Arista CloudVision

Clone the repository. The Docker backend lives in docker/ and ships a custom-catalog.yaml alongside the Dockerfile.

$ git clone https://github.com/rosarion97/cloudvision-readonly-mcp-server-public.git
$ cd cloudvision-readonly-mcp-server-public/docker

The image tag must match the image: field in custom-catalog.yaml (cloudvision-readonly-mcp:latest).

$ docker build -t cloudvision-readonly-mcp:latest .

Two required values, CVP_HOST and CVP_TOKEN; three optional ones for tuning (CVP_PORT defaults to 443, set 8443 for many on-prem clusters; CVP_VERIFY_SSL defaults to true; CVP_MAX_RESPONSE_BYTES defaults to 120000).

Option A, Docker MCP secret store (recommended). Each value lives in Docker Desktop's encrypted store; the gateway injects them as env vars at launch and they never appear in your client's config file. With Option A, continue through Steps 4–7.

$ docker mcp secret set CVP_HOST="www.arista.io"
$ docker mcp secret set CVP_TOKEN="<your-token-here>"
$ docker mcp secret set CVP_PORT="443"          # 8443 for many on-prem clusters
$ docker mcp secret set CVP_VERIFY_SSL="true"
$ docker mcp secret list   # values are masked

$ cp .env.example .env
$ chmod 600 .env   # then set CVP_HOST and CVP_TOKEN

{
  "mcpServers": {
    "cloudvision-readonly": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "--env-file", "/absolute/path/to/docker/.env",
        "cloudvision-readonly-mcp:latest"
      ]
    }
  }
}

Steps 4–6 are the Option A (secret store) path. Used Option B? Skip to Step 7.

$ mkdir -p ~/.docker/mcp/catalogs
$ cp custom-catalog.yaml ~/.docker/mcp/catalogs/custom.yaml

Already have a custom.yaml from another MCP Galaxy server? Merge the cloudvision-readonly: entry into your existing file under the single registry: key, don't overwrite it.

Add the entry under the single top-level registry: key in ~/.docker/mcp/registry.yaml. Don't overwrite the file if it already exists.

registry:
  cloudvision-readonly:
    catalog: custom
    enabled: true

Add the gateway block to claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json). The gateway spawns the CloudVision image on demand, reads your catalog and registry, and resolves your CVP_* secrets at request time. Replace <your-username> with your macOS username (run whoami to check):

{
  "mcpServers": {
    "mcp-toolkit-gateway": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "/var/run/docker.sock:/var/run/docker.sock",
        "-v", "/Users/<your-username>/.docker/mcp:/mcp",
        "-v", "/Users/<your-username>/Library/Caches/docker-secrets-engine/engine.sock:/root/.cache/docker-secrets-engine/engine.sock",
        "docker/mcp-gateway:latest",
        "--catalog=/mcp/catalogs/custom.yaml",
        "--registry=/mcp/registry.yaml",
        "--transport=stdio"
      ]
    }
  }
}

All three bind-mounts are required: the Docker socket lets the gateway spawn the server container; ~/.docker/mcp is where it reads your catalog and registry; the docker-secrets-engine socket is the resolver Docker Desktop exposes for the secret store, without it your CVP_* values resolve to empty strings and the server never starts. On Linux Docker Desktop the path is ~/.docker/desktop/secrets-engine/engine.sock; find it with find ~ -name engine.sock.

Then quit and reopen the client. claude_desktop_config.json never contains CVP_TOKEN, the gateway resolves it from Docker's secret store at request time. As a shortcut, docker mcp client connect claude-desktop (or MCP Toolkit → Clients in Docker Desktop) writes a similar block automatically; the explicit JSON above survives Docker Desktop updates that may rewrite the auto-managed entry.

$ docker mcp server list   # cloudvision-readonly → enabled
$ docker mcp tools list

Or run the image directly, it logs a startup line to stderr and waits silently on stdin (correct for an MCP stdio server). Press Ctrl+C to exit; a missing required env var fails fast on stderr.

$ docker run --rm -i --env-file /absolute/path/to/.env cloudvision-readonly-mcp:latest

Clone the repository. The Podman backend lives in podman/.

$ git clone https://github.com/rosarion97/cloudvision-readonly-mcp-server-public.git
$ cd cloudvision-readonly-mcp-server-public/podman

On macOS / Windows, start a Podman machine first (podman machine init && podman machine start); Linux runs natively. Podman 4.4+ is required for the --secret type=env flag below.

$ podman build -t cloudvision-readonly-mcp:latest -f Containerfile .

Two required values (CVP_HOST, CVP_TOKEN) plus optional tuning (CVP_PORT, CVP_VERIFY_SSL, CVP_MAX_RESPONSE_BYTES). Option 1 keeps them in Podman's encrypted secret store and is recommended; Option 2 writes a plaintext .env.

$ printf '%s' 'www.arista.io'     | podman secret create CVP_HOST -
$ printf '%s' '<your-token-here>' | podman secret create CVP_TOKEN -
$ printf '%s' '443'               | podman secret create CVP_PORT -
$ printf '%s' 'true'              | podman secret create CVP_VERIFY_SSL -
$ podman secret ls   # confirm; values not shown

printf '%s' (no \n) avoids a trailing newline in the secret value, a stray newline in CVP_HOST produces "Could not connect" errors that are tedious to debug.

$ cp .env.example .env
$ chmod 600 .env   # then set CVP_HOST and CVP_TOKEN

Add the entry matching your Step 3 choice. Option 1 injects each secret with --secret NAME,type=env; Option 2 reads them from your .env.

{
  "mcpServers": {
    "cloudvision-readonly": {
      "command": "podman",
      "args": [
        "run", "-i", "--rm",
        "--secret", "CVP_HOST,type=env",
        "--secret", "CVP_TOKEN,type=env",
        "--secret", "CVP_PORT,type=env",
        "--secret", "CVP_VERIFY_SSL,type=env",
        "cloudvision-readonly-mcp:latest"
      ]
    }
  }
}

{
  "mcpServers": {
    "cloudvision-readonly": {
      "command": "podman",
      "args": [
        "run", "-i", "--rm",
        "--env-file", "/absolute/path/to/podman/.env",
        "cloudvision-readonly-mcp:latest"
      ]
    }
  }
}

If podman isn't on Claude Desktop's PATH (common on macOS, where GUI apps don't inherit your shell's PATH), use the absolute path to the binary, usually /opt/homebrew/bin/podman (Apple Silicon Homebrew) or /usr/local/bin/podman (Intel Homebrew).

Run the image manually, it starts and waits on stdin. Press Ctrl+C to exit; a missing required env var fails fast on stderr.

$ podman run --rm -i \
    --secret CVP_HOST,type=env \
    --secret CVP_TOKEN,type=env \
    --secret CVP_PORT,type=env \
    --secret CVP_VERIFY_SSL,type=env \
    cloudvision-readonly-mcp:latest