MCP server container runs privileged or with the Docker socket

HighAV-MCP-109MCPMCP config packNew in 2.0

What it finds

A containerized MCP server is started with --privileged, host networking, host PID, extra capabilities, or the Docker socket mounted.

Why it matters

These flags remove the isolation that is the whole point of running the server in a container. With the Docker socket it can start new containers as root on the host.

What an attacker could do: The MCP server effectively has root-level access to the host machine.

How to fix it

Run the container without --privileged, host networking, or the Docker socket. Mount only the folders it needs, read-only where possible.

Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans

Check details

Finding code: MCP_DOCKER_PRIVILEGED
How it detects: Looks for a specific risky pattern in the code or config.
Confidence: Definite: the risky setting is written plainly in the file.
Scans: MCP client configuration files: claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, .mcp.json
OWASP LLM Top 10: LLM08 - Excessive Agency
NIST AI RMF: MG-2.2
SOC 2: CC6.1, CC6.8

Check your agent for this

Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.

Scan an agent free Run it in CI or your editor