abir-taheer/mcp-runner

A secure, isolated platform for running MCP (Model Context Protocol) servers in Docker containers with GVisor runtime. Built with NestJS and TypeScript, this service provides ephemeral, multi-tenant deployments of MCP servers with robust security isolation.

Motivation

This project solves key challenges when integrating with MCP servers:

• Security: Run untrusted MCP servers in isolated containers that cannot access host resources or communicate with each other
• Multi-tenancy: Multiple clients can safely connect to the same MCP server instance or you can set up multiple isolated instances for different users
• Ephemeral deployments: Complete cleanup of all deployment data (configs, logs, network, users) when deleted
• Legacy transport support: Connect to local MCP servers and expose them via Streamable HTTP or SSE endpoints
• Resource management: Enforce memory and CPU limits on shared infrastructure

Perfect for developers building applications that need to integrate with various MCP servers, especially untrusted or locally-running ones like Wikipedia MCP.

License

Copyright © 2025 Tangier AI, Inc.

Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

How It Works

The secure MCP runner operates through several layers of isolation:

1. Container Isolation: Each MCP server runs in its own Docker container with GVisor runtime (runsc)
2. Network Isolation: Containers are placed in isolated bridge networks that prevent inter-container communication
3. User Isolation: Each container runs as a unique unprivileged Linux user with minimal permissions
4. Resource Limits: Memory and CPU constraints prevent resource exhaustion
5. Transport Standardization: All MCP servers are exposed via Streamable HTTP/SSE endpoints for remote access regardless of their original transport (includes STDIO)

Security Model

Security is enforced through multiple layers:

• GVisor Runtime: All containers use runsc runtime for kernel-level isolation
• Capability Dropping: Containers drop dangerous capabilities (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE)
• Security Options: no-new-privileges, apparmor:docker-default, seccomp:unconfined
• Network Isolation: Networks are created for each deployment with inter-container communication disabled
• DNS Control: Containers use only Google (8.8.8.8) and Cloudflare (1.1.1.1) DNS servers