docker-mcp-server 2.1.0__tar.gz → 2.1.1__tar.gz

{docker_mcp_server-2.1.0 → docker_mcp_server-2.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: docker-mcp-server
-Version: 2.1.0
+Version: 2.1.1
 Summary: MCP server for managing Docker resources via the Docker SDK for Python
 Project-URL: Homepage, https://github.com/GavinLucas/docker-mcp
 Project-URL: Repository, https://github.com/GavinLucas/docker-mcp

{docker_mcp_server-2.1.0 → docker_mcp_server-2.1.1}/docker_mcp/tools/system.py

@@ -3,6 +3,7 @@
 import os
 import sys
 import threading
+import urllib.parse
 from pathlib import Path
 
 import docker
@@ -20,6 +21,7 @@ from docker_mcp._hosts import (
     resolve_auto,
 )
 from docker_mcp.server import tool
+from docker_mcp.tools._ssh_proxy import parse_ssh_url
 from docker_mcp.tools._utils import classify_host_kernel, close_stream_quietly, env_flag, in_container
 
 # One lazily-built docker-py client per configured host label (the pool). FastMCP runs sync tools
@@ -114,13 +116,52 @@ def _close_client_quietly(client: docker.DockerClient) -> None:
         pass
 
 
+def _ensure_ssh_port(url: str) -> str:
+    """
+    Work around a docker-py bug for an `ssh://` URL with no explicit port: `docker.utils.parse_host()`
+    hardcodes port 22 into the URL *before* `SSHHTTPAdapter._create_paramiko_client` ever runs, so that
+    adapter's own `~/.ssh/config` `Port` fallback (which only fires while the port is still unset) never
+    triggers — a non-22 `Port` in `~/.ssh/config` is silently ignored. We splice in the configured port
+    ourselves first, reusing the exact `~/.ssh/config` lookup `_ssh_proxy.parse_ssh_url` already does for
+    the CLI-backed tools, so both tool families honor a non-default SSH port the same way.
+
+    args: url: str - a DOCKER_HOST/host URL; only `ssh://` URLs with no explicit port are affected
+    returns: str - `url` unchanged, or with the `~/.ssh/config` port spliced into the netloc
+    """
+    if not url.startswith("ssh://"):
+        return url
+    parsed = urllib.parse.urlparse(url)
+    try:
+        has_port = parsed.port is not None
+    except ValueError:
+        # A malformed port (e.g. "ssh://host:abc") — leave url untouched so docker-py's own
+        # validation raises its clearer error instead of this helper failing first.
+        return url
+    if has_port:
+        return url
+    try:
+        # parse_ssh_url raises ValueError on a missing hostname (e.g. "ssh://" or "ssh://@") or a
+        # non-integer `Port` in ~/.ssh/config — leave url untouched in either case rather than
+        # raising a bare ValueError here instead of the connection error docker-py would produce.
+        target = parse_ssh_url(url)
+    except ValueError:
+        return url
+    if target.port is None:
+        return url
+    return urllib.parse.urlunparse(parsed._replace(netloc=f"{parsed.netloc}:{target.port}"))
+
+
 def _build_default_client() -> docker.DockerClient:
     """Client for DOCKER_HOST when set (via from_env, honoring its TLS env), else the resolved endpoint.
 
     auto/local resolution lives in docker_mcp._hosts now (the pure registry layer); resolve_auto() is
     the relocated _resolve_default_base_url().
     """
-    if os.environ.get("DOCKER_HOST"):
+    docker_host = os.environ.get("DOCKER_HOST")
+    if docker_host:
+        fixed = _ensure_ssh_port(docker_host)
+        if fixed != docker_host:
+            return docker.from_env(environment={**os.environ, "DOCKER_HOST": fixed})
         return docker.from_env()
     base_url = resolve_auto()
     return docker.DockerClient(base_url=base_url) if base_url else docker.from_env()
@@ -164,9 +205,8 @@ def _build_client(host: Host) -> docker.DockerClient:
     tls = _tls_config_for(host)
     if host.url is None:
         return docker.DockerClient(tls=tls) if tls is not None else docker.DockerClient()
-    return (
-        docker.DockerClient(base_url=host.url, tls=tls) if tls is not None else docker.DockerClient(base_url=host.url)
-    )
+    url = _ensure_ssh_port(host.url)
+    return docker.DockerClient(base_url=url, tls=tls) if tls is not None else docker.DockerClient(base_url=url)
 
 
 def _get_client(host: str | None = None) -> docker.DockerClient:

{docker_mcp_server-2.1.0 → docker_mcp_server-2.1.1}/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.4",
   "name": "docker-mcp-server",
   "display_name": "Docker MCP Server",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Manage Docker through the Docker SDK for Python and the docker CLI: containers, images, networks, volumes, Compose, Swarm, Buildx, Scout, and OCI registries, exposed as MCP tools.",
   "long_description": "Manage one or more Docker daemons through your AI agent — containers, images, networks, volumes, Compose, Swarm, Buildx, Scout, and OCI registries, exposed as MCP tools.\n\nDiscovery is automatic for your local socket with no configuration required. Or point it at additional remote daemons over TCP, TLS, or SSH (and mark any of them read-only to monitor without the risk of accidental changes). It also surfaces logs and stats as resources for triage. Read-only / no-destructive / disabled-domain switches let you register a restricted tool surface.\n\nAnswer questions like: ‘why did my local container crash?’, ‘is my production system under memory pressure?’, ‘what differences are there between my staging and production systems?’\n\nRuns entirely on your machine and sends no telemetry — see the Privacy Policy.",
   "author": {

{docker_mcp_server-2.1.0 → docker_mcp_server-2.1.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "docker-mcp-server"
-version = "2.1.0"
+version = "2.1.1"
 description = "MCP server for managing Docker resources via the Docker SDK for Python"
 readme = "README.md"
 license = "MIT"

{docker_mcp_server-2.1.0 → docker_mcp_server-2.1.1}/tests/test_system.py

@@ -571,3 +571,75 @@ def test_build_client_platform_default_ignores_ambient_docker_host(monkeypatch):
         assert system_module._build_client(Host("local", None)) is sentinel
     ctor.assert_called_once_with()  # no base_url -> platform socket/npipe; ambient DOCKER_HOST ignored
     from_env.assert_not_called()
+
+
+# ---------- _ensure_ssh_port: work around docker-py hardcoding port 22 for a bare ssh:// URL ----------
+
+
+def test_ensure_ssh_port_ignores_non_ssh_url():
+    assert system_module._ensure_ssh_port("tcp://prod:2376") == "tcp://prod:2376"
+
+
+def test_ensure_ssh_port_leaves_explicit_port_alone(monkeypatch):
+    # An explicit port must win even if ~/.ssh/config also has one — no lookup should even be needed.
+    monkeypatch.setattr(system_module, "parse_ssh_url", MagicMock(side_effect=AssertionError("should not be called")))
+    assert system_module._ensure_ssh_port("ssh://bob@example.com:1234") == "ssh://bob@example.com:1234"
+
+
+def test_ensure_ssh_port_leaves_malformed_port_for_docker_py_to_reject(monkeypatch):
+    # A non-numeric port makes urlparse's .port property raise ValueError — must not propagate out of
+    # this helper; leave the url untouched so docker-py's own validation is what surfaces the error.
+    monkeypatch.setattr(system_module, "parse_ssh_url", MagicMock(side_effect=AssertionError("should not be called")))
+    assert system_module._ensure_ssh_port("ssh://bob@example.com:abc") == "ssh://bob@example.com:abc"
+
+
+def test_ensure_ssh_port_leaves_hostless_url_for_docker_py_to_reject(monkeypatch):
+    # No hostname (e.g. "ssh://" or "ssh://@") makes the real parse_ssh_url raise ValueError — must
+    # not propagate out of this helper; leave docker-py's own validation to reject the malformed url.
+    monkeypatch.setattr("os.path.exists", lambda _path: False)  # no ~/.ssh/config lookup needed
+    assert system_module._ensure_ssh_port("ssh://") == "ssh://"
+    assert system_module._ensure_ssh_port("ssh://@") == "ssh://@"
+
+
+def test_ensure_ssh_port_leaves_url_alone_when_ssh_config_port_is_malformed(tmp_path, monkeypatch):
+    # A non-integer `Port` in ~/.ssh/config makes parse_ssh_url raise ValueError (int() failure) —
+    # must not propagate out of this helper; leave docker-py's own validation to surface the error.
+    config = tmp_path / "config"
+    config.write_text("Host example.com\n    Port notanumber\n")
+    monkeypatch.setattr("os.path.expanduser", lambda p: str(config) if p == "~/.ssh/config" else p)
+    assert system_module._ensure_ssh_port("ssh://bob@example.com") == "ssh://bob@example.com"
+
+
+def test_ensure_ssh_port_splices_in_ssh_config_port(tmp_path, monkeypatch):
+    config = tmp_path / "config"
+    config.write_text("Host example.com\n    Port 1234\n")
+    monkeypatch.setattr("os.path.expanduser", lambda p: str(config) if p == "~/.ssh/config" else p)
+    assert system_module._ensure_ssh_port("ssh://bob@example.com") == "ssh://bob@example.com:1234"
+
+
+def test_ensure_ssh_port_unchanged_when_config_has_no_port(monkeypatch):
+    monkeypatch.setattr("os.path.exists", lambda _path: False)  # no ~/.ssh/config at all
+    assert system_module._ensure_ssh_port("ssh://bob@example.com") == "ssh://bob@example.com"
+
+
+def test_build_default_client_splices_ssh_config_port_into_docker_host(tmp_path, monkeypatch):
+    config = tmp_path / "config"
+    config.write_text("Host example.com\n    Port 1234\n")
+    monkeypatch.setattr("os.path.expanduser", lambda p: str(config) if p == "~/.ssh/config" else p)
+    monkeypatch.setenv("DOCKER_HOST", "ssh://bob@example.com")
+    sentinel = MagicMock()
+    with patch("docker_mcp.tools.system.docker.from_env", return_value=sentinel) as from_env:
+        assert system_module._build_default_client() is sentinel
+    assert from_env.call_args.kwargs["environment"]["DOCKER_HOST"] == "ssh://bob@example.com:1234"
+
+
+def test_build_client_splices_ssh_config_port_for_multi_host_ssh_entry(tmp_path, monkeypatch):
+    _set_multi(monkeypatch)
+    config = tmp_path / "config"
+    config.write_text("Host example.com\n    Port 1234\n")
+    monkeypatch.setattr("os.path.expanduser", lambda p: str(config) if p == "~/.ssh/config" else p)
+    host = Host("remote", "ssh://bob@example.com")
+    sentinel = MagicMock()
+    with patch("docker_mcp.tools.system.docker.DockerClient", return_value=sentinel) as ctor:
+        assert system_module._build_client(host) is sentinel
+    ctor.assert_called_once_with(base_url="ssh://bob@example.com:1234")

{docker_mcp_server-2.1.0 → docker_mcp_server-2.1.1}/uv.lock

@@ -282,7 +282,7 @@ ssh = [
 
 [[package]]
 name = "docker-mcp-server"
-version = "2.1.0"
+version = "2.1.1"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography", marker = "platform_machine == 'x86_64' and sys_platform == 'darwin'" },