Rust MCP server and CLI for Arcane Docker and container management.
$git clone https://github.com/dinglebear-ai/rarcaneInstalls into the current project.
Install rarcane by running `git clone https://github.com/dinglebear-ai/rarcane`, then use it for the current task and follow its documentation at https://github.com/dinglebear-ai/rarcane.
| 1 | # arcane-rmcp |
| 2 | |
| 3 | `arcane-rmcp` is a Rust MCP server and CLI for managing Docker through an |
| 4 | [Arcane](https://github.com/ofkm/arcane) API server. |
| 5 | |
| 6 | It exposes one MCP tool, `arcane`, plus the `rarcane` CLI. Agents can inspect |
| 7 | Arcane environments, manage compose projects, containers, images, networks, |
| 8 | volumes, registries, GitOps syncs, image updates, vulnerability findings, and |
| 9 | system operations through stdio MCP, Streamable HTTP MCP, or direct shell |
| 10 | commands. |
| 11 | |
| 12 | **30-second path:** set `RARCANE_API_URL` and `RARCANE_API_KEY`, then run |
| 13 | `npx -y arcane-rmcp status` -> start loopback HTTP with |
| 14 | `RARCANE_MCP_HOST=127.0.0.1 npx -y arcane-rmcp serve` -> call `tools/call` with |
| 15 | `{"action":"status"}`. |
| 16 | |
| 17 | **Status:** operational RMCP upstream-client server. Write-capable; destructive |
| 18 | Docker and Arcane operations require explicit confirmation. HTTP MCP supports |
| 19 | loopback dev mode, static bearer tokens, and Google OAuth through `lab-auth`. |
| 20 | |
| 21 | **Not for:** replacing Arcane, bypassing Docker or Arcane authorization, |
| 22 | running arbitrary shell commands, storing registry or Git credentials, |
| 23 | multi-tenant isolation, or passing Arcane API keys through MCP tool arguments. |
| 24 | |
| 25 | ## Contents |
| 26 | |
| 27 | - [Naming](#naming) |
| 28 | - [Capabilities And Boundaries](#capabilities-and-boundaries) |
| 29 | - [Install](#install) |
| 30 | - [Quickstart](#quickstart) |
| 31 | - [Client Configuration](#client-configuration) |
| 32 | - [Runtime Surfaces](#runtime-surfaces) |
| 33 | - [MCP Tool Reference](#mcp-tool-reference) |
| 34 | - [CLI Reference](#cli-reference) |
| 35 | - [Configuration](#configuration) |
| 36 | - [Authentication](#authentication) |
| 37 | - [Safety And Trust Model](#safety-and-trust-model) |
| 38 | - [Architecture](#architecture) |
| 39 | - [Distribution Contract](#distribution-contract) |
| 40 | - [Development](#development) |
| 41 | - [Verification](#verification) |
| 42 | - [Deployment](#deployment) |
| 43 | - [Troubleshooting](#troubleshooting) |
| 44 | - [Related Servers](#related-servers) |
| 45 | - [Documentation](#documentation) |
| 46 | - [License](#license) |
| 47 | |
| 48 | ## Naming |
| 49 | |
| 50 | | Surface | This repo | |
| 51 | |---|---| |
| 52 | | Repository | `arcane-rmcp` | |
| 53 | | Rust crate | `rarcane` | |
| 54 | | Binary / CLI | `rarcane` | |
| 55 | | npm package | `arcane-rmcp` | |
| 56 | | npm binary alias | `rarcane` | |
| 57 | | MCP server name | `rarcane` in bundled plugin/client config | |
| 58 | | MCP tool | `arcane` | |
| 59 | | Config home | `~/.rarcane` on hosts, `/data` in containers | |
| 60 | | Env prefixes | `RARCANE_*`, `RARCANE_MCP_*`, `RARCANE_RMCP_*` for npm launcher controls | |
| 61 | |
| 62 | The repo and npm package use the upstream service name, while the shipped |
| 63 | binary keeps the historical Rust CLI name `rarcane`. The MCP server may be |
| 64 | registered as `rarcane`, but the tool clients call is `arcane`. |
| 65 | |
| 66 | ## Capabilities And Boundaries |
| 67 | |
| 68 | - Read Arcane status plus Docker environment, project, container, image, |
| 69 | network, volume, registry, GitOps, update, vulnerability, and system state. |
| 70 | - Create, update, start, stop, restart, delete, prune, deploy, sync, scan, and |
| 71 | back up supported Arcane resources through action/subaction dispatch. |
| 72 | - Enforce action scopes and destructive-operation confirmation before forwarding |
| 73 | write operations to Arcane. |
| 74 | - Expose the `quick_start` prompt and `rarcane://schema/mcp-tool` resource for |
| 75 | client-side discovery. |
| 76 | - Provide setup, doctor, and watch commands for local plugin/runtime checks. |
| 77 | |
| 78 | | This repo owns | Arcane owns | Explicitly out of scope | |
| 79 | |---|---|---| |
| 80 | | MCP/CLI projection, request validation, auth policy, response shaping, setup checks, schema/resource exposure, and destructive gates. | Docker state, Arcane projects and environments, upstream authorization, registry credentials, GitOps secrets, vulnerability scanner output, and API semantics. | Direct Docker socket access, shell execution, credential storage, generic REST proxy behavior, multi-tenant sandboxing, scheduler behavior, and replacing the Arcane UI/API. | |
| 81 | |
| 82 | ## Install |
| 83 | |
| 84 | | Path | Command | Best for | Notes | |
| 85 | |---|---|---|---| |
| 86 | | npm / npx | `npx -y arcane-rmcp --help` | Local MCP clients and quick trials. | Downloads the matching `rarcane` binary from GitHub Releases. | |
| 87 | | Release installer | `curl -fsSL https://raw.githubusercontent.com/jmagar/arcane-rmcp/main/scripts/install.sh \| bash` | Host installs without Node. | Installs `rarcane` for the current Linux host. | |
| 88 | | Docker / Compose | `docker compose up -d` | Shared HTTP MCP deployments. | Reads `.env` and exposes container port `40110`. | |
| 89 | | Build from source | `cargo build --release` | Development and audits. | Produces `target/release/rarcane`. | |
| 90 | | Plugin | `claude plugin install plugins/rarcane` | Claude Code local plugin setup from this checkout. | Uses the packaged setup hook, skill, and monitor metadata. | |
| 91 | |
| 92 | ### npm / npx |
| 93 | |
| 94 | Run the stdio MCP server or CLI without a manual binary install: |
| 95 | |
| 96 | ```bash |
| 97 | npx -y arcane-rmcp --help |
| 98 | npx -y arcane-rmcp mcp |
| 99 | npx -y arcane-rmcp status |
| 100 | ``` |
| 101 | |
| 102 | The npm package downloads `rarcane` during `postinstall`. Override download |
| 103 | behavior only when testing packaging: |
| 104 | |
| 105 | | Variable | Purpose | |
| 106 | |---|---| |
| 107 | | `RARCANE_RMCP_SKIP_DOWNLOAD=1` | Skip postinstall binary download. | |
| 108 | | `RARCANE_RMCP_VERSION` or `RARCANE_RMCP_BINARY_VERSION` | Select |