high
MCP server container runs --privileged
The server runs in Docker with --privileged.
Why it matters
A privileged container can reach the host's devices and kernel features, which defeats the point of containing the server.
How to fix it
Remove --privileged and add only the specific capability the server needs, if any.
Before
{
"mcpServers": {
"tools": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"--privileged",
"acme/mcp-tools:1.4.0"
]
}
}
}After
{
"mcpServers": {
"tools": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"acme/mcp-tools:1.4.0"
]
}
}
}Illustrative configs. The checker flags the “before” version with this finding and not the “after” version.
Other checks
- Secret written into an MCP config
- Secret passed as a command-line argument
- Secret inside an MCP server URL
- Remote MCP server over unencrypted http
- Remote MCP server with no credentials configured
- Unpinned MCP server package or image
- MCP server installs without asking (npx -y)
- MCP server container shares the host network
- Broad host folder or Docker socket mounted into an MCP container
- MCP filesystem server with access to a very broad path
- MCP server launched through a shell
- MCP server that can run shell commands
- MCP tools auto-approved or always allowed