Docker Forge MCP

Generate, audit, and tune Docker Compose stacks inside Claude Code — before you copy-paste anything.

Most DevOps work in AI assistants means prompting for a compose file, getting something almost-right, then spending 30 minutes fixing healthchecks, resource limits, and Traefik labels by hand. Docker Forge does all that before the compose file lands in your project.

Pure logic, no API keys, $0 to run.

4 tools

Tool	What it does	Tier
generate_stack	Generate a production-ready Docker Compose from a description	Free
audit_compose	Audit your compose for security & best-practice issues (scored 0-100)	Free
add_traefik	Generate Traefik v3 labels with middlewares	Free
list_stacks	List all available stack templates	Free
generate_dockerfile	Multi-stage, hardened Dockerfile for Node/Python/Go	Pro
generate_env	Extract all ${VARS} from a compose and generate .env template	Pro

Quick start

npx -y docker-forge-mcp

Or add to your Claude Code MCP config:

{
  "mcpServers": {
    "docker-forge": {
      "command": "npx",
      "args": ["-y", "docker-forge-mcp"]
    }
  }
}

Usage examples

Generate a stack:

"Generate a Docker Compose for a Node.js API with PostgreSQL and Redis, domain api.myapp.com"

Audit an existing compose:

"Audit this docker-compose.yml for security issues" → paste your file

Add Traefik:

"Add Traefik v3 labels for my 'backend' service on port 3000 at api.example.com with rate limiting"

Supported stacks

Stack type	Services
node-postgres-redis	Node.js + PostgreSQL + Redis
node-postgres	Node.js + PostgreSQL
node-redis	Node.js + Redis
python-postgres-redis-celery	FastAPI + PostgreSQL + Redis + Celery
python-postgres	FastAPI/Django + PostgreSQL
wordpress	WordPress + MySQL
nextjs-postgres	Next.js standalone + PostgreSQL
monitoring	Prometheus + Grafana + node-exporter
nginx	Nginx static server

What's in every generated stack

• restart: unless-stopped on all services
• deploy.resources.limits (CPU + memory) on every container
• healthcheck on every service
• depends_on with condition: service_healthy
• Named volumes (not anonymous)
• PostgreSQL pinned to 16-alpine, Redis to 7-alpine
• Optional Traefik v3 labels + HTTP→HTTPS redirect

Audit checks

Critical (score -20 each): privileged mode, root user, docker socket mounted, plaintext secrets in env, database ports exposed to internet

Warning (score -5 each): missing restart policy, no resource limits, :latest image tag, no healthcheck, bare depends_on without service_healthy

Info (score -1): no network isolation, simple depends_on

Traefik middleware presets

rate-limit, security-headers (HSTS + XSS + nosniff), auth-basic, compress, redirect-https

License

MIT — frederic.suretat.com/lab