Skip to main content
hc
Submit
mcpSource-backedReview first Safety ✓ Privacy ✓

Portainer MCP Server for Claude

Manage Docker and Kubernetes infrastructure from Claude — list environments, inspect containers, manage GitOps workflows, troubleshoot resources, and proxy Docker/K8s API calls — with the official Portainer MCP server generated from the Portainer OpenAPI spec.

by Portainer·added 2026-06-18·
Claude CodeCodexCursorClaude Desktop
HarnessClaude CodeCodexCursorClaude Desktop
Review first — review before installing

Open the source and read safety notes before installing.

Safety notes

  • The server exposes the full Portainer REST API — including container start/stop/delete, stack deployment, and Kubernetes resource management.
  • The API proxy tools forward requests directly to your Docker/Kubernetes API — review before executing any destructive operations.
  • For team deployments over HTTP, the container requires TLS (either BYO certificates or a TLS-terminated reverse proxy) — do not expose plaintext on the public internet.

Privacy notes

  • Container names, environment configurations, Docker/Kubernetes resource details, and GitOps credentials from your Portainer instance are surfaced in Claude's context.
  • Your Portainer API key grants the same access as your Portainer user account — treat it as a secret.

Prerequisites

  • A running Portainer instance (CE or Business Edition).
  • A Portainer API key: My Account → Access tokens → Add access token.
  • Python with `uv` installed: `pip install uv` or `brew install uv`.
  • Match the MCP server minor version to your Portainer instance minor version (e.g., `mcp-portainer~=2.42.0` for Portainer 2.42.x).
  • Set `PORTAINER_TLS_VERIFY=0` if your Portainer instance uses self-signed TLS certificates.

Schema details

Install type
cli
Troubleshooting
No
Source repository stats
Scope
Source repo
Collection metadata
Estimated setup
10 minutes
Difficulty
intermediate
Tool listing metadata
Full copyable content
{
  "mcpServers": {
    "portainer": {
      "command": "uvx",
      "args": ["--from", "mcp-portainer~=2.42.0", "mcp-portainer"],
      "env": {
        "PORTAINER_URL": "https://portainer.example.com",
        "PORTAINER_API_KEY": "ptr_xxxxx"
      }
    }
  }
}

About this resource

Overview

The Portainer MCP Server is the official Model Context Protocol server from Portainer, the container management platform. Generated directly from the Portainer OpenAPI specification via FastMCP, it exposes the full Portainer REST API as MCP tools — environments, containers, stacks, GitOps, Kubernetes resources, and Docker/K8s API proxy access. Supports both single-user stdio mode via uvx and multi-user container deployment. Licensed under MIT.

Match the MCP server minor version to your Portainer instance (e.g., mcp-portainer~=2.42.0 for Portainer 2.42.x).

Key capabilities

  • Environments — list and inspect Docker and Kubernetes environments managed by Portainer.
  • Container management — list, inspect, start/stop/restart containers; view logs.
  • GitOps workflows — review and manage GitOps stack configurations.
  • Kubernetes resources — inspect namespaces, pods, services, and deployments.
  • API proxy — proxy requests directly to the underlying Docker or Kubernetes API of any Portainer-managed environment for advanced troubleshooting.
  • Team deployment — deploy as a container with a shared gate secret and per-user Portainer API keys for multi-user access.

How it compares

Server Docker/K8s environments GitOps API proxy Multi-user Auth
Portainer MCP Yes Yes Yes Yes API key
Docker MCP Docker only No Partial No Socket
Kubernetes MCP K8s only No No No kubeconfig
Rancher MCP Yes No No No API key

Portainer's API proxy capability is unique — it lets Claude make arbitrary Docker and Kubernetes API calls through Portainer's authenticated proxy, enabling deep troubleshooting without direct socket or cluster access.

Installation

Single user (stdio via uvx)

claude mcp add portainer \
  -e PORTAINER_URL=https://portainer.example.com \
  -e PORTAINER_API_KEY=ptr_xxxxx \
  -- uvx --from "mcp-portainer~=2.42.0" mcp-portainer

Create an API key in Portainer: My Account → Access tokens → Add access token.

Team deployment (container via HTTP)

TOKEN=$(openssl rand -hex 32)
docker run -d --name portainer-mcp -p 17717:17717 \
  -v /etc/portainer-mcp/tls:/tls:ro \
  -e PORTAINER_URL=https://portainer.example.com \
  -e PORTAINER_MCP_AUTH_TOKEN="$TOKEN" \
  -e PORTAINER_MCP_ALLOWED_HOSTS=mcp.example.com:17717 \
  -e PORTAINER_MCP_TLS_CERT=/tls/cert.pem \
  -e PORTAINER_MCP_TLS_KEY=/tls/key.pem \
  portainer/portainer-mcp:2.42

claude mcp add portainer --transport http https://mcp.example.com:17717/mcp \
  --header "Authorization: Bearer <gate-token>" \
  --header "X-Portainer-API-Key: <ptr_user_key>"

Requirements

  • A running Portainer instance with API token authentication.
  • Python with uv installed.
  • An MCP client (Claude Code or Claude Desktop).
  • Minor version match between mcp-portainer and your Portainer instance.

Security

  • Use least-privilege API keys for each user.
  • For team deployments, always use TLS (BYO certificates or reverse proxy) — never expose the container directly on plaintext in production.
  • The PORTAINER_MCP_ALLOWED_HOSTS allowlist prevents DNS-rebinding attacks.

Source Verification Notes

Verified on 2026-06-18:

  • Official GitHub repository portainer/portainer-mcp (MIT) documents the mcp-portainer pip package, PORTAINER_URL/PORTAINER_API_KEY/PORTAINER_TLS_VERIFY configuration, the version-matching requirement, the Claude Code claude mcp add install command, the Docker container deployment mode with PORTAINER_MCP_AUTH_TOKEN/PORTAINER_MCP_ALLOWED_HOSTS, and the HTTP team deployment pattern with per-user X-Portainer-API-Key headers.
  • Claude Code MCP documentation at code.claude.com/docs/en/mcp describes the stdio and HTTP connector patterns used above.
#portainer#docker#kubernetes#containers#gitops#infrastructure#devops

Source citations

Add this badge to your README

Show that Portainer MCP Server for Claude is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/mcp/portainer-mcp-server.svg)](https://heyclau.de/entry/mcp/portainer-mcp-server)

How it compares

Portainer MCP Server for Claude side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

FieldPortainer MCP Server for Claude

Manage Docker and Kubernetes infrastructure from Claude — list environments, inspect containers, manage GitOps workflows, troubleshoot resources, and proxy Docker/K8s API calls — with the official Portainer MCP server generated from the Portainer OpenAPI spec.

Open dossier 		Fly.io MCP Server for Claude

Manage Fly.io applications, machines, volumes, secrets, certificates, and organizations from Claude — with the official Fly.io MCP server built into the flyctl CLI.

Open dossier 		Argo CD MCP Server

Argo Project Labs MCP server for connecting Claude to Argo CD applications, clusters, managed resources, workload logs, events, sync operations, and resource actions through stdio or HTTP stream transports.

Open dossier 		ConfigCat MCP Server for Claude

Manage ConfigCat feature flags from Claude — create, update, and delete flags and targeting rules, manage environments, find and clean up stale flags, and audit change history — with the official ConfigCat MCP server and its 52 tools for the full ConfigCat Management API.

Open dossier
Trust
Install riskReview firstReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
Categorymcpmcpmcpmcp
Sourcesource-backedsource-backedsource-backedsource-backed
AuthorPortainerFly.ioArgo Project LabsConfigCat
Added2026-06-182026-06-182026-06-062026-06-18
Platforms
Claude CodeCodexCursorClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Source repo————
Safety notes✓The server exposes the full Portainer REST API — including container start/stop/delete, stack deployment, and Kubernetes resource management. The API proxy tools forward requests directly to your Docker/Kubernetes API — review before executing any destructive operations. For team deployments over HTTP, the container requires TLS (either BYO certificates or a TLS-terminated reverse proxy) — do not expose plaintext on the public internet.✓The Fly.io MCP server runs locally with full access to your authenticated Fly.io account — it can create, delete, and modify apps, machines, and secrets. Fly.io warns that running the server remotely can give others access to run commands on your behalf; keep it bound to localhost unless you intend remote access. Destructive operations (machine deletion, secret updates) are available — review Claude's proposed commands before executing in production environments.✓Argo CD MCP can inspect clusters, applications, resource trees, managed resources, workload logs, and resource events. By default all tools are available; setting MCP_READ_ONLY to true disables create_application, update_application, delete_application, sync_application, and run_resource_action. sync_application can apply changes to Kubernetes resources and may prune resources depending on options. delete_application can remove Argo CD applications and may cascade deletion to child resources depending on options. run_resource_action can trigger actions on resources managed by an application. Disabling TLS certificate validation with NODE_TLS_REJECT_UNAUTHORIZED weakens transport security and should be limited to reviewed development contexts.✓Tools can create, update, and delete feature flags, targeting rules, environments, and segments — changes affect live feature flag configuration. Use `list-staleflags` before deleting flags to identify zombie flags and avoid breaking active SDKs.
Privacy notes✓Container names, environment configurations, Docker/Kubernetes resource details, and GitOps credentials from your Portainer instance are surfaced in Claude's context. Your Portainer API key grants the same access as your Portainer user account — treat it as a secret.✓App names, machine IDs, secret names (not values unless explicitly requested), and log content may be surfaced into Claude's context. Fly.io API tokens (`FLY_ACCESS_TOKEN`) grant full account access — store them in your environment, not in repositories.✓Argo CD application specs, cluster names, repository URLs, revisions, namespaces, Kubernetes manifests, resource events, and workload logs can reveal secrets, internal topology, deployment history, incident details, or customer data. ARGOCD_BASE_URL, ARGOCD_API_TOKEN, stateless HTTP request headers, cluster names, namespace names, and application names should stay out of prompts, issues, logs, screenshots, and committed files. Workload logs and resource events may include credentials, tokens, environment variables, error traces, or production incident context. HTTP transport should be authenticated and network-restricted so Argo CD tools are not reachable by untrusted clients.✓Feature flag configurations, targeting rules, audience segments, SDK keys, and audit log entries from your ConfigCat account are surfaced in Claude's context. `CONFIGCAT_API_USER` and `CONFIGCAT_API_PASS` are Management API credentials — keep them in the MCP config env and never commit them to version control.
Prerequisites
  • A running Portainer instance (CE or Business Edition).
  • A Portainer API key: My Account → Access tokens → Add access token.
  • Python with `uv` installed: `pip install uv` or `brew install uv`.
  • Match the MCP server minor version to your Portainer instance minor version (e.g., `mcp-portainer~=2.42.0` for Portainer 2.42.x).
  • flyctl installed — see fly.io/docs/flyctl/install/ (Homebrew: `brew install flyctl`)
  • Logged in to Fly.io: `fly auth login`
  • Or set `FLY_ACCESS_TOKEN` environment variable for headless/CI use.
  • An MCP client such as Claude Code or Claude Desktop.
  • Node.js 18 or newer.
  • Argo CD instance with API access.
  • Argo CD API token scoped to the minimum applications, projects, clusters, and actions Claude should use.
  • Read-only mode enabled unless the workflow explicitly needs application or resource mutations.
  • A ConfigCat account — log in at app.configcat.com.
  • Management API credentials: My Account → Public API Credentials → + Create new credentials (these are separate from SDK keys).
  • Node.js with `npx` available.
  • An MCP client such as Claude Code or Claude Desktop.
Install
claude mcp add portainer -e PORTAINER_URL=https://portainer.example.com -e PORTAINER_API_KEY=ptr_xxxxx -- uvx --from "mcp-portainer~=2.42.0" mcp-portainer
fly mcp server --claude
npx argocd-mcp@latest stdio
claude mcp add configcat -e CONFIGCAT_API_USER=<your-api-user> -e CONFIGCAT_API_PASS=<your-api-pass> -- npx -y @configcat/mcp-server
Config
{
  "mcpServers": {
    "portainer": {
      "command": "uvx",
      "args": ["--from", "mcp-portainer~=2.42.0", "mcp-portainer"],
      "env": {
        "PORTAINER_URL": "https://portainer.example.com",
        "PORTAINER_API_KEY": "ptr_xxxxx",
        "PORTAINER_TLS_VERIFY": "0"
      }
    }
  }
}
{
  "mcpServers": {
    "fly": {
      "command": "fly",
      "args": ["mcp", "server"]
    }
  }
}
{
  "mcpServers": {
    "argocd-mcp": {
      "command": "npx",
      "args": ["argocd-mcp@latest", "stdio"],
      "env": {
        "ARGOCD_BASE_URL": "<argocd-url>",
        "ARGOCD_API_TOKEN": "<argocd-token>",
        "MCP_READ_ONLY": "true"
      }
    }
  }
}
{
  "mcpServers": {
    "configcat": {
      "command": "npx",
      "args": ["-y", "@configcat/mcp-server"],
      "env": {
        "CONFIGCAT_API_USER": "<your-api-user>",
        "CONFIGCAT_API_PASS": "<your-api-pass>",
        "CONFIGCAT_BASE_URL": "https://api.configcat.com"
      }
    }
  }
}
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.