MCP Gateway by docker
by dockerdocker mcp CLI plugin / MCP Gateway
MCP Gateway is an open-source mcp server by docker, written mainly in Go, with 1,619 GitHub stars and the MIT license. Its code was last updated Oct 26, 2026.
Scan summary: scanned Nov 5, 2026 at commit 7e0f342. No capabilities flagged by our checks. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
7e0f342 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings.
Passed. This check ran and found nothing it flags.Static code scanpassPassed. This check ran and found nothing it flags.
Flagged. This check found an issue. See the findings below.Secrets scanfailFlagged. This check found an issue. See the findings below.
Flagged. This check found an issue. See the findings below.Dependency audit191 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Buildn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Boot & handshaken/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Network egressn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Reproducible (×3)n/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Findings (58)
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.go.opentelemetry.io/otel@1.36.0: 1 known vulnerabilityGO-2026-5506
examples/otel/metrics/go.mod - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.go.opentelemetry.io/otel/sdk@1.36.0: 3 known vulnerabilitiesGO-2026-4394, GO-2026-5426, GO-2026-6505
examples/otel/metrics/go.mod - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.github.com/modelcontextprotocol/go-sdk@1.0.0: 4 known vulnerabilitiesGO-2026-4569, GO-2026-4770, GO-2026-4773, GO-2026-5771
examples/sqlite-vec/go.mod - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@xmldom/xmldom@0.9.8: 17 known vulnerabilitiesGHSA-27p8-2357-5qqv, GHSA-2v35-w6hq-6mfw, GHSA-3px3-54cx-rmw9, GHSA-4w3w-2rp5-g8jm, GHSA-6gmq-8vp8-gcm6 +12 more
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.extract-zip@2.0.1: 2 known vulnerabilitiesGHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip-address@10.1.0: 6 known vulnerabilitiesGHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +1 more
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.1.0: 5 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.linkify-it@5.0.0: 2 known vulnerabilitiesGHSA-22p9-wv53-3rq4, GHSA-v245-v573-v5vm
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.lodash@4.17.21: 2 known vulnerabilitiesGHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.markdown-it@14.1.0: 6 known vulnerabilitiesGHSA-253c-mchw-3w2r, GHSA-38c4-r59v-3vqw, GHSA-6v5v-wf23-fmfq, GHSA-gfr2-rv44-r23c, GHSA-r7fv-28h4-cvq7 +1 more
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.mermaid@7.1.2: 10 known vulnerabilitiesGHSA-4f6x-49g2-99fm, GHSA-6m6c-36f7-fhxh, GHSA-6x64-9x62-f2gx, GHSA-87f9-hvmw-gh4p, GHSA-c4c3-pg64-4m4v +5 more
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.11: 3 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.5.6: 4 known vulnerabilitiesGHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 1 known vulnerabilityGHSA-68fv-2mgg-jv7q
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tmp@0.2.5: 1 known vulnerabilityGHSA-ph9p-34f9-6g65
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ws@8.18.3: 2 known vulnerabilitiesGHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@3.25.76: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
examples/tool_registrations/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.github.com/docker/cli@28.2.2+incompatible: 1 known vulnerabilityGO-2026-4610
go.mod - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.github.com/docker/docker@28.3.3+incompatible: 5 known vulnerabilitiesGO-2026-4883, GO-2026-4887, GO-2026-5617, GO-2026-5668, GO-2026-5746
go.mod - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.github.com/go-jose/go-jose/v4@4.1.3: 4 known vulnerabilitiesGO-2026-4945, GHSA-4w3g-jfj2-cw2q, GHSA-mgcc-cww5-fp2q, GHSA-vvm8-gf78-28g4
go.mod - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.github.com/klauspost/compress@1.18.0: 2 known vulnerabilitiesGO-2026-5841, GO-2026-5841
go.mod - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.github.com/sigstore/rekor@1.3.10: 3 known vulnerabilitiesGO-2026-4354, GO-2026-4355, GO-2026-5778
go.mod - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.github.com/sigstore/timestamp-authority@1.2.9: 3 known vulnerabilitiesGO-2025-4192, GO-2026-5763, GO-2026-5851
go.mod - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.go.opentelemetry.io/otel@1.40.0: 1 known vulnerabilityGO-2026-5506
go.mod - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.go.opentelemetry.io/otel/sdk@1.40.0: 2 known vulnerabilitiesGO-2026-5426, GO-2026-6505
go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/net@0.40.0: 17 known vulnerabilitiesGO-2026-4440, GO-2026-4441, GO-2026-4918, GO-2026-5025, GO-2026-5026 +12 more
examples/otel/metrics/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/sys@0.33.0: 1 known vulnerabilityGO-2026-5024
examples/otel/metrics/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/text@0.25.0: 2 known vulnerabilitiesGO-2026-5970, GO-2026-6629
examples/otel/metrics/go.mod - lowLow. Minor, or common in normal tools. Shown for information.katex@0.16.25: 1 known vulnerabilityGHSA-238p-pmpm-9mq7
examples/tool_registrations/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.moment@2.30.1: 1 known vulnerabilityGHSA-4p3w-j4w9-5jqw
examples/tool_registrations/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@7.1.0: 2 known vulnerabilitiesGHSA-rj75-hqrm-r3gf, GHSA-w9m9-85wc-3x92
examples/tool_registrations/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.github.com/cloudflare/circl@1.6.1: 1 known vulnerabilityGO-2026-4550
go.mod - lowLow. Minor, or common in normal tools. Shown for information.github.com/docker/distribution@2.8.3+incompatible: 1 known vulnerabilityGHSA-685w-q87j-wqw3
go.mod - lowLow. Minor, or common in normal tools. Shown for information.github.com/go-chi/chi@4.1.2+incompatible: 1 known vulnerabilityGO-2026-4316
go.mod - lowLow. Minor, or common in normal tools. Shown for information.github.com/in-toto/in-toto-golang@0.9.0: 1 known vulnerabilityGO-2026-5547
go.mod - lowLow. Minor, or common in normal tools. Shown for information.github.com/sigstore/cosign/v2@2.5.0: 3 known vulnerabilitiesGO-2026-4309, GO-2026-4529, GO-2026-5694
go.mod - lowLow. Minor, or common in normal tools. Shown for information.github.com/sigstore/sigstore@1.9.5: 1 known vulnerabilityGO-2026-4358
go.mod - lowLow. Minor, or common in normal tools. Shown for information.github.com/sigstore/sigstore-go@1.0.0: 2 known vulnerabilitiesGO-2026-5952, GO-2026-6162
go.mod - lowLow. Minor, or common in normal tools. Shown for information.github.com/theupdateframework/go-tuf/v2@2.1.1: 3 known vulnerabilitiesGO-2026-4348, GO-2026-4349, GO-2026-4377
go.mod - lowLow. Minor, or common in normal tools. Shown for information.go.mongodb.org/mongo-driver@1.17.4: 1 known vulnerabilityGO-2026-5327
go.mod - lowLow. Minor, or common in normal tools. Shown for information.go.opentelemetry.io/otel/exporters/otlp/otlptrace@1.40.0: 1 known vulnerabilityGO-2026-6505
go.mod - lowLow. Minor, or common in normal tools. Shown for information.go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.40.0: 1 known vulnerabilityGO-2026-6505
go.mod - lowLow. Minor, or common in normal tools. Shown for information.go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@1.36.0: 2 known vulnerabilitiesGO-2026-4985, GO-2026-6505
go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/mod@0.36.0: 2 known vulnerabilitiesGO-2026-6179, GO-2026-6180
go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/net@0.54.0: 14 known vulnerabilitiesGO-2026-5025, GO-2026-5026, GO-2026-5027, GO-2026-5028, GO-2026-5029 +9 more
go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/text@0.37.0: 2 known vulnerabilitiesGO-2026-5970, GO-2026-6629
go.mod - lowLow. Minor, or common in normal tools. Shown for information.github.com/valyala/fasthttp@1.62.0: 1 known vulnerabilityGO-2026-4950
tools/l7proxy/go.mod - lowLow. Minor, or common in normal tools. Shown for information.requests@2.31.0: 3 known vulnerabilitiesPYSEC-2026-1872, PYSEC-2026-1873, PYSEC-2026-2275
vendor/github.com/theupdateframework/go-tuf/requirements-test.txt - lowLow. Minor, or common in normal tools. Shown for information.tuf@3.1.0: 2 known vulnerabilitiesGHSA-77hh-43cm-v8j6, GHSA-qp9x-wp8f-qgjj
vendor/github.com/theupdateframework/go-tuf/requirements-test.txt - lowLow. Minor, or common in normal tools. Shown for information.idna@3.9.0: 1 known vulnerabilityPYSEC-2026-215
vendor/github.com/theupdateframework/go-tuf/requirements-test.txt - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
MCP Gateway alternatives
View more →Similar mcp servers in Cloud Infrastructure, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| MCP Gateway (this page) docker | 1.6k | MIT | Oct 26, 2026 | Scanned, no flagged issues |
| TREK liketrek | 15k | AGPL-3.0 | Nov 1, 2026 | Scanned, no flagged issues |
| MCP awslabs | 9.9k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |
| MCP Context Forge IBM | 4.7k | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |
| Mcpo open-webui | 4.4k | MIT | May 17, 2026 | Scanned, no flagged issues |
| Lean Ctx yvgude | 3.9k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |