, docker.io and ghcr.io by default; a registry's port is not a separate boundary, and base images a build downloads are not checked |
| Ownership records | Cleanup and adoption rely on the service's state file; set an absolute STATE_FILE_PATH, because memory mode forgets them between calls |
| Containers | MAX_CONTAINERS_PER_SESSION, 100 by default, is a count check before creation |
| One call | 60 seconds per served call, fixed; the longer operation deadlines (120 seconds, 300 seconds for pull, build, push and wait) cannot extend it, and a timed-out call does not stop or undo the work |
| Daemon connection | Unix socket or tcp:// address; reach a remote daemon through a tunnel you operate |
| Ownership | Control and removal need a container you created or adopted; list tools show everything of the calling kind |
| Monitoring | Off unless ENABLE_METRICS is set in the service's environment; enable it only on a network you control, and restrict access to the port |
An error naming a different session requires checking the intended container and coordinating with its controller before considering adoption. See Troubleshooting.