abir-taheer/mcp-runner

GVisor 런타임을 가진 Docker 컨테이너에서 MCP(모델 Context Protocol) 서버를 실행하는 안전한 분리형 플랫폼. NestJS 및 TypeScript를 내장한 이 서비스는 강력한 보안 고립을 가진 MCP 서버의 ephemeral, multi-tenant 배포를 제공합니다.

동기 부여

이 프로젝트는 MCP 서버와 통합 할 때 중요한 과제를 해결합니다.

• Security: 호스트 리소스에 액세스하거나 서로 통신할 수없는 고립 된 컨테이너에서 MCP 서버를 실행
• Multi-tenancy: 다중 클라이언트는 안전하게 동일한 MCP 서버 인스턴스에 연결하거나 다른 사용자를 위한 다수 고립된 인스턴스를 설치할 수 있습니다
• **Ephemeral 배포 **: 삭제할 때 모든 배포 데이터 (configs, logs, network, users)의 완전한 정리
• **Legacy 수송 지원 **: 로컬 MCP 서버에 연결하고 스트리밍 가능한 HTTP 또는 SSE 엔드포인트를 통해 노출
• ** 자원 관리**: 공유 인프라의 메모리 및 CPU 한계 강화

다양한 MCP 서버와 통합해야하는 개발자 구축 응용 프로그램에 대한 완벽한, 특히 Wikipedia MCP와 같은 로컬 실행 하나.

라이센스

저작권 © 2025 Tangier AI, Inc.

Apache License 하에 라이센스, 버전 2.

A secure, isolated platform for running MCP (Model Context Protocol) servers in Docker containers with GVisor runtime. Built with NestJS and TypeScript, this service provides ephemeral, multi-tenant deployments of MCP servers with robust security isolation.

Motivation

This project solves key challenges when integrating with MCP servers:

• Security: Run untrusted MCP servers in isolated containers that cannot access host resources or communicate with each other
• Multi-tenancy: Multiple clients can safely connect to the same MCP server instance or you can set up multiple isolated instances for different users
• Ephemeral deployments: Complete cleanup of all deployment data (configs, logs, network, users) when deleted
• Legacy transport support: Connect to local MCP servers and expose them via Streamable HTTP or SSE endpoints
• Resource management: Enforce memory and CPU limits on shared infrastructure

Perfect for developers building applications that need to integrate with various MCP servers, especially untrusted or locally-running ones like Wikipedia MCP.

License

Copyright © 2025 Tangier AI, Inc.

Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

How It Works

The secure MCP runner operates through several layers of isolation:

1. Container Isolation: Each MCP server runs in its own Docker container with GVisor runtime (runsc)
2. Network Isolation: Containers are placed in isolated bridge networks that prevent inter-container communication
3. User Isolation: Each container runs as a unique unprivileged Linux user with minimal permissions
4. Resource Limits: Memory and CPU constraints prevent resource exhaustion
5. Transport Standardization: All MCP servers are exposed via Streamable HTTP/SSE endpoints for remote access regardless of their original transport (includes STDIO)

Security Model

Security is enforced through multiple layers:

• GVisor Runtime: All containers use runsc runtime for kernel-level isolation
• Capability Dropping: Containers drop dangerous capabilities (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE)
• Security Options: no-new-privileges, apparmor:docker-default, seccomp:unconfined
• Network Isolation: Networks are created for each deployment with inter-container communication disabled
• DNS Control: Containers use only Google (8.8.8.8) and Cloudflare (1.1.1.1) DNS servers