Build an MCP Docker image by packaging an SDK-based server, its pinned dependencies, and a transport-specific startup command. Use stdio when a local client launches the containerized process; use Streamable HTTP when clients connect to a deployed endpoint, normally /mcp. Keep stdio logs on stderr, expose an HTTP port only for HTTP transport, run as a non-root user where practical, and configure host/origin protection before putting the endpoint behind a real hostname.
Decide the transport before writing the Dockerfile
The transport determines whether the container listens on a network port and how its command is tested.
| Transport | Best fit | Container consequence |
|---|---|---|
| stdio | A local desktop, IDE, or agent starts the server process | No listening port. Standard output is reserved for JSON-RPC messages. |
| Streamable HTTP | Remote clients, shared services, and multi-client deployments | Expose an HTTP port and serve the MCP endpoint, normally /mcp. Configure host and origin allowlists. |
| HTTP+SSE | Compatibility with older clients | Use only when a client requires the legacy transport; new TypeScript implementations should prefer Streamable HTTP. |
Python SDK v2 requires Python 3.10 or newer and supports stdio, Streamable HTTP, and SSE. The current TypeScript first-server guide requires Node.js 20 or newer and ES modules. A single image can contain either implementation, but its command, health checks, and exposed port must match the selected transport.
Prepare a minimal server
Python stdio example
Create server.py with the official Python SDK. This example keeps the protocol channel clean and registers one tool.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
from mcp.server.fastmcp import FastMCP
mcp = FastMCP("calculator")
@mcp.tool()
def add(a: int, b: int) -> int:
"""Add two integers."""
return a + b
if __name__ == "__main__":
mcp.run(transport="stdio")
Do not use print() for diagnostics in this mode. The TypeScript documentation states the rule plainly: “stdout is the protocol channel. Log with console.error — one console.log corrupts the JSON-RPC stream.” The same discipline applies to Python: send operational messages to stderr.
Python Streamable HTTP example
For a remotely reachable service, expose the SDK’s ASGI application and let an ASGI server handle sockets and workers.
from mcp.server.fastmcp import FastMCP
mcp = FastMCP("calculator")
@mcp.tool()
def add(a: int, b: int) -> int:
"""Add two integers."""
return a + b
app = mcp.streamable_http_app()
Run that application with Uvicorn, Hypercorn, FastAPI, or another ASGI host. The resulting MCP route is normally /mcp. The SDK’s HTTP security settings must allow the exact public host and permitted origins; leaving the localhost defaults in place can produce 421 Misdirected Request or 403 Forbidden before a request reaches your tools.
TypeScript considerations
The official TypeScript SDK requires Node.js 20 or newer and ES modules. Put tool registration in a module, start stdio for local integrations, and use console.error for logs. For remote operation, use the SDK’s Streamable HTTP server and mount it at /mcp. Keep the same separation used in the Python example: protocol bytes on stdout only for stdio, and HTTP access controls at the deployed hostname.
Write a reproducible Dockerfile
Python image for stdio
Use a maintained runtime image, install a lockfile or pinned requirements, copy only required files, and run as a non-root account. A simple layout is server.py plus requirements.txt.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
FROM python:3.12-slim
ENV PYTHONDONTWRITEBYTECODE=1
PYTHONUNBUFFERED=1
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --require-hashes -r requirements.txt
&& useradd --create-home --uid 10001 mcpuser
COPY server.py .
RUN chown -R mcpuser:mcpuser /app
USER mcpuser
CMD ["python", "server.py"]
Generate requirements.txt from the SDK version you have selected and pin every transitive dependency with hashes when your build process supports it. If your package manager uses a lockfile, copy and install that lockfile instead of an unconstrained dependency range.
Python image for Streamable HTTP
The application code can stay the same; the command and port change.
FROM python:3.12-slim
ENV PYTHONDONTWRITEBYTECODE=1
PYTHONUNBUFFERED=1
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --require-hashes -r requirements.txt
&& useradd --create-home --uid 10001 mcpuser
COPY server.py .
RUN chown -R mcpuser:mcpuser /app
USER mcpuser
EXPOSE 8000
CMD ["uvicorn", "server:app", "--host", "0.0.0.0", "--port", "8000"]
Only the HTTP variant needs EXPOSE; that instruction documents the intended port and does not itself publish it. Publish the port with your runtime or hosting platform.
Free tools Windows power users keep installed
One-click scans. No signup required.
Node.js image pattern
For a TypeScript server, use a maintained Node.js 20-or-newer image, copy package.json and the lockfile first, run a frozen install, build the project, and copy the compiled output into a smaller runtime stage. Set "type": "module" in package.json when using the SDK’s ES-module examples. Keep the final command explicit, such as node dist/server.js for stdio or an HTTP listener for Streamable HTTP.
Build, run, and test the image
- Build a versioned image:
docker build -t example/mcp-calculator:1.0.0 .. - For stdio, let the MCP client launch the image and do not publish a port. Pass only the environment variables the tool needs, for example with
docker run --rm -i --env API_TOKEN example/mcp-calculator:1.0.0. The interactive input flag keeps the JSON-RPC stream connected. - For HTTP, publish the service locally:
docker run --rm -p 8000:8000 --env API_TOKEN example/mcp-calculator:1.0.0. Point an MCP client or MCP Inspector at the image’s actual endpoint, such ashttp://localhost:8000/mcp. - Verify tool discovery and invocation with the same transport, path, headers, and authentication that production will use. A test against a host process does not prove that the container command or networking is correct.
- Tag the tested image with an immutable release and push it to your registry. Prefer a digest in deployment configuration so a later tag move cannot silently change the running code.
Secure an HTTP deployment
Streamable HTTP is a network service, not just a different command-line flag. Configure the SDK’s allowed_hosts and allowed_origins for the exact public hostname and browser origins that should connect. Do not disable those checks as a shortcut. Put TLS termination and identity enforcement at the ingress or platform boundary, then pass only authenticated traffic to the container.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Use a real hostname and HTTPS in production.
- Allow only the hostnames and origins you operate; avoid broad wildcards unless there is a documented reason.
- Keep API keys, OAuth secrets, database passwords, and signing keys out of the image and source repository. Inject them at runtime through the deployment system or Docker MCP secret mechanisms.
- Restrict the tools and credentials exposed to each client. A server that can read files or call internal APIs should not receive credentials intended for an unrelated client.
- Add health and startup diagnostics outside the MCP protocol stream. For stdio, diagnostics belong on stderr; for HTTP, use your platform’s health mechanism or a separate diagnostic route.
Use Docker MCP Toolkit and Gateway when you need central operations
Docker MCP Toolkit organizes servers and clients with profiles. Its MCP Gateway centralizes routing, credentials, access control, and server lifecycle. The Gateway starts a server container when a requested tool is not already running, which avoids keeping every server active all the time. The documented Toolkit interface describes Docker Desktop 4.62 and later.
The Docker MCP Catalog lists more than 300 verified servers packaged as container images with versioning, provenance, and security updates. You can use a catalog image when it meets your needs, or register your own pushed image and apply the same profile, credential, and routing controls. The Toolkit getting-started flow is: create a profile, add servers, connect clients, and verify each connection.
Recommended Free Tools
Production checklist
- Reproducibility: pin application dependencies and, preferably, deploy by image digest.
- Least privilege: run as a non-root user, expose only required tools, and provide narrowly scoped credentials.
- Transport correctness: stdio has no listening port; HTTP listens on the configured port and serves the expected
/mcppath. - Protocol-safe logging: never write ordinary logs to stdout in stdio mode.
- HTTP security: set exact host and origin allowlists before exposing the service publicly.
- Secrets: inject at runtime, rotate them through the platform, and ensure they are absent from image layers and build logs.
- Lifecycle: define startup, shutdown, retry, and health behavior for the process manager or managed service.
- Validation: test the built image with an MCP client or Inspector, not just a unit test of the tool function.
Troubleshoot common failures
The client receives invalid JSON or disconnects immediately
This is usually a polluted stdio stream. Remove print(), console.log, progress bars, and dependency banners from stdout. Send diagnostics to stderr and rebuild the image.
The container exits as soon as it starts
Check the image command, module path, and runtime version. An HTTP image started with a stdio command, or a Node image running source files that were never compiled, will terminate or fail before a client connects. Read container logs and run the command interactively with the same environment variables.
The HTTP client gets 404 at the expected route
Confirm that the ASGI application is mounted at the SDK’s MCP route and that the client uses /mcp, including any required trailing-slash behavior. Also verify that a reverse proxy has not stripped or rewritten the path.
The client gets 421 or 403 before tool handling
The deployed hostname or origin is not in the SDK allowlist. Add the exact public host and permitted origins, then redeploy. Do not solve this by turning off host or origin protection.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
The image cannot install dependencies
Check that the lockfile matches the selected Python or Node version and that native build dependencies are available during the build stage. Pin a compatible SDK release, rebuild without a stale cache when necessary, and keep the final image limited to runtime files.
Tools work locally but fail through the Gateway
Compare the Gateway’s profile, injected secrets, image digest, transport, and endpoint shape with your direct Docker test. A profile can route a request to a different image version or omit a required credential even when the tool works on your workstation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Performance, reliability, and cost decisions
For stdio, startup latency is paid whenever a client launches a process; keeping the image small and dependencies preinstalled reduces that delay. For HTTP, a long-running process avoids repeated startup but requires concurrency limits, timeouts, and a deployment policy for restarts. Stateless HTTP handlers are easier to scale horizontally. Session-aware behavior needs an explicit state strategy so requests routed to different replicas see the state they require.
Build once and promote the same digest through environments. Managed HTTPS platforms can provide TLS, identity, autoscaling, and log collection; the Python SDK supplies the ASGI application, while the process manager, load balancer, worker topology, and platform policy remain your deployment responsibility. There is no universal Dockerfile, port, or worker count: choose them from the language, SDK version, transport, and hosting platform you actually deploy.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Or skip the browser setup
If you need a clean visual capture of an MCP-enabled web console, documentation page, or deployment status page, ScreenshotNeo returns a screenshot or PDF through one request instead of maintaining browser automation. It accepts consent banners like a visitor, removes more than 60 known consent platforms plus newsletter popups and chat widgets before capture, and reports whether a response was billed. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed.
For example, capture a page after deploying your service:
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com/mcp -o shot.webpThe same API is available from Python and Node.js. See the ScreenshotNeo documentation for all parameters.
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://example.com/mcp"}, timeout=90)
open("shot.webp", "wb").write(r.content)
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://example.com/mcp' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
ScreenshotNeo also provides an MCP server with take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients. Every feature is included on every plan: 1,000 screenshots per month are free with no card; paid plans start at $5 for 3,000 shots. Sign up for the free plan.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFrequently Asked Questions
Can one Docker image support both stdio and Streamable HTTP?
Yes, if the application includes both startup paths and the deployment selects the matching command and configuration. Treat each mode as a separate tested deployment because their logging, networking, and security requirements differ.
Is Docker MCP Gateway required to run a custom MCP image?
No. Docker Engine plus a compatible MCP client can run the image directly. Gateway is useful when you want centralized routing, credentials, access control, profiles, and on-demand container lifecycle.
Should I use SSE for a new server?
Only when compatibility with an older client requires it. Streamable HTTP is the recommended remote transport for new TypeScript implementations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
