OpenClaw went from a side project to hundreds of thousands of GitHub stars in months. It also went from zero to hundreds of malicious skills on its own marketplace in weeks. Both facts describe the same tool, and if you are planning to run it, you need to understand why.

OpenClaw connects to messaging apps like WhatsApp, Telegram, Discord, and Slack, reads local files, executes shell commands, and acts on your behalf across whatever services you connect it to.

OpenClaw is not unsafe by design, but its permission model makes a compromised instance far more damaging than typical software. The risks are well documented at this point: a supply-chain campaign called ClawHavoc placed 341 malicious skills on ClawHub, a critical remote-code-execution flaw (CVE-2026-25253) let attackers hijack instances through a single malicious link, and Cisco found that 26% of 31,000 scanned agent skills contained at least one exploitable vulnerability. None of that means the tool is unusable. It means safe deployment comes down to isolation, a locked-down firewall, skill vetting, and logging, not avoidance.

This guide covers what independent security researchers actually documented, why the risk is structural rather than a handful of bad skills, and a practical checklist for running OpenClaw without becoming the next case study.

Why OpenClaw Is a Different Kind of Security Risk

Most software vulnerabilities give an attacker a foothold. A compromised OpenClaw instance often gives an attacker the same permissions the agent already has, which for most users includes:

Read access to local files, and often to connected cloud storage

Live API keys and OAuth tokens for every connected service, from email and calendars to crypto wallets in some setups

The ability to install new skills on its own, if configured for autonomous operation

Skills, OpenClaw's extension mechanism, run with the same permissions as the agent itself. There is no sandbox boundary between "this skill checks the weather" and "this skill reads your browser's saved passwords." Security researchers have repeatedly shown that the two can look identical from the outside, and by design, ClawHub requires nothing more than a week-old GitHub account to publish a new one.

What the Security Research Actually Found

These incidents are documented by named security vendors and researchers, not rumor. Where sources disagreed on details, we've gone with the figures corroborated by multiple independent outlets.

The ClawHavoc supply chain attack. In February 2026, Koi Security audited all 2,857 skills then live on ClawHub and identified 341 malicious entries, roughly 12% of the registry. Of those, 335 were traced to a single coordinated campaign, now tracked as ClawHavoc, that used fake "prerequisite" install steps to deliver Atomic Stealer (AMOS) on macOS, a tool built to harvest browser passwords, crypto wallet keys, and session cookies. By later scans the count of flagged malicious skills had grown well past 800 as the registry itself expanded.

A critical remote code execution flaw. Tracked as CVE-2026-25253 and rated CVSS 8.8, this vulnerability let an attacker hijack a running OpenClaw instance and steal its authentication token simply by getting the victim to click a crafted link or visit a malicious page. It was patched within days of disclosure, but only for users who updated.

Widespread vulnerability rates across the wider skill ecosystem. Cisco's AI Defense team scanned roughly 31,000 agent skills across multiple frameworks, OpenClaw included, and found that about 26% contained at least one exploitable vulnerability: command injection, data exfiltration, or prompt injection.

Credential exposure at scale. Snyk's separate ToxicSkills audit scanned close to 4,000 ClawHub skills and found that 7.1% (283 skills) exposed sensitive credentials in plaintext, with 13.4% classified as containing critical-severity issues.

Scanners can be bypassed. Trail of Bits demonstrated that ClawHub's own malware-scanning pipeline could be defeated by padding a malicious skill file with roughly 100,000 blank lines, pushing the harmful code outside the window the scanner actually inspects. Comparable gaps were found in third-party scanning tools built specifically to catch this kind of threat.

Exposed instances at scale. Cisco has reported more than 135,000 OpenClaw instances reachable from the public internet, many running outdated, vulnerable versions.

The institutional response has been telling. China's government restricted state agencies, state-owned enterprises, and banks from running OpenClaw, citing risks around unauthorized data deletion, data leaks, and excessive resource usage. Multiple security vendors, including Cisco, report seeing similar internal restrictions inside enterprises as adoption grows.

The checklist below is what deploying it "deliberately, isolated, and monitored" actually looks like in practice.

How to Deploy OpenClaw Safely: A 7-Step Checklist

1. Never run it on a machine with unrelated sensitive access

Do not install OpenClaw on your daily laptop, especially one logged into personal email, banking, or production infrastructure. A dedicated VM, cloud instance, or container gives you a hard boundary between "if this agent is compromised" and "everything I own".

2. Default to deny on outbound network access

An agent that can only reach the specific APIs it needs is far less useful to an attacker than one with open egress to the entire internet. Configure your firewall for allowlisted outbound connections rather than blocklisting known-bad destinations after the fact.

3. Treat every third-party skill as untrusted code

Skills execute with full agent permissions the moment they are installed. Before adding anything from ClawHub:

Scan it with a dedicated tool built for this, such as Cisco's open-source skill-scanner, rather than relying on the marketplace's built-in check alone

Read the SKILL.md file and any bundled scripts yourself if the skill touches credentials, files, or network calls

Keep the total number of installed skills small; every skill is additional attack surface

Avoid one-click installs from public marketplaces in any environment connected to sensitive accounts

4. Keep credentials out of the agent's filesystem

Use a secrets manager or vault rather than letting OpenClaw store API keys and tokens in plaintext config files. Rotate tokens regularly, and scope each connected service to the minimum permissions the agent actually needs. If a skill only needs to read a calendar, it should not also hold write access to email.

5. Patch on a schedule, not when you remember

CVE-2026-25253 and similar flaws were fixed quickly once disclosed. The instances that got compromised were, overwhelmingly, ones running outdated versions. Update OpenClaw and its dependencies on a defined cadence, and subscribe to the project's security advisories.

If OpenClaw can act autonomously, you need an audit trail of what it acted on: which skills ran, which tool calls fired, which external destinations received data. Runtime monitoring is what turns "we think something went wrong three weeks ago" into "we caught this in under a minute".

7. Separate the agent from production infrastructure

If OpenClaw is managing DevOps tasks, deploying code, or touching infrastructure, give it a scoped service account rather than admin credentials, and route its actions through the same review gates you would require of a junior engineer.

Once the isolation and monitoring model above is in place, the remaining decision is infrastructure: a self-managed server, a cloud VM you harden by hand, or a preconfigured deployment.

TryDirect's marketplace includes an OpenClaw preconfigured stack, built by the StackDog Team, that deploys to Amazon EC2, DigitalOcean, or Hetzner Cloud with a firewall already configured. It is worth being direct about what that stack currently is and is not: the listing is explicitly labeled an experimental setup, and at the time of writing it has passed 3 of the marketplace's 8 verification checks. That is not unusual for a preconfigured stack built around a tool this new, but it does mean the firewall and isolation it ships with are a starting point, not a substitute for the credential hygiene, skill vetting, and monitoring practices above.

The advantage of deploying through a marketplace stack rather than a manual install is mainly speed and a consistent baseline: a fresh, isolated instance with networking pre-configured, rather than OpenClaw sharing a machine with other workloads by default. Whichever route you choose, self-hosted VM, containerized deployment, or a marketplace image, the checklist does not change. Isolation, a locked-down firewall, vetted skills, and real logging are what determine whether an OpenClaw deployment is a productivity tool or a liability.

Is OpenClaw safe to use? OpenClaw is not inherently unsafe, but its permission model, an agent with shell access, file access, and live credentials, means the consequences of a compromise are more severe than with typical software. Safety depends heavily on how it is deployed and which skills are installed, not just which version you run.

What is ClawHub and why does it matter for security? ClawHub is OpenClaw's community marketplace for skills, the packages that extend what the agent can do. Because anyone with a week-old GitHub account can publish and vetting has historically been limited, ClawHub was the primary vector for the ClawHavoc campaign and other malicious-skill incidents documented by Koi Security, Snyk, and Cisco.

Should I run OpenClaw on my personal computer? It is not recommended if that machine also holds sensitive personal accounts, saved passwords, or production credentials. A dedicated, isolated environment, whether a cloud VM, container, or preconfigured stack, limits the blast radius if something goes wrong.

Do skill scanners fully solve the malicious skill problem? No. Trail of Bits demonstrated bypasses against ClawHub's own scanning pipeline and several third-party scanners. Scanning is a useful first filter, not a guarantee, which is why limiting the number of installed skills and reviewing anything with credential or network access still matters.

Deploy OpenClaw on an isolated, firewall-configured instance in minutes with the OpenClaw preconfigured stack on TryDirect.

OpenClaw went from a side project to hundreds of thousands of GitHub stars in months. It also went from zero to hundreds of malicious skills on its own marketplace in weeks. Both facts describe the same tool, and if you are planning to run it, you need to understand why.

OpenClaw connects to messaging apps like WhatsApp, Telegram, Discord, and Slack, reads local files, executes shell commands, and acts on your behalf across whatever services you connect it to.

OpenClaw is not unsafe by design, but its permission model makes a compromised instance far more damaging than typical software. The risks are well documented at this point: a supply-chain campaign called ClawHavoc placed 341 malicious skills on ClawHub, a critical remote-code-execution flaw (CVE-2026-25253) let attackers hijack instances through a single malicious link, and Cisco found that 26% of 31,000 scanned agent skills contained at least one exploitable vulnerability. None of that means the tool is unusable. It means safe deployment comes down to isolation, a locked-down firewall, skill vetting, and logging, not avoidance.

This guide covers what independent security researchers actually documented, why the risk is structural rather than a handful of bad skills, and a practical checklist for running OpenClaw without becoming the next case study.

Why OpenClaw Is a Different Kind of Security Risk

Most software vulnerabilities give an attacker a foothold. A compromised OpenClaw instance often gives an attacker the same permissions the agent already has, which for most users includes:
Full shell access on the host machine
Read access to local files, and often to connected cloud storage
Live API keys and OAuth tokens for every connected service, from email and calendars to crypto wallets in some setups
The ability to install new skills on its own, if configured for autonomous operation

Skills, OpenClaw's extension mechanism, run with the same permissions as the agent itself. There is no sandbox boundary between "this skill checks the weather" and "this skill reads your browser's saved passwords." Security researchers have repeatedly shown that the two can look identical from the outside, and by design, ClawHub requires nothing more than a week-old GitHub account to publish a new one.

What the Security Research Actually Found

These incidents are documented by named security vendors and researchers, not rumor. Where sources disagreed on details, we've gone with the figures corroborated by multiple independent outlets.

The ClawHavoc supply chain attack. In February 2026, Koi Security audited all 2,857 skills then live on ClawHub and identified 341 malicious entries, roughly 12% of the registry. Of those, 335 were traced to a single coordinated campaign, now tracked as ClawHavoc, that used fake "prerequisite" install steps to deliver Atomic Stealer (AMOS) on macOS, a tool built to harvest browser passwords, crypto wallet keys, and session cookies. By later scans the count of flagged malicious skills had grown well past 800 as the registry itself expanded.

A critical remote code execution flaw. Tracked as CVE-2026-25253 and rated CVSS 8.8, this vulnerability let an attacker hijack a running OpenClaw instance and steal its authentication token simply by getting the victim to click a crafted link or visit a malicious page. It was patched within days of disclosure, but only for users who updated.

Widespread vulnerability rates across the wider skill ecosystem. Cisco's AI Defense team scanned roughly 31,000 agent skills across multiple frameworks, OpenClaw included, and found that about 26% contained at least one exploitable vulnerability: command injection, data exfiltration, or prompt injection.

Credential exposure at scale. Snyk's separate ToxicSkills audit scanned close to 4,000 ClawHub skills and found that 7.1% (283 skills) exposed sensitive credentials in plaintext, with 13.4% classified as containing critical-severity issues.

Scanners can be bypassed. Trail of Bits demonstrated that ClawHub's own malware-scanning pipeline could be defeated by padding a malicious skill file with roughly 100,000 blank lines, pushing the harmful code outside the window the scanner actually inspects. Comparable gaps were found in third-party scanning tools built specifically to catch this kind of threat.

Exposed instances at scale. Cisco has reported more than 135,000 OpenClaw instances reachable from the public internet, many running outdated, vulnerable versions.

The institutional response has been telling. China's government restricted state agencies, state-owned enterprises, and banks from running OpenClaw, citing risks around unauthorized data deletion, data leaks, and excessive resource usage. Multiple security vendors, including Cisco, report seeing similar internal restrictions inside enterprises as adoption grows.

The checklist below is what deploying it "deliberately, isolated, and monitored" actually looks like in practice.

How to Deploy OpenClaw Safely: A 7-Step Checklist

1. Never run it on a machine with unrelated sensitive access
Do not install OpenClaw on your daily laptop, especially one logged into personal email, banking, or production infrastructure. A dedicated VM, cloud instance, or container gives you a hard boundary between "if this agent is compromised" and "everything I own".

2. Default to deny on outbound network access
An agent that can only reach the specific APIs it needs is far less useful to an attacker than one with open egress to the entire internet. Configure your firewall for allowlisted outbound connections rather than blocklisting known-bad destinations after the fact.

3. Treat every third-party skill as untrusted code
Skills execute with full agent permissions the moment they are installed. Before adding anything from ClawHub:
Scan it with a dedicated tool built for this, such as Cisco's open-source skill-scanner, rather than relying on the marketplace's built-in check alone
Read the SKILL.md file and any bundled scripts yourself if the skill touches credentials, files, or network calls
Keep the total number of installed skills small; every skill is additional attack surface
Avoid one-click installs from public marketplaces in any environment connected to sensitive accounts

4. Keep credentials out of the agent's filesystem
Use a secrets manager or vault rather than letting OpenClaw store API keys and tokens in plaintext config files. Rotate tokens regularly, and scope each connected service to the minimum permissions the agent actually needs. If a skill only needs to read a calendar, it should not also hold write access to email.

5. Patch on a schedule, not when you remember
CVE-2026-25253 and similar flaws were fixed quickly once disclosed. The instances that got compromised were, overwhelmingly, ones running outdated versions. Update OpenClaw and its dependencies on a defined cadence, and subscribe to the project's security advisories.

6. Log everything the agent does
If OpenClaw can act autonomously, you need an audit trail of what it acted on: which skills ran, which tool calls fired, which external destinations received data. Runtime monitoring is what turns "we think something went wrong three weeks ago" into "we caught this in under a minute".

7. Separate the agent from production infrastructure
If OpenClaw is managing DevOps tasks, deploying code, or touching infrastructure, give it a scoped service account rather than admin credentials, and route its actions through the same review gates you would require of a junior engineer.

Where to Actually Run It

Once the isolation and monitoring model above is in place, the remaining decision is infrastructure: a self-managed server, a cloud VM you harden by hand, or a preconfigured deployment.

TryDirect's marketplace includes an OpenClaw preconfigured stack, built by the StackDog Team, that deploys to Amazon EC2, DigitalOcean, or Hetzner Cloud with a firewall already configured. It is worth being direct about what that stack currently is and is not: the listing is explicitly labeled an experimental setup, and at the time of writing it has passed 3 of the marketplace's 8 verification checks. That is not unusual for a preconfigured stack built around a tool this new, but it does mean the firewall and isolation it ships with are a starting point, not a substitute for the credential hygiene, skill vetting, and monitoring practices above.

The advantage of deploying through a marketplace stack rather than a manual install is mainly speed and a consistent baseline: a fresh, isolated instance with networking pre-configured, rather than OpenClaw sharing a machine with other workloads by default. Whichever route you choose, self-hosted VM, containerized deployment, or a marketplace image, the checklist does not change. Isolation, a locked-down firewall, vetted skills, and real logging are what determine whether an OpenClaw deployment is a productivity tool or a liability.

FAQ

Is OpenClaw safe to use? OpenClaw is not inherently unsafe, but its permission model, an agent with shell access, file access, and live credentials, means the consequences of a compromise are more severe than with typical software. Safety depends heavily on how it is deployed and which skills are installed, not just which version you run.

What is ClawHub and why does it matter for security? ClawHub is OpenClaw's community marketplace for skills, the packages that extend what the agent can do. Because anyone with a week-old GitHub account can publish and vetting has historically been limited, ClawHub was the primary vector for the ClawHavoc campaign and other malicious-skill incidents documented by Koi Security, Snyk, and Cisco.

Should I run OpenClaw on my personal computer? It is not recommended if that machine also holds sensitive personal accounts, saved passwords, or production credentials. A dedicated, isolated environment, whether a cloud VM, container, or preconfigured stack, limits the blast radius if something goes wrong.

Do skill scanners fully solve the malicious skill problem? No. Trail of Bits demonstrated bypasses against ClawHub's own scanning pipeline and several third-party scanners. Scanning is a useful first filter, not a guarantee, which is why limiting the number of installed skills and reviewing anything with credential or network access still matters.

Deploy OpenClaw on an isolated, firewall-configured instance in minutes with the OpenClaw preconfigured stack on TryDirect.

ClawHavoc, CVE-2026-25253, and 341 malicious skills: what the OpenClaw security research found, and a checklist to deploy it safely in 2026.

OpenClaw Security: Safe Deployment Guide

What Happens When a Service Is Missing? You've created a project on the Stacker dashboard, deployed it to a cloud server, and everything looks good - except the main application container isn't there. Only the database is running. This usually happens when the project was set up without a proper application template, leaving you with a half-empty stack. In this guide, we'll walk through a real scenario: an Umami analytics project that was deployed with only PostgreSQL and no Umami container. You'll learn how to inspect the deployment, add the missing app via the Stacker API, deploy it, and verify everything works - all from the command line. Quick Answer Use stacker agent status to inspect your deployment, then register the missing app via the Stacker API ( POST /project/{id}/apps ) and deploy it with stacker agent deploy-app . Step 1: Inspect the Current Deployment Start by checking what's actually running on your deployment agent. Use the stacker agent status command with your deployment hash: stacker agent status --deployment deployment_c837325f-34b3-4d1f-b4a0-e55a49cf8926 This shows you the running containers, their images, and their states: ──────────────────────────────────────────────────────────────────────────────────────────── Agent: ● online Heartbeat: 2026-07-01T18:31:56.563318Z ──────────────────────────────────────────────────────────────────────────────────────────── APP NAME IMAGE ENABLED postgres postgres postgres:latest yes ──────────────────────────────────────────────────────────────────────────────────────────── CONTAINER STATE PORTS IMAGE project-postgres-1 ⟳ restarting 5432 postgres:latest statuspanel_agent ▶ running - registry-intl.eu-central-1.… statuspanel ▶ running - registry-intl.eu-central-1.… ──────────────────────────────────────────────────────────────────────────────────────────── Notice only postgres appears in the APP list. The Umami analytics container is completely absent. Step 2: Get Detailed App Configuration For more detail, use the --json flag. This reveals the exact environment variables, port mappings, volumes, and network configuration of the running apps: stacker agent status --deployment deployment_c837325f-34b3-4d1f-b4a0-e55a49cf8926 --json Look for the apps array in the JSON output. For our postgres app: { "apps": [ { "code": "postgres", "image": "postgres:latest", "environment": { "POSTGRES_DB": "umami", "POSTGRES_USER": "umami", "POSTGRES_PASSWORD": "umami" }, "ports": [{"host_port": 5432, "container_port": 5432}], "networks": ["default_network"], ... } ] } This tells us the database credentials ( umami for user, password, and database name) - exactly what we need to configure the Umami container's DATABASE_URL . Step 3: Check If a Template Exists See what templates are available in the marketplace: stacker templates | grep -i umami stacker catalog | grep -i umami If nothing shows up, there's no Umami template you can simply install. You'll need to register the app manually. Step 4: Create the App via the Stacker API Apps are managed through the Stacker REST API. The endpoint is a POST to /project/{project_id}/apps - and it's an upsert, so you can safely run it multiple times. First, find your project ID and get your auth token from ~/.config/stacker/credentials.json : # List projects to find your project ID stacker projects | grep umami # Output: 243 umami 2026-06-30T08:49:12... # Your access token is stored here cat ~/.config/stacker/credentials.json Now create the Umami app: TOKEN="*******token*******" curl -s -X POST "https://try.direct/stacker/project/243/apps" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{ "code": "umami", "name": "Umami Analytics", "image": "ghcr.io/umami-software/umami:postgresql-latest", "environment": { "DATABASE_URL": "postgresql://umami:umami@postgres:5432/umami", "HASH_SALT": "3b8e9f1a7c2d5e4f6a0b9c8d7e6f5a4b3c2d1e0f" }, "ports": [ {"host_port": 3000, "container_port": 3000, "protocol": "tcp"} ], "depends_on": ["postgres"], "restart_policy": "always", "enabled": true, "deploy_order": 2 }' Successful response: { "message": "OK", "item": { "id": 28, "project_id": 243, "code": "umami", "name": "Umami Analytics", "image": "ghcr.io/umami-software/umami:postgresql-latest", "environment": { "DATABASE_URL": "postgresql://umami:umami@postgres:5432/umami", "HASH_SALT": "3b8e9f1a7c2d5e4f6a0b9c8d7e6f5a4b3c2d1e0f" }, "ports": [{"container_port": 3000, "host_port": 3000, "protocol": "tcp"}], "restart_policy": "always", "enabled": true, "deploy_order": 2, "created_at": "2026-07-01T18:39:11.469030Z", "updated_at": "2026-07-01T18:39:11.469030Z", "config_version": 1 } } Step 5: Plan and Deploy the App First, preview what deploy-app will do: stacker agent deploy-app umami \ --deployment deployment_c837325f-34b3-4d1f-b4a0-e55a49cf8926 \ --plan Expected plan output: { "hasChanges": true, "actions": [ { "kind": "redeploy_app", "target": "app", "appCode": "umami", "reason": "explicit deploy-app plan targets a single app" }, { "kind": "sync_app_config", "target": "app", "appCode": "umami", "reason": "app config version is ahead of the synced Vault/runtime version" } ] } Apply the plan: stacker agent deploy-app umami \ --deployment deployment_c837325f-34b3-4d1f-b4a0-e55a49cf8926 Successful deployment output: Command: cmd_513774de-e91e-4357-b886-8565f3ce3ef2 Type: deploy_app Status: ✓ completed { "app_code": "umami", "container_state": "running", "deployed_at": "2026-07-01T18:40:36Z", "status": "deployed" } Step 6: Verify Everything Is Running Check the status again: stacker agent status --deployment deployment_c837325f-34b3-4d1f-b4a0-e55a49cf8926 ──────────────────────────────────────────────────────────────────────────────────────────── Agent: ● online Heartbeat: 2026-07-01T18:40:36.661528Z ──────────────────────────────────────────────────────────────────────────────────────────── APP NAME IMAGE ENABLED postgres postgres postgres:latest yes umami Umami Analytics ghcr.io/umami-software/umam… yes ──────────────────────────────────────────────────────────────────────────────────────────── CONTAINER STATE PORTS IMAGE umami ▶ running - ghcr.io/umami-software/umam… postgres ▶ running - postgres:latest statuspanel_agent ▶ running - registry-intl.eu-central-1.… statuspanel ▶ running - registry-intl.eu-central-1.… ──────────────────────────────────────────────────────────────────────────────────────────── Both postgres and umami are now listed as apps and running. You can inspect the logs to confirm the application started correctly: stacker agent logs umami \ --deployment deployment_c837325f-34b3-4d1f-b4a0-e55a49cf8926 Look for key log lines: ✓ DATABASE_URL is defined. ✓ Database connection successful. ✓ Database is up to date. > umami@3.2.0 start-server > node server.js ▲ Next.js 16.2.6 - Local: http://localhost:3000 - Network: http://0.0.0.0:3000 ✓ Ready in 0ms Step 7: Configure a Domain Set a public domain for the new app via the API: curl -s -X PUT "https://try.direct/stacker/project/243/apps/umami/domain" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"domain": "umami.try.direct", "ssl_enabled": true}' Then configure the reverse proxy on the agent: stacker agent configure-proxy umami \ --domain umami.try.direct \ --port 3000 \ --ssl \ --deployment deployment_c837325f-34b3-4d1f-b4a0-e55a49cf8926 \ --force Troubleshooting Common Issues Issue 1: "service refers to undefined network" If the existing app has networks configured but the Docker Compose file lacks the network definition, update the existing app to remove the network reference: curl -s -X POST "https://try.direct/stacker/project/243/apps" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{ "code": "postgres", "image": "postgres:latest", ... }' Omitting the networks field lets Docker Compose use its default network, which all services can share. Issue 2: "service refers to undefined volume" Named volumes must be defined at the top level of the Compose file. If the deploy-app command complains about undefined volumes, remove the volumes configuration from the app definition (the data persists on disk via the existing container). Issue 3: Vault is unavailable Some operations (like configure-proxy ) require HashiCorp Vault for credential resolution. If Vault is unavailable, the proxy configuration step will fail. In this case, the app will still run and be accessible on its internal port - you can configure DNS and SSL manually on the server. Key Commands Reference Command Purpose stacker agent status --deployment Inspect running containers and apps stacker agent status --deployment --json Detailed JSON view with config stacker projects | grep Find your project ID POST /project/{id}/apps Register a new app (via API) stacker agent deploy-app --deployment Deploy the registered app to the agent stacker agent logs --deployment View container logs stacker agent configure-proxy --domain ... --port ... Set up reverse proxy and SSL How It All Fits Together The Stacker platform separates app registration from app deployment (done through the CLI, which sends commands to the remote agent). This two-step process gives you full control: API - Define the Docker image, environment variables, port mappings, volumes, restart policy, and deployment order CLI - Push the configuration to the remote server, pull the image, create the container, and wire it into the existing Docker Compose project This approach works for any containerized application, not just Umami. Whether you're adding Redis, a custom API, or a background worker, the workflow is identical. The next time you find a project deployed without its main application container, you now have the exact steps to fix it - inspect, register, deploy, verify.

Learn how to add a missing container service to an existing Stacker deployment using the Stacker CLI and API. Step-by-step walkthrough with real commands and output.

How to Add a Missing Service to a Stacker Deployment

Matomo is an open-source, privacy-first web analytics platform you can self-host. Compared to Google Analytics 4, it gives you 100% data ownership, no data sampling, unlimited retention, and a path to cookieless tracking that the French data protection authority has accepted as consent-exempt. You can deploy a ready-made Matomo stack to your own cloud from try.direct in minutes.

Google Analytics is free, and that is exactly the problem. You are not the customer, your visitors' data is the product. In return for a powerful tool at no cash cost, your numbers get sampled, your data lives on Google's servers, and your visitors get one more cookie banner to dismiss. For a lot of teams in 2026 that trade no longer makes sense.

Matomo is the most established alternative, and the comparison is more even than Google would like. Let us be fair to both, then show you the part most articles skip: how to actually run it.

The first is ownership. GA4 processes and stores your analytics data on Google's infrastructure, largely on US servers. You can read it through dashboards, but ultimate control sits with Google. For EU businesses and regulated industries, that raises real data-residency questions that no setting inside GA4 fully answers.

The second is accuracy. On the free tier, GA4 applies sampling to exploration reports once queries exceed roughly 10 million events. Above that threshold you are looking at estimates, not exact counts. Matomo processes 100% of your data at every traffic level, with no sampling threshold, so the number you see is the number that happened.

The third is retention. GA4 caps event-data retention at 14 months on standard properties. Self-hosted Matomo keeps your data for as long as you want, on your own disk, which matters the moment you need a true year-over-year comparison.

The fourth is consent fatigue. GA4's tracking model generally requires consent in the EU, which means a banner on every visit and lost data every time a visitor clicks reject.

Put plainly, the two tools optimize for different things.

Matomo, self-hosted, gives you complete data ownership on your own server, no sampling at any traffic level, retention for as long as you choose, and a cookieless mode that France's CNIL has accepted as exempt from consent. The software core is free and open source, and it can even import your historical Universal Analytics data so you do not start from zero.

Google Analytics 4 stores your data on Google's servers, samples large exploration reports on the free tier, caps standard retention at 14 months, and generally requires consent in the EU. It does not import Universal Analytics history.

Two things deserve a fair word for Google, though. GA4 is genuinely strong if you live in the Google Ads ecosystem, because it feeds conversion data straight into automated bidding and remarketing, and Matomo does not replicate that natively. Its AI-assisted insights also lower the barrier for teams without an analyst. If paid search is your main channel, that integration alone may keep you on GA4. This is a real tradeoff, not a one-sided pitch.

The data ownership point that actually matters

When your analytics run on someone else's cloud, you have outsourced a piece of your own understanding of your business. Where your traffic comes from, which pages convert, how visitors behave: that is competitive insight, and with GA4 it sits in a third party's system under their terms.

Self-hosted Matomo keeps all of it on infrastructure you control, in the jurisdiction you choose. You decide who can access it, how long to keep it, and when to delete it. That is a posture you can defend to a regulator, a client, or your own security team.

Cookieless tracking and the consent banner

This is the feature that drives most self-hosted adoption. Matomo has a privacy mode that anonymizes IP addresses at ingestion and operates without cookies. EU data protection authorities, including France's CNIL, have explicitly named Matomo's cookieless configuration as one that can run without a consent banner, on the basis that it does not constitute personal data processing.

No banner means no rejected visitors, which means more complete data and a cleaner experience. One honest caveat: the moment you enable behavioral features like session recording, you can re-enter consent territory, because replay can capture personal data on screen. Privacy mode is a deliberate configuration, not an automatic guarantee, so confirm your specific setup against your obligations.

Switching analytics usually means starting from zero. Matomo is an exception, because it can import historical Universal Analytics data, so the years of context you built up do not vanish the way they do when moving cold into GA4. For anyone who still has that old data sitting around, this turns a painful migration into a clean continuation.

Matomo is not magic. The core self-hosted platform is free and complete for standard reporting, but some advanced features such as funnels, certain behavioral tools, and a few premium plugins are paid add-ons. And like any self-hosted app, it needs a server, a database, and basic upkeep. That operational step is the reason many teams stall before they start.

The try.direct Matomo stack ships the platform with everything a real deployment needs, then installs it on your own cloud account. You get Matomo itself, a MySQL database with phpMyAdmin for management, Redis for performance, MyDumper for automated database backups, Fail2ban for protection, and a status panel to keep an eye on the containers. No manual database setup, no PHP tuning, no guesswork.

Run it on Hetzner, DigitalOcean, AWS, Vultr, UpCloud, or any VPS with Docker, and your visitor data never leaves infrastructure you control.

Ready to own your analytics? Deploy the free Matomo stack to your own cloud here: 

Is Matomo a real alternative to Google Analytics 4?

Yes. Matomo has been an established analytics platform for nearly two decades and covers the core analytics needs of most sites: traffic sources, page views, events, goals, and e-commerce, with full data ownership on top.

No. Matomo processes 100% of your data at all traffic levels. GA4 applies sampling to large exploration reports on the free tier.

Can I run Matomo without a cookie consent banner?

In its cookieless privacy mode, yes, in many EU scenarios. France's CNIL has named Matomo's cookieless configuration as exempt from consent. Always confirm your specific configuration against your own legal requirements, especially if you enable behavioral features.

Do I keep my old Universal Analytics data?

Matomo can import historical Universal Analytics data, so you do not have to start from scratch the way you do moving into GA4.

The self-hosted core is free and open source. Some advanced and behavioral features are paid plugins. Your other cost is the server you run it on.

Use the try.direct Matomo stack. It deploys Matomo with its database, caching, and automated backups to your own cloud in minutes, so you skip the manual setup entirely.

Matomo is an open-source, privacy-first web analytics platform you can self-host. Compared to Google Analytics 4, it gives you 100% data ownership, no data sampling, unlimited retention, and a path to cookieless tracking that the French data protection authority has accepted as consent-exempt. You can deploy a ready-made Matomo stack to your own cloud from try.direct in minutes.
Google Analytics is free, and that is exactly the problem. You are not the customer, your visitors' data is the product. In return for a powerful tool at no cash cost, your numbers get sampled, your data lives on Google's servers, and your visitors get one more cookie banner to dismiss. For a lot of teams in 2026 that trade no longer makes sense.
Matomo is the most established alternative, and the comparison is more even than Google would like. Let us be fair to both, then show you the part most articles skip: how to actually run it.

Why teams are leaving GA4
Four reasons come up again and again.
The first is ownership. GA4 processes and stores your analytics data on Google's infrastructure, largely on US servers. You can read it through dashboards, but ultimate control sits with Google. For EU businesses and regulated industries, that raises real data-residency questions that no setting inside GA4 fully answers.
The second is accuracy. On the free tier, GA4 applies sampling to exploration reports once queries exceed roughly 10 million events. Above that threshold you are looking at estimates, not exact counts. Matomo processes 100% of your data at every traffic level, with no sampling threshold, so the number you see is the number that happened.
The third is retention. GA4 caps event-data retention at 14 months on standard properties. Self-hosted Matomo keeps your data for as long as you want, on your own disk, which matters the moment you need a true year-over-year comparison.
The fourth is consent fatigue. GA4's tracking model generally requires consent in the EU, which means a banner on every visit and lost data every time a visitor clicks reject.

The honest comparison
Put plainly, the two tools optimize for different things.
Matomo, self-hosted, gives you complete data ownership on your own server, no sampling at any traffic level, retention for as long as you choose, and a cookieless mode that France's CNIL has accepted as exempt from consent. The software core is free and open source, and it can even import your historical Universal Analytics data so you do not start from zero.
Google Analytics 4 stores your data on Google's servers, samples large exploration reports on the free tier, caps standard retention at 14 months, and generally requires consent in the EU. It does not import Universal Analytics history.
Two things deserve a fair word for Google, though. GA4 is genuinely strong if you live in the Google Ads ecosystem, because it feeds conversion data straight into automated bidding and remarketing, and Matomo does not replicate that natively. Its AI-assisted insights also lower the barrier for teams without an analyst. If paid search is your main channel, that integration alone may keep you on GA4. This is a real tradeoff, not a one-sided pitch.

The data ownership point that actually matters
When your analytics run on someone else's cloud, you have outsourced a piece of your own understanding of your business. Where your traffic comes from, which pages convert, how visitors behave: that is competitive insight, and with GA4 it sits in a third party's system under their terms.
Self-hosted Matomo keeps all of it on infrastructure you control, in the jurisdiction you choose. You decide who can access it, how long to keep it, and when to delete it. That is a posture you can defend to a regulator, a client, or your own security team.

Cookieless tracking and the consent banner
This is the feature that drives most self-hosted adoption. Matomo has a privacy mode that anonymizes IP addresses at ingestion and operates without cookies. EU data protection authorities, including France's CNIL, have explicitly named Matomo's cookieless configuration as one that can run without a consent banner, on the basis that it does not constitute personal data processing.
No banner means no rejected visitors, which means more complete data and a cleaner experience. One honest caveat: the moment you enable behavioral features like session recording, you can re-enter consent territory, because replay can capture personal data on screen. Privacy mode is a deliberate configuration, not an automatic guarantee, so confirm your specific setup against your obligations.

Migrating without losing history
Switching analytics usually means starting from zero. Matomo is an exception, because it can import historical Universal Analytics data, so the years of context you built up do not vanish the way they do when moving cold into GA4. For anyone who still has that old data sitting around, this turns a painful migration into a clean continuation.

The honest cons
Matomo is not magic. The core self-hosted platform is free and complete for standard reporting, but some advanced features such as funnels, certain behavioral tools, and a few premium plugins are paid add-ons. And like any self-hosted app, it needs a server, a database, and basic upkeep. That operational step is the reason many teams stall before they start.
It is also the step try.direct removes.

Deploy Matomo the easy way
The try.direct Matomo stack ships the platform with everything a real deployment needs, then installs it on your own cloud account. You get Matomo itself, a MySQL database with phpMyAdmin for management, Redis for performance, MyDumper for automated database backups, Fail2ban for protection, and a status panel to keep an eye on the containers. No manual database setup, no PHP tuning, no guesswork.
Run it on Hetzner, DigitalOcean, AWS, Vultr, UpCloud, or any VPS with Docker, and your visitor data never leaves infrastructure you control.
Ready to own your analytics? Deploy the free Matomo stack to your own cloud here: 
➞ Matomo

Frequently asked questions
Is Matomo a real alternative to Google Analytics 4?
Yes. Matomo has been an established analytics platform for nearly two decades and covers the core analytics needs of most sites: traffic sources, page views, events, goals, and e-commerce, with full data ownership on top.

Does Matomo sample data like GA4?
No. Matomo processes 100% of your data at all traffic levels. GA4 applies sampling to large exploration reports on the free tier.

Can I run Matomo without a cookie consent banner?
In its cookieless privacy mode, yes, in many EU scenarios. France's CNIL has named Matomo's cookieless configuration as exempt from consent. Always confirm your specific configuration against your own legal requirements, especially if you enable behavioral features.

Do I keep my old Universal Analytics data?
Matomo can import historical Universal Analytics data, so you do not have to start from scratch the way you do moving into GA4.

Is Matomo free?
The self-hosted core is free and open source. Some advanced and behavioral features are paid plugins. Your other cost is the server you run it on.

How do I deploy it quickly?
Use the try.direct Matomo stack. It deploys Matomo with its database, caching, and automated backups to your own cloud in minutes, so you skip the manual setup entirely.

Matomo vs GA4: the open-source, self-hosted analytics with 100% data ownership, zero sampling, and cookieless tracking. See the comparison and deploy it.

Matomo vs GA4: Own Your Analytics Data

Wazuh is a free, open-source platform that unifies SIEM and XDR in one place. It gives you threat detection, file integrity monitoring, vulnerability scanning, and compliance reporting across your servers and cloud workloads, with no license fees and no per-gigabyte pricing. You can deploy a production-ready Wazuh stack to your own cloud from try.direct in minutes.

Here is the uncomfortable truth about most commercial security monitoring: your bill scales with the volume of logs you ingest, not with the number of threats you actually catch. The more visibility you try to buy, the more you pay to store data you may never query. Teams end up filtering out logs to control cost, which quietly shrinks the exact coverage a SIEM is supposed to provide. You are paying more to see less.

Wazuh flips that model. The software is free, the architecture is yours, and the only thing you pay for is the infrastructure you already control.

Wazuh is an open-source security platform that combines two things teams usually buy separately.

The SIEM side collects, normalizes, and analyzes logs from your endpoints, servers, network devices, and cloud workloads. It correlates events in real time and raises alerts when something looks like an attempted or successful intrusion, a misconfiguration, or a policy violation.

The XDR side runs a lightweight agent on each monitored system. Instead of only reading logs after the fact, it watches what is happening on the host itself: file changes, suspicious processes, malware and rootkit indicators, and signs of compromise. When an alert fires, you do not just see a strange login, you see what happened on that machine before and after it.

Putting both in one platform is the point. A log line on its own is noise. A log line plus host context is an investigation you can actually close.

A default Wazuh deployment already covers most of what a small security team needs, and it covers it without a single license key.

On the detection side, Wazuh handles log collection and rule-based correlation across all your systems, flags attempted and successful intrusions, and watches for malware, rootkits, hidden files, and cloaked processes directly on each host. File integrity monitoring tracks changes to the files, permissions, and ownership you care about, and records which user or process made each change, which is exactly the kind of evidence you want during an incident.

On the prevention side, it continuously compares your installed software against updated CVE databases so you find vulnerable packages before an attacker does, and it runs configuration checks against hardening guides to catch risky settings early. When something does go wrong, active response can run automated countermeasures, such as blocking a source address when your criteria are met, and every detected event is mapped to the relevant MITRE ATT&CK tactics so your analysts spend less time guessing and more time responding.

Wazuh reports more than 15 million downloads per year and runs one of the largest open-source security communities in the world. It was also named a 2026 Cybersecurity Stars Awards winner for Best SIEM Platform and Best Cloud Security Platform. This is not a science project, it is a platform large organizations run in production.

If you have ever sat through a PCI DSS or ISO audit, you know that "we have logs somewhere" is not an acceptable answer. Auditors want centralized log collection, file integrity monitoring, and evidence that you review security events.

Wazuh ships with dashboards and reporting aligned to common frameworks including PCI DSS, GDPR, HIPAA, and NIST. File integrity monitoring alone satisfies a specific PCI DSS requirement that many teams scramble to meet at audit time. Because you self-host, the data lives on infrastructure you control, in a jurisdiction you choose, which is exactly the posture regulated buyers increasingly need.

Self-hosted vs managed: the honest tradeoff

Wazuh is free, but it is not effortless. The platform has real depth, and getting the indexer, server, dashboard, and agents wired together correctly takes time and Linux comfort. A managed cloud SIEM hands you a login and a bill. Self-hosted Wazuh hands you full control and a setup task.

That setup task is the friction that stops most teams from switching, even when the cost savings are obvious. It is also exactly the part try.direct removes.

The try.direct Wazuh stack packages the platform with the pieces a real deployment needs, then deploys the whole thing to your own cloud account. You get Wazuh for detection and monitoring, Fail2ban for an extra layer of brute-force protection, Netdata for host-level performance visibility, Portainer for container management, and baseline optimization applied during setup. No manual indexer tuning, no YAML marathon, no weekend lost to install docs.

You run it on Hetzner, DigitalOcean, AWS, Vultr, UpCloud, or any VPS with Docker. The data stays yours.

Ready to start? Deploy the free Wazuh stack to your own cloud here:

Yes. Wazuh is open source and free to download and self-host, even for large organizations. Your costs are the servers you run it on and any optional paid support, not the software itself.

For core SIEM work like log collection, correlation, detection, and dashboards, Wazuh is a credible replacement, and it avoids the per-gigabyte licensing that makes commercial tools expensive at scale. Very large enterprises with heavy advanced-analytics needs should evaluate against their specific requirements.

Endpoints, servers, virtual machines, containers, and cloud workloads. It handles log analysis, intrusion detection, file integrity monitoring, vulnerability detection, configuration assessment, and automated response.

Yes. It includes reporting and controls mapped to standards such as PCI DSS, GDPR, HIPAA, and NIST. Self-hosting also keeps your security data in a jurisdiction you control.

With the try.direct Wazuh stack, a working deployment to your own cloud takes minutes rather than the hours a manual install can require.

A VPS with Docker on a provider like Hetzner, DigitalOcean, AWS, Vultr, or UpCloud. The stack handles the rest.

Wazuh is a free, open-source platform that unifies SIEM and XDR in one place. It gives you threat detection, file integrity monitoring, vulnerability scanning, and compliance reporting across your servers and cloud workloads, with no license fees and no per-gigabyte pricing. You can deploy a production-ready Wazuh stack to your own cloud from try.direct in minutes.
Here is the uncomfortable truth about most commercial security monitoring: your bill scales with the volume of logs you ingest, not with the number of threats you actually catch. The more visibility you try to buy, the more you pay to store data you may never query. Teams end up filtering out logs to control cost, which quietly shrinks the exact coverage a SIEM is supposed to provide. You are paying more to see less.
Wazuh flips that model. The software is free, the architecture is yours, and the only thing you pay for is the infrastructure you already control.

What Wazuh actually is
Wazuh is an open-source security platform that combines two things teams usually buy separately.
The SIEM side collects, normalizes, and analyzes logs from your endpoints, servers, network devices, and cloud workloads. It correlates events in real time and raises alerts when something looks like an attempted or successful intrusion, a misconfiguration, or a policy violation.
The XDR side runs a lightweight agent on each monitored system. Instead of only reading logs after the fact, it watches what is happening on the host itself: file changes, suspicious processes, malware and rootkit indicators, and signs of compromise. When an alert fires, you do not just see a strange login, you see what happened on that machine before and after it.
Putting both in one platform is the point. A log line on its own is noise. A log line plus host context is an investigation you can actually close.

What you get out of the box
A default Wazuh deployment already covers most of what a small security team needs, and it covers it without a single license key.
On the detection side, Wazuh handles log collection and rule-based correlation across all your systems, flags attempted and successful intrusions, and watches for malware, rootkits, hidden files, and cloaked processes directly on each host. File integrity monitoring tracks changes to the files, permissions, and ownership you care about, and records which user or process made each change, which is exactly the kind of evidence you want during an incident.
On the prevention side, it continuously compares your installed software against updated CVE databases so you find vulnerable packages before an attacker does, and it runs configuration checks against hardening guides to catch risky settings early. When something does go wrong, active response can run automated countermeasures, such as blocking a source address when your criteria are met, and every detected event is mapped to the relevant MITRE ATT&CK tactics so your analysts spend less time guessing and more time responding.
Wazuh reports more than 15 million downloads per year and runs one of the largest open-source security communities in the world. It was also named a 2026 Cybersecurity Stars Awards winner for Best SIEM Platform and Best Cloud Security Platform. This is not a science project, it is a platform large organizations run in production.

The compliance angle
If you have ever sat through a PCI DSS or ISO audit, you know that "we have logs somewhere" is not an acceptable answer. Auditors want centralized log collection, file integrity monitoring, and evidence that you review security events.
Wazuh ships with dashboards and reporting aligned to common frameworks including PCI DSS, GDPR, HIPAA, and NIST. File integrity monitoring alone satisfies a specific PCI DSS requirement that many teams scramble to meet at audit time. Because you self-host, the data lives on infrastructure you control, in a jurisdiction you choose, which is exactly the posture regulated buyers increasingly need.

Self-hosted vs managed: the honest tradeoff
Wazuh is free, but it is not effortless. The platform has real depth, and getting the indexer, server, dashboard, and agents wired together correctly takes time and Linux comfort. A managed cloud SIEM hands you a login and a bill. Self-hosted Wazuh hands you full control and a setup task.
That setup task is the friction that stops most teams from switching, even when the cost savings are obvious. It is also exactly the part try.direct removes.

Deploy Wazuh the easy way
The try.direct Wazuh stack packages the platform with the pieces a real deployment needs, then deploys the whole thing to your own cloud account. You get Wazuh for detection and monitoring, Fail2ban for an extra layer of brute-force protection, Netdata for host-level performance visibility, Portainer for container management, and baseline optimization applied during setup. No manual indexer tuning, no YAML marathon, no weekend lost to install docs.
You run it on Hetzner, DigitalOcean, AWS, Vultr, UpCloud, or any VPS with Docker. The data stays yours.
Ready to start? Deploy the free Wazuh stack to your own cloud here:

➞ Wazuh

Frequently asked questions
Is Wazuh really free?
Yes. Wazuh is open source and free to download and self-host, even for large organizations. Your costs are the servers you run it on and any optional paid support, not the software itself.

Can Wazuh replace Splunk or Datadog?
For core SIEM work like log collection, correlation, detection, and dashboards, Wazuh is a credible replacement, and it avoids the per-gigabyte licensing that makes commercial tools expensive at scale. Very large enterprises with heavy advanced-analytics needs should evaluate against their specific requirements.

What does Wazuh monitor?
Endpoints, servers, virtual machines, containers, and cloud workloads. It handles log analysis, intrusion detection, file integrity monitoring, vulnerability detection, configuration assessment, and automated response.

Does Wazuh help with compliance?
Yes. It includes reporting and controls mapped to standards such as PCI DSS, GDPR, HIPAA, and NIST. Self-hosting also keeps your security data in a jurisdiction you control.

How long does it take to deploy?
With the try.direct Wazuh stack, a working deployment to your own cloud takes minutes rather than the hours a manual install can require.

What infrastructure do I need?
A VPS with Docker on a provider like Hetzner, DigitalOcean, AWS, Vultr, or UpCloud. The stack handles the rest.

Wazuh is a free, open-source SIEM and XDR you can self-host. Get threat detection, file integrity monitoring, and compliance, with no per-gigabyte fees.

Self-Host Wazuh: Free Open-Source SIEM/XDR

Effective date: 2026-06-24. Audience: marketplace creators. This policy defines what is allowed and what is not allowed on the TryDirect marketplace. Reviewers reject submissions that violate these rules and cite the specific section in feedback. Creators should review this before submitting. 1. Hard prohibitions - never allowed Templates in the following categories are rejected on sight and cannot be made compliant. Repeated submissions may result in creator account termination. Illegal or harmful software Malware, ransomware, spyware, stalkerware, rootkits, RATs (remote access trojans). Botnets, command-and-control frameworks for unauthorised use, DDoS tools. Credential-stuffing tools, password brute-forcers, account-cracking tools. Phishing kits, fake-login templates, credential-harvesting frontends. Exploit kits and weaponised vulnerability scanners targeting third parties. Cryptojackers - software that mines cryptocurrency without consent. Dual-use security tooling (pentesting frameworks, fuzzing tools, reverse engineering tools) is allowed if the template is clearly labelled for authorised security testing, includes a usage warning, and ships with safe defaults (no auto-exploitation, no scanning of arbitrary targets). Illegal content distribution Child sexual abuse material (CSAM) - zero tolerance, reported to authorities. Content promoting terrorism, mass violence, or genocide. Content inciting violence against a person or group. Stolen credentials, leaked databases, doxing tools. Trademark infringement (e.g. fake brand storefronts). Templates that exist primarily to distribute pirated software, media, or game keys. Fraud and financial crime Unlicensed financial services (lending, payment processing, crypto exchanges in jurisdictions that require licensing). Tools designed for tax evasion, money laundering, or sanctions evasion. Carding tools, fake-ID generators, synthetic identity tools. Multi-level marketing platforms that meet the FTC pyramid-scheme criteria. Templates that misrepresent TryDirect or another brand's identity. Debt-relief, debt-settlement, or debt-negotiation templates. Identity-theft protection or credit-repair service templates. Bail-bond or bankruptcy-lawyer service templates. Loan-repayment-by-credit-card platforms or credit-counselling services. Negative-option marketing, telemarketing, or door-to-door-sales management templates. Government-service templates that impersonate agencies or lack authorisation. Illegal marketplaces and listings Drug marketplaces (controlled substances). Weapons or ammunition sales platforms. Human trafficking, prostitution, escort booking platforms. Wildlife trafficking, endangered-species trade. Stolen-goods marketplaces. 2. Restricted - allowed only under specific conditions The following categories are allowed but require explicit conditions. Reviewers verify each condition before approval. Category Allowed if... Crypto mining software (consensual) Template makes mining the explicit primary purpose, deploys only to the creator's or buyer's own infrastructure, and includes electricity-cost disclosure. Email-sending platforms Designed for transactional email or owned-list newsletters; not optimised for cold outreach or list scraping; complies with CAN-SPAM and GDPR consent requirements. Web scrapers Respects robots.txt by default, includes rate-limiting, prominently documents the legal obligation to honour target-site Terms of Service. Proxy or VPN services Not anonymising for illegal activity; logs disclosure clear; includes abuse-handling contact in template config. Adult content platforms Legal in the deployment jurisdiction; ships with strict age-verification (18+ wall) enabled by default; not targeting jurisdictions where pornography is illegal. Gambling or poker platforms Licensed-operator-only (template enforces licence-key validation); ships with self-exclusion and responsible-gambling tooling enabled. Tobacco, alcohol, cannabis storefronts Legal in the deployment jurisdiction; age-verification on by default; complies with local advertising rules. AI agents with autonomous action capability Documented permission model; ships with sane defaults (no auto-execution of shell commands, no auto-transfer of funds). Forks of existing open-source projects Original licence preserved and visible; creator has the right to redistribute (or the original licence permits it); template attributes the original maintainer in the long description. 3. Security and quality rules Templates that compromise the security of the buyer's infrastructure are rejected. This is the most common rejection category in practice. Embedded credentials No hardcoded passwords, API keys, secrets, tokens, certificates, or SSH keys in any file shipped with the template (compose files, env files, configs, volumes, scripts). Use environment variable interpolation ( ${VAR} ) and document required variables in the template's long description. If a service needs a default password (for example, databases), the template must generate a random one at first boot, not ship with a known default. Insecure defaults No --api.insecure=true or equivalent insecure-mode flags. No services bound to 0.0.0.0 when 127.0.0.1 or a private network is appropriate. No services without authentication when authentication is available. No outdated versions of services with known CVEs at submission time. No docker.sock mounts unless absolutely required, and only with docker-socket-proxy or equivalent least-privilege wrapper. No containers running as root unless the underlying service requires it and the template documents why. Misleading metadata The listed services must match what is actually deployed (no bait-and-switch). The category and tags must reflect the actual purpose. The support URL must resolve to a real support channel. The pricing must match what the buyer is charged. The long description must not promise features the template does not deliver. Outdated and unmaintained software Service versions must be supported upstream at submission time. Templates relying on end-of-life software (for example, Python 2, Node 12, PostgreSQL 11 and earlier, MySQL 5.7 and earlier) are rejected unless the unsupported software is the explicit subject of the template (such as a security training lab) and is clearly labelled as such. Hidden network calls Templates must not phone home to the creator's infrastructure without the buyer's explicit knowledge. Any telemetry, license check, or update check call must be documented in the long description with the exact endpoints and data sent. Call-home patterns that would let the creator track buyer deployments, harvest data, or remotely disable a template are not allowed. 4. Required practices Every published template must: Deploy cleanly to a fresh server on at least one supported cloud provider. Include a clear long description explaining purpose, required environment variables, and customisation points. Include working SSL/TLS configuration when exposing services to the public internet (Let's Encrypt or equivalent, automated). Document any expected ongoing costs (third-party API usage, model hosting, storage growth). Include healthchecks for each long-running service. Document the reset and uninstall procedure. 5. Content moderation and takedown How we hear about violations TryDirect responds to credible reports from: Buyers via the in-app report button or support@try.direct . Rightsholders for IP-infringement claims (see section 6). Law enforcement requests valid under applicable law. Independent security researchers via the responsible-disclosure policy. Takedown process When a violation is confirmed: Template is delisted from /applications immediately. Existing buyers are notified within 7 days. Existing deployments continue to function. TryDirect does not remotely destroy buyer infrastructure. Creator is notified with the specific violation cited. Creator may appeal within 14 days via support@try.direct . Earnings from sales prior to delisting are paid out per the standard schedule. Repeated violations First violation: warning and delisting of the specific template. Second violation: 90-day publishing suspension. Third violation: permanent ban from publishing. Severe violations (CSAM, malware) result in immediate permanent ban without warning. 6. Intellectual property Creator representation By submitting a template, the creator represents that: They own the rights to all content in the template, or have permission to redistribute it. The template's use of open-source software complies with the relevant licences (MIT, Apache 2, GPL, AGPL, etc.) including attribution requirements. The template does not infringe any patent, trademark, or copyright. DMCA / IP takedown TryDirect honours valid DMCA-style takedown notices. Rightsholders may submit takedown requests to dmca@try.direct with: Identification of the copyrighted work claimed to be infringed. Identification of the specific template alleged to infringe. Contact information. Good-faith statement and statement under penalty of perjury. Creators receive counter-notice rights consistent with DMCA Section 512(g). AGPL and copyleft considerations Templates incorporating AGPL software must: Clearly state the AGPL licensing in the long description. Make any modifications to AGPL components publicly available per AGPL Section 13. Not strip AGPL notices from the bundled software. 7. Geographic and legal compliance Creators are responsible for the legality of their template in jurisdictions where they market and sell it. TryDirect may geofence specific templates if required by applicable law (sanctions, export controls, age verification). Templates that violate US, EU, or other major-jurisdiction law are removed regardless of where the creator is based. 8. Changes to this policy TryDirect may update this policy at any time. Material changes affecting already-listed templates are announced via email and in the creator dashboard at least 30 days before they take effect. Templates that become non-compliant due to a policy change are given the same 30-day window to either become compliant or be delisted. Questions Email support@try.direct for general questions, or dmca@try.direct for IP takedown notices. See the Marketplace Payout Terms for revenue share, payout schedule, and tax details.

What is allowed and what is not allowed on the TryDirect marketplace: hard prohibitions, restricted categories, security and quality requirements, and the takedown process.

Marketplace Acceptable Use Policy

Effective date: 2026-06-24. Audience: marketplace creators. This page defines how TryDirect pays marketplace creators. It is the authoritative source for revenue share, payout schedule, supported methods, chargebacks, taxes, and account closure. Anything stated in marketing copy, the creator dashboard, or support communication matches what is here. 1. Revenue share Creators keep 75% of every sale. TryDirect retains a 25% platform fee, which covers payment processing (around 3%), marketplace hosting and promotion, review work, and ongoing platform development. For subscription products, the 75/25 split applies to every renewal cycle , not only the first sale. To avoid rounding errors, the creator share is always calculated as the remainder: creator_payout = gross_sale - platform_fee , where platform_fee = round(gross_sale × 0.25, 2) . 2. Payout schedule Payouts are monthly, Net-30 . Sales that settle in a calendar month are paid out by the 30th of the following month. Sales settled in Paid out by January February 28 February March 30 March April 30 June July 30 December January 30 (next year) "Settled" means the payment has cleared the payment provider and the chargeback window has closed: typically 1-7 days after capture for cards, longer for disputed transactions. 3. Minimum payout threshold The minimum payout is $50 USD . If your available balance at the end of a settlement cycle is below $50, it rolls forward to the next cycle. This avoids transfer fees on tiny amounts and lets creators batch payouts efficiently. Creators with balances under $50 still see full earnings in the dashboard - they are simply not paid until the threshold is crossed. 4. Payout methods Pick one of two methods during onboarding at /dashboard/marketplace/submissions?tab=earnings . You can switch later from the same dashboard. Stripe Connect Express Available in 35+ countries (see Stripe's country list). Direct bank transfer in local currency where supported. Stripe Connect KYC required during onboarding (real name, address, tax ID). PayPal Available worldwide where PayPal operates. Paid to the creator's PayPal email. Recipient is responsible for PayPal's currency conversion fees. 5. Chargebacks, refunds, and disputes Before payout If a sale is refunded or charged back before the monthly payout, the sale is removed from that month's creator balance - no clawback needed. After payout If a buyer disputes a sale after the payout has been sent: The disputed amount is deducted from the creator's next available balance. TryDirect does not issue retroactive clawbacks from already-paid funds. If the next month's balance is insufficient, the negative balance carries forward until enough new sales offset it. Dispute window Card payment disputes can be filed up to 180 days after purchase. PayPal disputes: 180 days. Creators should account for this when reading their pending balance. Refund policy Buyers may request a refund within 14 days of purchase if the template fails to deploy and the creator has not resolved the issue. Refunds reverse the creator's share for that specific sale. 6. Taxes What TryDirect collects US creators: Form W-9 during onboarding. Annual 1099-NEC issued for creators earning $600+ in a calendar year. Non-US creators: Form W-8BEN (individuals) or W-8BEN-E (entities) during onboarding. Annual earnings statement provided on request. EU creators: VAT handling per the marketplace VAT regime; statements provided for VAT return purposes. What creators are responsible for Reporting marketplace income to their local tax authority. VAT registration in their jurisdiction if applicable. Sales tax in jurisdictions that require collection on digital goods (TryDirect handles US sales tax via the marketplace facilitator regime where applicable). TryDirect does not provide tax advice. Consult a local tax professional. 7. Currencies Pricing: USD only at launch. EUR pricing on roadmap. Payouts: in the currency Stripe Connect or PayPal supports for the creator's country. FX conversion is at the payment provider's published rate. Dashboard display: USD, with optional local currency conversion shown at the dashboard's current FX snapshot (informational only). 8. Changes to these terms TryDirect may update payout terms at any time. Changes that affect existing creators are announced via email and in the dashboard at least 30 days before they take effect. Active sales already in the pipeline at the time of a change continue under the previous terms. Future sales follow the new terms. 9. Account closure and final payout If a creator closes their account or TryDirect terminates the account: Voluntary closure: any balance at or above $50 is paid out in the next scheduled cycle. Balances below $50 are paid in a final manual payout within 60 days. Termination for cause (fraud, Terms of Service violation, illegal content): balances may be withheld up to the dispute window (180 days) and used to offset chargebacks, refunds, or restitution. Questions Email support@try.direct for help with onboarding, payouts, tax forms, or any clarifications. The Marketplace Acceptable Use Policy is the companion document defining what may and may not be sold.

How TryDirect pays marketplace creators: 75% revenue share, monthly Net-30 payouts via Stripe Connect or PayPal, $50 minimum threshold, and clear chargeback policy.

Marketplace Payout Terms

The 15-minute setup that takes three months to finish

Every MCP server has the same origin story. Someone runs a one-line install, connects it to Claude or another agent, and within fifteen minutes it's pulling data from a ticketing system or a database. It works. It feels like magic.

Then someone asks an obvious question: who else can use this, and what happens when it touches production data?

That question is where the real work begins. The gap between "MCP server running on my laptop" and "MCP infrastructure my whole team can trust" isn't a gap in features. It's a gap in everything that doesn't show up in a quickstart guide: authentication, access control, logging, and isolation.

Here's what actually closes that gap, and how to get there without turning it into a months-long infrastructure project.

The Model Context Protocol (MCP) is a standard that lets AI agents connect to external tools and data sources through a common interface. Instead of writing custom integration code for every tool an agent needs, MCP gives agents a consistent way to discover and call tools.

An MCP gateway sits between AI agents and the MCP servers they talk to. It acts as a single entry point that handles authentication, routing, logging, and policy enforcement for all MCP traffic, instead of leaving every individual MCP server to handle these concerns on its own.

Put simply, an MCP server exposes one set of tools, while an MCP gateway manages access to many MCP servers at once and makes that access auditable and controllable.

Why "it works locally" isn't the same as "it's ready for production"

A local MCP setup usually has no authentication beyond a config file, no logging beyond stdout, and no isolation between what the agent can technically do and what it should be allowed to do. That's fine for one developer testing one tool.

It stops being fine the moment more than one person, one agent, or one environment is involved. At that point, four questions need real answers:

Who is allowed to call which tools? Without role-based access control, every agent that connects to the gateway can call every tool behind it. That's a problem the moment one of those tools can delete records, send emails, or push code.

What did an agent actually do, and when? If an agent takes an unexpected action, "check the logs" needs to mean something. An audit trail that records every tool call, its parameters, and its result is the difference between debugging an incident in minutes and not being able to reconstruct it at all.

Can a tool be restricted without forking it? Sometimes a third-party MCP server exposes more than you want agents to use. Production setups need a way to create a restricted variant of a tool, limiting parameters or disabling specific actions, without modifying the original server's code.

What happens if an agent goes off-script? Sandboxing and short-lived, isolated execution environments contain the blast radius of a misbehaving agent or a malicious prompt injection, so a single bad action doesn't cascade into the rest of the stack.

None of these are exotic requirements. They're the same operational basics that any internal API has had to deal with for years. MCP just brings them back into focus, because the "client" calling your tools is now an autonomous agent making its own decisions about what to call and when.

Self-hosted vs managed: what actually changes

Managed MCP gateway platforms exist for a reason: they hide most of the operational work behind a dashboard. But "hidden" doesn't mean "gone." Someone is still running the gateway, patching it, and deciding what data passes through a third party's infrastructure.

For teams with data residency requirements, contractual restrictions on where data can flow, or simply a preference for owning their stack, self-hosting an MCP gateway makes more sense. The tradeoff has traditionally been operational burden: setting up the gateway, the MCP servers behind it, networking, and monitoring all became someone's part-time job.

That tradeoff is exactly what container orchestration was built to remove. An MCP gateway and the MCP servers it routes to are, from an infrastructure point of view, just another set of containers with defined dependencies, networking rules, and environment variables. The same multi-container patterns used for web app stacks apply directly.

What a self-hosted MCP gateway stack looks like

A practical self-hosted MCP setup is typically composed of a small number of services working together:

A gateway container handles incoming connections from agents, authenticates them, and routes requests to the correct MCP server based on policy.

One or more MCP server containers each expose a specific set of tools: a database connector, a ticketing system integration, a documentation search tool, and so on.

A policy and logging layer stores access rules and writes an audit trail of every tool call, often backed by a small database or log aggregation service.

A network boundary restricts which containers can reach which internal resources, so an MCP server connecting to a ticketing system has no path to, say, a production database it has no business touching.

Defined as a Compose file, this is a handful of services with clear roles and explicit connections between them. The complexity isn't in any single piece. It's in getting all the pieces configured correctly together, and keeping them that way as MCP servers get added or updated.

This is precisely the kind of stack try.direct is built for: multiple containers that need to work together, deployed on infrastructure you control, without hand-assembling configuration from scratch every time.

Instead of provisioning a server, installing Docker, writing a Compose file from a half-finished tutorial, and debugging networking between containers, a pre-composed MCP gateway stack can be deployed and reused as a unit. The gateway, the MCP servers behind it, and the network rules connecting them are defined once and deployed consistently, whether that's a single environment for testing or separate environments for different teams.

For organizations that need their AI agent infrastructure to stay on infrastructure they own, whether for compliance reasons, data residency, or simply control, this turns "self-hosted MCP gateway" from a multi-week infrastructure project into something that can be stood up, modified, and redeployed in the time it takes to review a Compose file.

Is MCP only useful for large enterprises? 

No. The protocol itself is lightweight and works for a single developer connecting one agent to one tool. The gateway layer, with authentication, access control, and audit logging, becomes important once more than one person or one agent depends on the same tools.

Can a self-hosted MCP gateway connect to cloud-based AI models?

Yes. Self-hosting the gateway and the MCP servers behind it controls where your data and tool access live. It doesn't restrict which AI models or agent platforms connect to that gateway; the gateway is the boundary, not the model.

What's the difference between an MCP server and an MCP gateway?

An MCP server exposes a specific set of tools, for example a connector to a single database or ticketing system. A gateway sits in front of one or more MCP servers and handles shared concerns: authentication, routing, access policy, and logging across all of them.

Do I need Kubernetes to run an MCP gateway in production?

Not necessarily. Docker Compose is sufficient for many production deployments, particularly for small to mid-sized teams. Kubernetes adds value at larger scale or when workloads need to scale dynamically, but it isn't a requirement to have authentication, audit logging, and isolation in place.

The hard part of MCP was never the protocol itself. It's everything that surrounds it once the question shifts from "does this work" to "can I trust this in production." Self-hosting closes that gap without handing your data and tool access over to a third party. And with the right deployment approach, it doesn't have to cost you months of infrastructure work either.

The 15-minute setup that takes three months to finish

Every MCP server has the same origin story. Someone runs a one-line install, connects it to Claude or another agent, and within fifteen minutes it's pulling data from a ticketing system or a database. It works. It feels like magic.
Then someone asks an obvious question: who else can use this, and what happens when it touches production data?
That question is where the real work begins. The gap between "MCP server running on my laptop" and "MCP infrastructure my whole team can trust" isn't a gap in features. It's a gap in everything that doesn't show up in a quickstart guide: authentication, access control, logging, and isolation.
Here's what actually closes that gap, and how to get there without turning it into a months-long infrastructure project.

What is an MCP gateway?

The Model Context Protocol (MCP) is a standard that lets AI agents connect to external tools and data sources through a common interface. Instead of writing custom integration code for every tool an agent needs, MCP gives agents a consistent way to discover and call tools.
An MCP gateway sits between AI agents and the MCP servers they talk to. It acts as a single entry point that handles authentication, routing, logging, and policy enforcement for all MCP traffic, instead of leaving every individual MCP server to handle these concerns on its own.
Put simply, an MCP server exposes one set of tools, while an MCP gateway manages access to many MCP servers at once and makes that access auditable and controllable.

Why "it works locally" isn't the same as "it's ready for production"

A local MCP setup usually has no authentication beyond a config file, no logging beyond stdout, and no isolation between what the agent can technically do and what it should be allowed to do. That's fine for one developer testing one tool.
It stops being fine the moment more than one person, one agent, or one environment is involved. At that point, four questions need real answers:
Who is allowed to call which tools? Without role-based access control, every agent that connects to the gateway can call every tool behind it. That's a problem the moment one of those tools can delete records, send emails, or push code.
What did an agent actually do, and when? If an agent takes an unexpected action, "check the logs" needs to mean something. An audit trail that records every tool call, its parameters, and its result is the difference between debugging an incident in minutes and not being able to reconstruct it at all.
Can a tool be restricted without forking it? Sometimes a third-party MCP server exposes more than you want agents to use. Production setups need a way to create a restricted variant of a tool, limiting parameters or disabling specific actions, without modifying the original server's code.
What happens if an agent goes off-script? Sandboxing and short-lived, isolated execution environments contain the blast radius of a misbehaving agent or a malicious prompt injection, so a single bad action doesn't cascade into the rest of the stack.
None of these are exotic requirements. They're the same operational basics that any internal API has had to deal with for years. MCP just brings them back into focus, because the "client" calling your tools is now an autonomous agent making its own decisions about what to call and when.

Self-hosted vs managed: what actually changes

Managed MCP gateway platforms exist for a reason: they hide most of the operational work behind a dashboard. But "hidden" doesn't mean "gone." Someone is still running the gateway, patching it, and deciding what data passes through a third party's infrastructure.
For teams with data residency requirements, contractual restrictions on where data can flow, or simply a preference for owning their stack, self-hosting an MCP gateway makes more sense. The tradeoff has traditionally been operational burden: setting up the gateway, the MCP servers behind it, networking, and monitoring all became someone's part-time job.
That tradeoff is exactly what container orchestration was built to remove. An MCP gateway and the MCP servers it routes to are, from an infrastructure point of view, just another set of containers with defined dependencies, networking rules, and environment variables. The same multi-container patterns used for web app stacks apply directly.

What a self-hosted MCP gateway stack looks like

A practical self-hosted MCP setup is typically composed of a small number of services working together:
A gateway container handles incoming connections from agents, authenticates them, and routes requests to the correct MCP server based on policy.
One or more MCP server containers each expose a specific set of tools: a database connector, a ticketing system integration, a documentation search tool, and so on.
A policy and logging layer stores access rules and writes an audit trail of every tool call, often backed by a small database or log aggregation service.
A network boundary restricts which containers can reach which internal resources, so an MCP server connecting to a ticketing system has no path to, say, a production database it has no business touching.
Defined as a Compose file, this is a handful of services with clear roles and explicit connections between them. The complexity isn't in any single piece. It's in getting all the pieces configured correctly together, and keeping them that way as MCP servers get added or updated.

Where try.direct fits in

This is precisely the kind of stack try.direct is built for: multiple containers that need to work together, deployed on infrastructure you control, without hand-assembling configuration from scratch every time.
Instead of provisioning a server, installing Docker, writing a Compose file from a half-finished tutorial, and debugging networking between containers, a pre-composed MCP gateway stack can be deployed and reused as a unit. The gateway, the MCP servers behind it, and the network rules connecting them are defined once and deployed consistently, whether that's a single environment for testing or separate environments for different teams.
For organizations that need their AI agent infrastructure to stay on infrastructure they own, whether for compliance reasons, data residency, or simply control, this turns "self-hosted MCP gateway" from a multi-week infrastructure project into something that can be stood up, modified, and redeployed in the time it takes to review a Compose file.

Frequently asked questions

Is MCP only useful for large enterprises? 
No. The protocol itself is lightweight and works for a single developer connecting one agent to one tool. The gateway layer, with authentication, access control, and audit logging, becomes important once more than one person or one agent depends on the same tools.

Can a self-hosted MCP gateway connect to cloud-based AI models?
Yes. Self-hosting the gateway and the MCP servers behind it controls where your data and tool access live. It doesn't restrict which AI models or agent platforms connect to that gateway; the gateway is the boundary, not the model.

What's the difference between an MCP server and an MCP gateway?
An MCP server exposes a specific set of tools, for example a connector to a single database or ticketing system. A gateway sits in front of one or more MCP servers and handles shared concerns: authentication, routing, access policy, and logging across all of them.

Do I need Kubernetes to run an MCP gateway in production?
Not necessarily. Docker Compose is sufficient for many production deployments, particularly for small to mid-sized teams. Kubernetes adds value at larger scale or when workloads need to scale dynamically, but it isn't a requirement to have authentication, audit logging, and isolation in place.

The takeaway

The hard part of MCP was never the protocol itself. It's everything that surrounds it once the question shifts from "does this work" to "can I trust this in production." Self-hosting closes that gap without handing your data and tool access over to a third party. And with the right deployment approach, it doesn't have to cost you months of infrastructure work either.

What a self-hosted MCP gateway needs for production: auth, RBAC, audit logs, and sandboxing. Deploy one on your own infrastructure with Docker.

Self-Hosted MCP Gateways: From Demo to Production

AI agents are no longer confined to chat windows. They read files, call APIs, write to databases, and execute code autonomously. That changes the security model entirely. A misconfigured agent is not just a buggy service; it is a privileged process that handles untrusted input and has broad tool access by design.

This guide covers three layers that actually matter: why standard Docker containers are not enough, how gVisor and Kata Containers raise the isolation floor, and how Docker's MCP Toolkit lets you enforce least-privilege at the tool layer.

1. Why Standard Docker Containers Are Not Enough

Docker containers isolate through Linux namespaces, cgroups, and seccomp, but they share the host kernel. Every container on a host calls into the same kernel. That is a fine trade-off for a trusted web server. It is a significant one for a process that dynamically generates and executes code based on external input.

The threat model for an AI agent looks like this:

Container escape (MITRE ATT&CK T1611): a kernel vulnerability or misconfiguration gives an attacker host-level access, reaching every other container on the machine.

Prompt injection leading to RCE: an agent receives a malicious instruction and executes it through a shell tool.

Tool poisoning: hidden directives embedded in MCP tool metadata are visible to the model but not to the user.

Credential exfiltration: an agent with filesystem access can read .env files, ~/.aws/credentials, or service account tokens.

Real-world baseline: A 2025 academic survey of over 1,800 deployed MCP server implementations found that more than 30% had at least one exploitable vulnerability. Endor Labs analysis of 2,614 MCP implementations found that 82% use file operations prone to path traversal and 34% use APIs susceptible to command injection.

CVE-2024-21626 ("Leaky Vessels") showed the concrete risk of shared-kernel runtimes: a process inside a container could set its working directory to /proc/self/fd/7, a leaked file descriptor pointing at the host filesystem, and achieve a full container escape. Affected all runc versions up to 1.1.11, patched in 1.1.12.

2. Stronger Runtimes: gVisor and Kata Containers

gVisor is a Google open-source project that implements the Linux kernel in user-space. A component called Sentry intercepts all syscalls before they reach the host kernel and handles them in an isolated process. From the container's perspective everything looks normal. From the host's perspective, no direct kernel calls ever happen.

Installation requires a single binary (runsc) registered in daemon.json. Any existing image runs without changes since it is OCI-compatible. The overhead is roughly 10 to 30% on I/O-heavy workloads and minimal on compute-heavy ones.

Kata Containers: a micro-VM per container

Kata Containers wraps each container in a lightweight VM with its own Linux kernel via KVM. The hardware boundary eliminates an entire class of kernel-based attacks since there is no shared kernel to escape to. It is OCI-compatible and works with Docker Compose with a single runtime field change.

The trade-offs are cold starts of roughly 100 to 300ms, around 100 MB of extra RAM per container, and no support on macOS or WSL2 (you need bare metal or a cloud instance with nested virtualization). GPU passthrough works with Kata 3.x via VFIO.

How to choose: use gVisor for high-I/O agents where simpler setup matters and a user-space kernel boundary is sufficient. Use Kata Containers when agents execute untrusted, LLM-generated code in production, since the dedicated kernel eliminates the kernel escape vector entirely. Standard runc is appropriate only for agents running fully trusted, reviewed code.

3. Docker MCP Toolkit: Least Privilege at the Tool Layer

Model Context Protocol (MCP) is Anthropic's open standard for connecting LLMs to external tools and data sources. Docker's MCP Toolkit, announced in April 2025 and released in beta in June 2025, solves three problems at once: tool discovery through a catalog of 300+ verified servers on Docker Hub, isolation where each MCP server runs as its own container, and credential management through a Gateway proxy rather than environment variables.

MCP Catalog is a curated registry on Docker Hub with automated testing and scanning. Currently over 300 verified servers including Stripe, Elastic, Neo4j, New Relic, Grafana, and many others.

MCP Toolkit is a Docker Desktop extension for managing server profiles and launching containers. Credentials are stored in Docker Desktop's secure store rather than in environment variables, reducing the risk of accidental exposure through logs or environment dumps.

MCP Gateway is an open-source proxy between MCP clients and servers that enforces policy on every tool call. It handles server lifecycle management, request routing, authentication, logging, and call tracing.

Key principle: By treating each tool as a separate MCP server container, you re-introduce least privilege. Instead of giving an agent broad access, you allow only the smallest set of capabilities it needs. The Gateway enforces this per-call and provides full audit visibility over every tool invocation.

Tool poisoning is a demonstrated attack class first documented publicly by Invariant Labs in April 2025. An attacker who controls an MCP server writes directives directly into tool descriptions or JSON Schema metadata. The model reads this as trusted configuration and executes hidden commands while the user sees nothing unusual. Because these fields arrive at boot as what looks like system configuration, they bypass the mental model most developers have of injection attacks.

The rug pull variant is subtler: a tool's description looks benign on day one, then quietly changes on day seven to redirect API keys to an attacker. MCP clients should alert on any change to tool descriptions after installation.

MCPoison (CVE-2025-54136, CVSS 7.2) is a related but distinct vulnerability discovered by Check Point Research in Cursor IDE. Once a user approved an MCP configuration file, Cursor never re-validated it on subsequent opens. An attacker with write access to a shared repository could commit a benign config, wait for approval, then silently swap in a malicious payload. Every subsequent Cursor launch would execute the attacker's commands with no warning. Fixed in Cursor 1.3, released July 29, 2025.

mcp-remote is a popular OAuth proxy for connecting local MCP clients to remote servers. JFrog Security Research discovered a critical OS command injection flaw (CVSS 9.6/10) in all versions from 0.0.5 up to 0.1.16. A malicious MCP server could send a crafted authorization_endpoint URL that mcp-remote passed directly to the system shell, achieving RCE on the client machine. The package had been downloaded over 437,000 times at the time of disclosure. Fixed in version 0.1.16.

Mitigation: Pin all images by sha256 digest, not by tag. Use only servers from the Docker MCP Catalog with passed verification. Enable signature verification in MCP Gateway. Alert on any change to tool descriptions. Keep mcp-remote at 0.1.16 or later.

When multiple MCP servers connect to the same agent, a malicious server can attempt to override or intercept calls to a trusted one through the model's context window. Network isolation between servers through an internal Docker network with gateway routing limits this attack surface structurally, since servers cannot reach each other without going through the Gateway policy layer.

5. Kubernetes: RuntimeClass for Per-Workload Isolation

For teams running agents on Kubernetes, RuntimeClass lets you assign an isolation level per Pod without changing container images.

Google's Agent Sandbox, a project contributed to CNCF under Kubernetes SIG, is building a standard for agentic workload isolation with gVisor and Kata Containers as pluggable backends. Not yet GA, but worth tracking if you already operate Kubernetes at scale.

Use gVisor or Kata Containers. Never use standard runc for code-executing agents.

Never run containers with --privileged. Drop ALL capabilities and add back only what is needed.

Set read_only: true on the container filesystem. Mount tmpfs for /tmp with noexec.

Bind MCP services to 127.0.0.1 only. Use an internal Docker network with no default egress.

Pin every image by sha256 digest. Never deploy from a mutable tag in production.

Store credentials in Docker Secrets or an external vault, not in environment variables.

AI agents are no longer confined to chat windows. They read files, call APIs, write to databases, and execute code autonomously. That changes the security model entirely. A misconfigured agent is not just a buggy service; it is a privileged process that handles untrusted input and has broad tool access by design.
This guide covers three layers that actually matter: why standard Docker containers are not enough, how gVisor and Kata Containers raise the isolation floor, and how Docker's MCP Toolkit lets you enforce least-privilege at the tool layer.

1. Why Standard Docker Containers Are Not Enough

Docker containers isolate through Linux namespaces, cgroups, and seccomp, but they share the host kernel. Every container on a host calls into the same kernel. That is a fine trade-off for a trusted web server. It is a significant one for a process that dynamically generates and executes code based on external input.
The threat model for an AI agent looks like this:
Container escape (MITRE ATT&CK T1611): a kernel vulnerability or misconfiguration gives an attacker host-level access, reaching every other container on the machine.
Prompt injection leading to RCE: an agent receives a malicious instruction and executes it through a shell tool.
Tool poisoning: hidden directives embedded in MCP tool metadata are visible to the model but not to the user.
Credential exfiltration: an agent with filesystem access can read .env files, ~/.aws/credentials, or service account tokens.

Real-world baseline: A 2025 academic survey of over 1,800 deployed MCP server implementations found that more than 30% had at least one exploitable vulnerability. Endor Labs analysis of 2,614 MCP implementations found that 82% use file operations prone to path traversal and 34% use APIs susceptible to command injection.

CVE-2024-21626 ("Leaky Vessels") showed the concrete risk of shared-kernel runtimes: a process inside a container could set its working directory to /proc/self/fd/7, a leaked file descriptor pointing at the host filesystem, and achieve a full container escape. Affected all runc versions up to 1.1.11, patched in 1.1.12.

2. Stronger Runtimes: gVisor and Kata Containers

gVisor: a kernel in user-space
gVisor is a Google open-source project that implements the Linux kernel in user-space. A component called Sentry intercepts all syscalls before they reach the host kernel and handles them in an isolated process. From the container's perspective everything looks normal. From the host's perspective, no direct kernel calls ever happen.
Installation requires a single binary (runsc) registered in daemon.json. Any existing image runs without changes since it is OCI-compatible. The overhead is roughly 10 to 30% on I/O-heavy workloads and minimal on compute-heavy ones.

 

 

Kata Containers: a micro-VM per container
Kata Containers wraps each container in a lightweight VM with its own Linux kernel via KVM. The hardware boundary eliminates an entire class of kernel-based attacks since there is no shared kernel to escape to. It is OCI-compatible and works with Docker Compose with a single runtime field change.
The trade-offs are cold starts of roughly 100 to 300ms, around 100 MB of extra RAM per container, and no support on macOS or WSL2 (you need bare metal or a cloud instance with nested virtualization). GPU passthrough works with Kata 3.x via VFIO.

 
How to choose: use gVisor for high-I/O agents where simpler setup matters and a user-space kernel boundary is sufficient. Use Kata Containers when agents execute untrusted, LLM-generated code in production, since the dedicated kernel eliminates the kernel escape vector entirely. Standard runc is appropriate only for agents running fully trusted, reviewed code.

3. Docker MCP Toolkit: Least Privilege at the Tool Layer

Model Context Protocol (MCP) is Anthropic's open standard for connecting LLMs to external tools and data sources. Docker's MCP Toolkit, announced in April 2025 and released in beta in June 2025, solves three problems at once: tool discovery through a catalog of 300+ verified servers on Docker Hub, isolation where each MCP server runs as its own container, and credential management through a Gateway proxy rather than environment variables.

The three components
MCP Catalog is a curated registry on Docker Hub with automated testing and scanning. Currently over 300 verified servers including Stripe, Elastic, Neo4j, New Relic, Grafana, and many others.
MCP Toolkit is a Docker Desktop extension for managing server profiles and launching containers. Credentials are stored in Docker Desktop's secure store rather than in environment variables, reducing the risk of accidental exposure through logs or environment dumps.
MCP Gateway is an open-source proxy between MCP clients and servers that enforces policy on every tool call. It handles server lifecycle management, request routing, authentication, logging, and call tracing.

Key principle: By treating each tool as a separate MCP server container, you re-introduce least privilege. Instead of giving an agent broad access, you allow only the smallest set of capabilities it needs. The Gateway enforces this per-call and provides full audit visibility over every tool invocation.

Hardened Compose config

 

4. MCP Attack Patterns You Need to Know

Tool poisoning
Tool poisoning is a demonstrated attack class first documented publicly by Invariant Labs in April 2025. An attacker who controls an MCP server writes directives directly into tool descriptions or JSON Schema metadata. The model reads this as trusted configuration and executes hidden commands while the user sees nothing unusual. Because these fields arrive at boot as what looks like system configuration, they bypass the mental model most developers have of injection attacks.
The rug pull variant is subtler: a tool's description looks benign on day one, then quietly changes on day seven to redirect API keys to an attacker. MCP clients should alert on any change to tool descriptions after installation.

MCPoison: CVE-2025-54136
MCPoison (CVE-2025-54136, CVSS 7.2) is a related but distinct vulnerability discovered by Check Point Research in Cursor IDE. Once a user approved an MCP configuration file, Cursor never re-validated it on subsequent opens. An attacker with write access to a shared repository could commit a benign config, wait for approval, then silently swap in a malicious payload. Every subsequent Cursor launch would execute the attacker's commands with no warning. Fixed in Cursor 1.3, released July 29, 2025.

Supply chain: CVE-2025-6514
mcp-remote is a popular OAuth proxy for connecting local MCP clients to remote servers. JFrog Security Research discovered a critical OS command injection flaw (CVSS 9.6/10) in all versions from 0.0.5 up to 0.1.16. A malicious MCP server could send a crafted authorization_endpoint URL that mcp-remote passed directly to the system shell, achieving RCE on the client machine. The package had been downloaded over 437,000 times at the time of disclosure. Fixed in version 0.1.16.

Mitigation: Pin all images by sha256 digest, not by tag. Use only servers from the Docker MCP Catalog with passed verification. Enable signature verification in MCP Gateway. Alert on any change to tool descriptions. Keep mcp-remote at 0.1.16 or later.

Cross-server hijacking
When multiple MCP servers connect to the same agent, a malicious server can attempt to override or intercept calls to a trusted one through the model's context window. Network isolation between servers through an internal Docker network with gateway routing limits this attack surface structurally, since servers cannot reach each other without going through the Gateway policy layer.

5. Kubernetes: RuntimeClass for Per-Workload Isolation

For teams running agents on Kubernetes, RuntimeClass lets you assign an isolation level per Pod without changing container images.

 

 
Google's Agent Sandbox, a project contributed to CNCF under Kubernetes SIG, is building a standard for agentic workload isolation with gVisor and Kata Containers as pluggable backends. Not yet GA, but worth tracking if you already operate Kubernetes at scale.

6. Production Security Checklist

Use gVisor or Kata Containers. Never use standard runc for code-executing agents.
Never run containers with --privileged. Drop ALL capabilities and add back only what is needed.
Set read_only: true on the container filesystem. Mount tmpfs for /tmp with noexec.
Bind MCP services to 127.0.0.1 only. Use an internal Docker network with no default egress.
Pin every image by sha256 digest. Never deploy from a mutable tag in production.
Store credentials in Docker Secrets or an external vault, not in environment variables.
Log all tool calls through MCP Gateway. Redact secrets before they reach the model.
Alert on changes to tool descriptions. This is your rug pull detector.
Keep mcp-remote at version 0.1.16 or later. Audit all MCP-related npm packages regularly.

FAQ

What is Docker MCP and why does it matter for AI agents?
Docker MCP Toolkit is Docker's solution for running MCP servers as isolated containers with managed credentials and policy enforcement. Without it, MCP servers typically run directly on the host with access to the full filesystem. The Toolkit adds a catalog of 300+ verified servers, per-server container isolation, and an open-source Gateway proxy that enforces policy on every tool call and provides full call tracing.

What is the difference between gVisor and Kata Containers?
gVisor implements a Linux kernel in user-space so syscalls are intercepted by an isolated process instead of reaching the host kernel directly. Kata Containers goes further: each container gets its own micro-VM with a dedicated Linux kernel via KVM. gVisor is simpler to set up and works on most environments including cloud VMs; Kata gives stronger, hardware-enforced isolation and is the right choice when agents run untrusted, LLM-generated code in production.

Do I need a different container image for gVisor or Kata?
No. Both runtimes are OCI-compatible. Your existing images run without any changes. You only add a single runtime field to your Compose file or daemon.json.

What is MCP tool poisoning?
Tool poisoning embeds malicious instructions in an MCP tool's descriptions or JSON Schema metadata rather than in user input. The model reads this as trusted system configuration and executes the hidden directives. Invariant Labs first documented this attack class in April 2025. Defense includes using only catalog-verified servers pinned by digest, enabling Gateway policy enforcement, and monitoring for any changes to tool descriptions after initial installation.

What was CVE-2025-6514?
CVE-2025-6514 was a critical (CVSS 9.6) OS command injection vulnerability in mcp-remote, a widely used npm package for connecting MCP clients to remote servers via OAuth. A malicious MCP server could craft an authorization_endpoint URL that mcp-remote passed directly to the system shell. Discovered by JFrog Security Research, disclosed July 9, 2025, and fixed in mcp-remote version 0.1.16.

Conclusion

AI agents are privileged processes that handle untrusted input. Standard Docker container isolation was not designed for this threat model.
The practical floor for production in 2026 is gVisor for I/O-heavy agents, Kata Containers for anything executing untrusted code, Docker MCP Gateway as the policy enforcement point for every tool call, and digest-pinned images throughout. The MCP ecosystem is maturing fast and so is its CVE list. The tools to defend it exist today. The gap is architectural decisions, not missing technology.

How to run AI agents securely in Docker using gVisor, Kata Containers, and MCP Toolkit. Real CVEs, attack patterns, and hardened Compose configs included.

Dashboard

TryDirect blog

OpenClaw Security: Safe Deployment Guide

How to Add a Missing Service to a Stacker Deployment

Matomo vs GA4: Own Your Analytics Data

Self-Host Wazuh: Free Open-Source SIEM/XDR

Marketplace Acceptable Use Policy

Marketplace Payout Terms

Self-Hosted MCP Gateways: From Demo to Production

Docker AI Agents: Isolation, Security & MCP

Self-Host Your AI Stack for Under $20/Month

Penetration Testing AI-Generated Code in 2026

TryDirect vs Coolify vs Caprover

From Stack Builder to Reusable Marketplace-Style Assets