Portainer MCP Docker

Dockerized version of thePortainer MCP Serverfor easy deployment.

Wraps the MCP server withmcp-proxyto expose it over Streamable HTTP. Supports bearer token authentication so the endpoint is not publicly accessible. Best for remote access, e.g., connecting from Claude Web to a Portainer instance on your server.

- A runningPortainerinstance
- A Portainer API access token (generated from the Portainer UI underMy Account > Access Tokens)
- Docker and Docker Compose

docker pull ghcr.io/serraniel/portainer-mcp-docker:latest docker run -i --rm ghcr.io/serraniel/portainer-mcp-docker:latest \ -server your-portainer:9443 \ -token your-api-token

docker run -i --rm \ --add-host=host.docker.internal:host-gateway \ ghcr.io/serraniel/portainer-mcp-docker:latest \ -server host.docker.internal:9443 \ -token your-api-token

{ "mcpServers": { "portainer": { "command": "docker", "args": [ "run", "-i", "--rm", "--add-host=host.docker.internal:host-gateway", "ghcr.io/serraniel/portainer-mcp-docker:latest", "-server", "host.docker.internal:9443", "-token", "your-api-token" ] } } }

Replacehost.docker.internal:9443with your Portainer's actualhostname:portif it runs on a different machine.

{ "mcpServers": { "portainer": { "command": "docker", "args": [ "run", "-i", "--rm", "--add-host=host.docker.internal:host-gateway", "ghcr.io/serraniel/portainer-mcp-docker:latest", "-server", "host.docker.internal:9443", "-token", "your-api-token" ] } } }

-

Portainer API token(PORTAINER_TOKEN) — authenticates the MCP server against your Portainer instance. Generate one in the Portainer UI underMy Account > Access Tokens > Add access token.

MCP bearer token(API_ACCESS_TOKEN) — protects the HTTP endpoint so only authorized MCP clients can connect. This is a secret you create yourself. Generate a secure random token:

Use the output as yourMCP_API_TOKENin the.envfile and configure the same value in your MCP client'sAuthorization: Bearer <token>header.

docker pull ghcr.io/serraniel/portainer-mcp-docker:http docker run -d --rm \ -p 8080:8080 \ -e PORTAINER_SERVER=your-portainer:9443 \ -e PORTAINER_TOKEN=your-portainer-api-token \ -e API_ACCESS_TOKEN=your-mcp-bearer-token \ ghcr.io/serraniel/portainer-mcp-docker:http

services: portainer: image: portainer/portainer-ce:latest restart: always ports: - "9443:9443" volumes: - /var/run/docker.sock:/var/run/docker.sock - portainer_data:/data portainer-mcp: image: ghcr.io/serraniel/portainer-mcp-docker:http restart: always ports: - "8080:8080" environment: - PORTAINER_SERVER=portainer:9443 - PORTAINER_TOKEN=${PORTAINER_TOKEN} - API_ACCESS_TOKEN=${MCP_API_TOKEN} # Optional: # - PORTAINER_READ_ONLY=true # - PORTAINER_DISABLE_VERSION_CHECK=true # - MCP_PORT=8080 # - MCP_HOST=0.0.0.0 volumes: portainer_data:

PORTAINER_TOKEN=your-portainer-api-token MCP_API_TOKEN=your-mcp-bearer-token

Claude Web / Claude Desktop (Remote URL)

Configure your MCP client to connect to the HTTP endpoint:

- URL:http://your-server:8080/sse
- Authorization:Bearer token (theMCP_API_TOKENyou configured)

{ "mcpServers": { "portainer": { "type": "url", "url": "http://your-server:8080/sse", "headers": { "Authorization": "Bearer your-mcp-bearer-token" } } } }

All flags from the upstream binary are supported:

Image tags follow the formatv<upstream>-<build>:

- v0.7.0-1- First build of upstream v0.7.0 (stdio)
- v0.7.0-1-http- Same version, HTTP variant
- v0.7.0-2- Rebuild (e.g., base image security update)
- latest- Most recent stdio build
- http- Most recent HTTP build

For full documentation on the Portainer MCP server capabilities, tools, and Portainer version compatibility, see theupstream README.

This project is licensed under theEuropean Union Public License v1.2(EUPL-1.2).

The upstreamportainer-mcpbinary is licensed under theZlib License.

Agent-ready global image CDN that AI agents can install and operate through MCP.