Manage your Docker or Podman deployments through Komodo with AI assistants and automation tools.
Komodo MCP Server enables seamless interaction between AI assistants (like Claude, GitHub Copilot) and Komodo (Container Management Platform) for efficient container management, server orchestration, and deployment operations. The MCP-Server gives you the ability to control your Komodo-managed infrastructure by using natural language or automated workflows.
MCP server for Komodo - manage Docker containers, servers, stacks, and deployments via AI
88 Tools, 20 Categories — Full lifecycle management for containers, stacks, deployments, servers, builds, repos, procedures, actions, alerters, Docker Swarms (Komodo v2), variables, resource syncs, update history, Docker image/network/volume introspection, builders, tags and TOML export — from listing and inspecting to deploying, building, scaling and destroying.
Remote Terminal Access — Execute commands on servers, containers, deployments, and stack services with real-time output streaming, exit codes, and progress reporting.
Log Search & Analysis — Pattern-based log search across containers with configurable tail limits and match counting.
🔌 Deploy Anywhere
Multi-Transport — Streamable HTTP (stateful), HTTPS with TLS, legacy SSE, and stdio. Same server, any client.
Multi-Platform Docker — Production-ready images for amd64, arm64, arm/v7, and arm/v6 (Raspberry Pi). Non-root, multi-stage builds with tini init.
Works with Any MCP Client — Claude Desktop, VS Code / GitHub Copilot, or any MCP-compatible tool. Runs via Docker, npx, or native Node.js.
🔐 Security & Authentication
Three Auth Methods — API Key/Secret (recommended), username/password, or JWT token. All support Docker secrets via *_FILE variants.
Auth Enabled by Default — Per-user local login in HTTP mode unless explicitly disabled. The global [komodo] connection is configured once at startup (or via env vars) and used only for stdio or auth-disabled deployments.
Confirmation for Destructive Actions — Deletes, destroys, prunes, and shell execution ask the human operator for explicit approval first (MCP elicitation with a confirm checkbox). Fail-closed on clients that can't prompt; tunable via MCP_CONFIRM_DESTRUCTIVE / MCP_CONFIRM_FALLBACK.
Hardened by Default — Input validation (Zod), rate limiting, DNS rebinding protection, security headers via Helmet, and central fail-closed secret redaction: every tool result (including exec output and retrieved logs) passes the framework's scrub boundary before it reaches the client transcript — see Secret Redaction.
⚡ Reliability & Operations
Live Progress & Cancellation — Long-running operations (deploy, start, stop) report real-time progress. Cancel any operation mid-flight via AbortSignal.
Auto-Reconnection — Connection monitoring with automatic recovery and exponential backoff. Auth failures stop retries immediately.
Health & Readiness — Kubernetes-ready /health and /ready endpoints. komodo_health_check reports server version, connectivity, and auth status.
Built on mcp-server-framework — a production-ready TypeScript MCP server framework with structured logging, OpenTelemetry, and session management.
Tip: Every tool carries _meta.category (one of config, container, server, stack, deployment, build, repo, procedure, action, alerter, swarm, resource_sync, variable, update, terminal, user, docker, builder, tag, toml) and a requiredScopes array (komodo:read / komodo:operate / komodo:admin), so MCP clients and gateways can filter or gate tools by category and three-tier RBAC.
Limit the tool surface (server-side). To keep a client's tool list - and its token cost - small, prune what the server registers with three optional env vars: MCP_TOOLS_ALLOWED_CATEGORIES (category allowlist; unset -> all), MCP_TOOLS_EXCLUDED_CATEGORIES (drop whole categories), and MCP_TOOLS_EXCLUDED_TOOLS (drop tools by name, e.g. komodo_exec). Use the exact category strings above. Pruned tools are absent from tools/list and not callable. This is purely subtractive - it never exposes more and never bypasses authentication or the read-only-when-open behavior.
List/info/logs tools support cursor pagination via { cursor, page_size } (1–100, default 25) and emit _meta.page.next_cursor when more items are available. inspect, info, logs, and search_logs responses also include a session-scoped ephemeral://... resource link so large payloads can be fetched out-of-band via resources/read; pass inline_full: true to force inlining.
Quick Start
Docker Compose (Recommended for HTTP)
Deploy as a persistent HTTP server — connect from any MCP client.
mkdir komodo-mcp && cd komodo-mcp
curl -O https://raw.githubusercontent.com/MP-Tool/komodo-mcp-server/main/docker/compose.yaml
curl -O https://raw.githubusercontent.com/MP-Tool/komodo-mcp-server/main/docker/docker.env
cp docker.env .env # Edit with your credentials
docker compose up -d
Once connected, ask Claude, Copilot, or any MCP-compatible assistant in plain language — it picks the tools. The tool each prompt drives is shown on the right:
Use /mcp for Streamable HTTP or /sse for legacy SSE transport (if enabled). Adjust host and port to match your setup.
Authentication
There are two distinct layers - don't confuse them:
1. Connecting to Komodo - how the server itself talks to Komodo Core. Choose one method:
Method
Environment Variables
Best For
API Key (recommended)
KOMODO_API_KEY + KOMODO_API_SECRET
Service accounts, automation
Username / Password
KOMODO_USERNAME + KOMODO_PASSWORD
Interactive users
JWT Token
KOMODO_JWT_TOKEN
Browser-based SSO (OIDC, GitHub, Google OAuth)
KOMODO_URL is always required. All credentials also support Docker secrets via *_FILE variants
(e.g. KOMODO_API_KEY_FILE). This shared connection is used for stdio and for open (auth-disabled)
HTTP mode.
2. Users signing in to the MCP server (HTTP/HTTPS) - on by default since 1.5.0. Each person
logs in with their own Komodo username and password and gets their own session with their own
permissions. Turn it off with MCP_AUTH_ENABLED=false (an open network server is then read-only);
stdio is local and never authenticated.
For the full configuration reference (env vars, config files, Docker secrets), see the Configuration Guide.
Troubleshooting
Connection refused / the server can't reach Komodo. Check KOMODO_URL — it needs the scheme, host, and Komodo Core port (e.g. https://komodo.example.com:9120). From inside Docker, localhost points at the container, not the host — use the host's IP or a Docker network alias. Confirm nothing (firewall, reverse proxy) blocks the port.
401 Unauthorized when a client connects (HTTP). Since 1.5.0, authentication defaults on for HTTP/HTTPS, so clients must sign in (browser login against your Komodo username/password). Either complete the login, or set MCP_AUTH_ENABLED=false to run without it. A 401 after login usually means the Komodo credentials are wrong or the account is disabled. (stdio is local and never requires this.)
Tools are missing from the list. Two causes, both by design:
Read-only mode. If you disabled auth (MCP_AUTH_ENABLED=false) on an HTTP/HTTPS transport, the server is read-only for anonymous callers — every write/exec/delete tool (incl. komodo_exec) is hidden and rejected. Enable [auth] (per-user login) to get them back. Startup logs a READ-ONLY notice when this is active.
Tool-surface filter.MCP_TOOLS_ALLOWED_CATEGORIES, MCP_TOOLS_EXCLUDED_CATEGORIES, or MCP_TOOLS_EXCLUDED_TOOLS prune the registered set. Unset all three to expose everything. A bad category name is ignored with a startup warning listing the valid categories.
Disclaimer
AI tools (GitHub Copilot, Claude) are used as part of the development workflow — for code generation, architecture exploration, and documentation drafting. Every line of code and documentation is manually reviewed to ensure quality, correctness, and compliance with established engineering standards.
# Clone and install
git clone https://github.com/MP-Tool/komodo-mcp-server.git
cd komodo-mcp-server
npm install
# Build and run
npm run build
npm start
Komodo v2 (Komodo Core 2.x; the server refuses version-sensitive tools like komodo_exec on older cores)
Docker (for containerized deployment) or Node.js 22+ (for native installation)
Valid Komodo credentials (API Key/Secret, Username/Password, or JWT Token)
Security
Report security vulnerabilities via GitHub's Private Vulnerability Reporting (see SECURITY.md).
Destructive-action confirmation: By default, destructive tools (all *_delete tools, komodo_exec, stack/deployment destroy, server stop_all/prune_*/delete_*, swarm remove_*, and procedure/action/resource-sync run) require the human operator to approve an MCP elicitation prompt — "accept" plus a ticked confirm checkbox — before anything executes. Clients that cannot prompt (no elicitation support, or stateless HTTP mode) are refused by default. Tune with MCP_CONFIRM_FALLBACK=allow (execute with a warning on such clients) or MCP_CONFIRM_DESTRUCTIVE=false (disable the feature) — relevant for stdio setups whose client lacks elicitation support.
Secret redaction: Tool results are persisted to the MCP client transcript and forwarded to the model provider, so every tool result passes the framework's central, fail-closed scrub boundary before it leaves the process — structured resource config (env blocks, webhook_secret, passkey), alerter webhook URLs, exec output, and container/build/update logs, for inline payloads and offloaded resource links alike. On top, is_secret variable values are always masked and stacks drop the post-interpolation deployed_config/deployed_contents. Best-effort defence-in-depth: heuristics catch deterministic secret shapes, not arbitrary material. Intended exception: komodo_user_create_api_key returns its one-time secret unredacted. See Secret Redaction.
