Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
On a Linux host without Docker Desktop, the most direct route is Docker’s MCP Gateway: install its docker-mcp CLI plugin, add MCP servers to a profile, and start docker mcp gateway run --profile my-profile. MCP clients can launch that command over stdio. If you instead need an HTTP router with a web interface, the separate cubicecho/mcp-router project provides /mcp/<name> and aggregate /mcp endpoints and can run with Docker Compose or Node.js 22.18 or newer.
Choose the router before installing anything
“MCP router” is used for two different designs. Docker MCP Gateway is a Docker-managed proxy: it keeps a profile of servers, starts or connects to them through Docker, and presents one gateway to a client. The standalone cubicecho/mcp-router is an HTTP-oriented application that exposes each configured server separately and also offers an aggregate endpoint.
| Concern | Docker MCP Gateway | cubicecho/mcp-router |
|---|---|---|
| Primary interface | stdio by default; Docker also documents SSE and streaming transport values | HTTP routes: /mcp/<name> for an individual server and /mcp for the aggregate |
| Server management | Docker catalogs and profiles; add servers with the Docker CLI | Application configuration managed through its web UI or project configuration |
| Deployment choices | Docker Engine plus the separately installed CLI plugin; Docker Desktop is not required | Docker Compose quickstart or a bare Node deployment |
| Runtime requirement | A Linux Docker Engine installation and the release binary matching your platform | Node.js 22.18 or newer for the bare Node deployment |
| Network posture | Usually local stdio between the client and gateway | Binds all interfaces by default; set HOST=127.0.0.1 for localhost-only access |
Use the Docker option when profiles, catalog entries, container isolation, and a client that can launch a command are your priorities. Use the HTTP router when clients require HTTP endpoints, you want a browser-based configuration interface, or the servers are not being managed as Docker profile entries.
Prerequisites on Linux
- A working Docker Engine installation and permission to run the
dockercommand. - An MCP client that supports either stdio or the HTTP transport exposed by your selected router.
- Credentials required by each MCP server. A profile entry does not automatically supply API keys or other secrets.
- A decision about exposure: keep a router on localhost unless a controlled network endpoint is genuinely required.
Docker’s release assets and command flags change over time. Check the release instructions for the current Linux binary and run docker mcp gateway run --help after installation rather than assuming flags from an older version.
#1 Best Overall
Install Docker MCP Gateway without Docker Desktop
Docker Engine users install the gateway separately as a Docker CLI plugin. Download the current Linux release binary from the project’s release page, then place it at the exact plugin path below. The commands show the documented destination and permission step; they do not select an architecture or verify a particular release asset for you.
mkdir -p ~/.docker/cli-plugins
# Place the downloaded Linux release binary at:
# ~/.docker/cli-plugins/docker-mcp
chmod +x ~/.docker/cli-plugins/docker-mcp
docker mcp --helpThe final command should print the MCP command group. If it reports an unknown command, Docker is not finding the plugin; revisit the filename, path, executable bit, and whether the downloaded binary matches your Linux architecture.
Create a profile and select servers
A Docker MCP profile is the collection of servers that the gateway exposes. First inspect the catalog, then add only the servers needed by this client or workload.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
docker mcp catalog server ls mcp/docker-mcp-catalog
docker mcp profile server add my-profile
--server catalog://mcp/docker-mcp-catalog/github-officialThe catalog identifier in the example is illustrative. Replace it with the server ID shown by the catalog listing. Read the selected server’s own documentation for tokens, OAuth setup, environment variables, required mounts, and any other settings. Adding a reference to a profile does not prove that the server can authenticate or that its downstream service is reachable.
Keep profiles purposeful. A small profile makes it easier to audit which tools a client can call, reduces accidental access to unrelated credentials, and gives you a separate configuration for development, automation, and production.
Start the gateway
Run the gateway with the profile you just created:
docker mcp gateway run --profile my-profilestdio is the default transport. Docker also documents sse and streaming as other transport values; use the transport your installed command and MCP client both support. Leave this process attached to the client when the client launches it, or supervise it using an operations method appropriate for your distribution. There is no single distro-independent systemd unit supplied here, so do not copy a unit intended for another Linux distribution without checking paths, user permissions, environment handling, and restart behavior.
Connect an MCP client over stdio
Most clients that support local MCP servers have a configuration entry containing a command, an argument array, and a transport. The conceptual entry is:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →{
"mcpServers": {
"linux-gateway": {
"command": "docker",
"args": ["mcp", "gateway", "run", "--profile", "my-profile"],
"transport": "stdio"
}
}
}This is a shape example, not a universal schema. Some applications omit the transport property because stdio is implicit; others use a different top-level key or call the command an MCP server definition. Follow the exact configuration format for your client, but preserve the command and argument order. Start the client as the same Linux user that can read the Docker plugin and access any credential files.
If the client offers a choice between launching a process and connecting to a URL, choose the process or stdio mode for this setup. Do not put an HTTP URL in a stdio entry, and do not expect an HTTP-only client to understand a local process without an adapter.
Verify the connection before relying on it
- Start the client and open its MCP status, integrations, or server-inspection view.
- Confirm that the gateway process is shown as connected rather than merely configured.
- Inspect the discovered tool list and select one low-risk tool from one server.
- Invoke that tool with a harmless request and check the result, server logs, and Docker output.
- Repeat with each server whose credentials or network path differs; one healthy server does not validate the rest of the profile.
Client command names and status screens differ, so use the chosen application’s verification procedure. Treat a profile as unverified until a real tool call succeeds on the target host.
Run cubicecho/mcp-router when you need HTTP endpoints
cubicecho/mcp-router is a separate third-party implementation, not Docker MCP Gateway. Its documented Docker Compose quickstart is the simplest deployment when you already operate Compose. The project also documents a bare Node deployment that requires Node.js 22.18 or newer. Follow that project’s current README for the repository checkout, dependency installation, and startup command rather than substituting commands from another Node application.
Once running, the router’s model is straightforward: address one configured server at /mcp/<name>, or use the aggregate /mcp endpoint when the client should see the combined set. Confirm which transport and authentication scheme your client expects before choosing an endpoint.
The project binds all interfaces by default. For a router used only by local processes, set:
HOST=127.0.0.1When you intentionally expose it beyond localhost, place it behind your approved TLS and authentication boundary, restrict firewall access, and protect its bearer token. Binding to all interfaces is a reachability choice, not an access-control policy.
Security controls to review
Docker Gateway controls
The gateway command reference includes controls for blocking network access and secret transfer, verifying signatures, selecting enabled servers, and performing a dry-run configuration. Flag names and defaults are version-sensitive. Inspect the installed command’s help output, enable only the servers required by the profile, and use a dry run when changing a production profile. Treat every server image, package, and credential mapping as part of your trusted-computing boundary.
HTTP-router controls
The standalone router runs installed server packages as child processes with configured environment variables. That is code execution with access to whatever secrets you provide. Its documentation also warns that recorded activity can retain proxied call bodies in process memory. Keep the bearer token private, limit network reachability, and decide deliberately whether activity logging or captured-call inspection is appropriate for sensitive prompts, headers, or tool arguments.
Credential hygiene
- Give each server the narrowest credential scope available.
- Do not paste long-lived keys into a shared client configuration or commit them to a repository.
- Review profile membership when a project or operator changes.
- Rotate credentials after moving a router to a new host or changing its network exposure.
Reliability, performance, and operating cost
There is no independent benchmark that establishes a universal latency or throughput advantage between these implementations. In practice, response time includes client-to-router transport, server startup or container scheduling, the downstream API, and any authorization handshake. Keep the gateway process warm for interactive use, avoid loading unnecessary servers into a profile, and watch Docker CPU, memory, disk, and network usage under your actual workload.
Profiles improve operational repeatability, but they do not eliminate failures in a downstream server. A healthy gateway can still return an authentication error, timeout, rate-limit response, or malformed tool result from the selected server. Capture logs at the client, router, and server layers so you can identify which hop failed.
Both approaches are software you run on your own Linux host; no separate per-call price is established for either router. Your costs are therefore the host, Docker or Node operations, and any downstream MCP service accounts you use.
Troubleshooting common failures
docker mcp is unknown
Docker is not loading the plugin. Confirm that the file is exactly ~/.docker/cli-plugins/docker-mcp, is executable, and is a Linux binary for the host architecture. Run docker --version and docker mcp --help as the same user that owns the plugin directory.
The gateway starts but no tools appear
List the catalog again, verify the server ID, and inspect the profile’s server entries. Add the server to the profile explicitly, then restart the gateway. If the tool list is still empty, check the server’s required credentials and its own startup output.
A server returns an authentication or permission error
The router is reaching the server, but the configured secret, scope, account, or environment variable is wrong or missing. Compare the server documentation with the profile configuration, replace expired credentials, and retry a minimal tool call.
The client cannot launch the gateway
Run the exact command from a shell under the client’s user account. Correct the client’s schema, command path, argument array, and working-directory assumptions. A client configured for HTTP will not connect to a stdio process, and a client configured for stdio will not parse an HTTP endpoint.
Free tools Windows power users keep installed
One-click scans. No signup required.
The HTTP router is reachable from unexpected machines
Set HOST=127.0.0.1 for a local-only deployment, restart it, and verify the listening address with your distribution’s socket inspection tools. For remote use, put authentication and network filtering in front of it rather than relying on the bind address alone.
Best Value
The Node deployment refuses to start
Check the runtime first: the project requires Node.js 22.18 or newer for its bare Node deployment. Upgrade Node using your organization’s supported method, then reinstall dependencies exactly as the project documentation specifies.
Or skip the browser setup:
If an MCP workflow also needs clean screenshots of webpages, ScreenshotNeo is a direct website screenshot API and MCP server. One GET request returns PNG, JPEG, WebP, or PDF; it accepts cookie and consent banners like a visitor, removes more than 60 known consent platforms plus newsletter popups and chat widgets, and bills only clean shots. Bot checks, CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and each response identifies the result with X-Page-Verdict and X-Billed headers. Its MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients.
Use the API documentation at https://screenshotneo.com/docs/ for the full option set. A minimal cURL call is:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutecurl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpThe same request in Python:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)And in Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' }); const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo supports full-page and element captures, device presets or custom viewports, retina scale, dark mode, PDF settings, custom CSS and JavaScript, clicks, selector waits, delays, network-idle waits, request blocking, headers, cookies, user agents, authorization, timezone, geolocation, transparent backgrounds, resizing, caching with a chosen TTL, signed links, async webhooks, bulk capture of up to 100 URLs per call, and a usage API. Every feature is on every plan. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account to get started.
Operational checklist
- Install and test the gateway plugin as the intended Linux user.
- Create a profile containing only required servers.
- Document each server’s credentials, transport, and network dependency.
- Run a real tool call from the target MCP client.
- Inspect gateway flags for network blocking, secret transfer, signatures, enabled servers, and dry runs.
- For HTTP routing, bind locally unless remote access is necessary and protect the bearer token.
- Record a rollback method: the previous profile, binary, configuration, and credential rotation steps.
Frequently Asked Questions
Can one Linux host run both router designs?
Yes. They are separate processes with different interfaces, so you can keep Docker MCP Gateway for profile-managed stdio clients and run the HTTP router for clients that require URL endpoints. Give each process its own ports, credentials, and network policy.
What should I expose to an untrusted network?
Neither router should be treated as public by default. Keep the process on localhost or place it behind authenticated, encrypted access with firewall rules and carefully scoped server credentials.
Where should a production service definition come from?
Use the selected project’s current deployment documentation together with your Linux distribution’s service manager guidance. There is no single service unit that is verified for every distribution or release.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
