Nmap doesn’t work - requires add-cap=NET_ADMIN

[moconnor-leavened]

nmap doesn’t work on the kali MCP server. I tried adding the —privileged flag and add-cap=NET_ADMIN flags to the docker run mcp gateway command in the claud config.

@theNetworkChuck seems to not add any privilege flags or CAP flags and it just works for him?

I tested my Kali mcp server with the CAP flag and it works so that’s definitely this issue. I searched the mcp gateway docs and couldn’t find anywhere where you can add that flag to a config.

[moconnor-leavened]

Well, I figured out a work around. I'm still not sure what @theNetworkChuck did to get his to work out of the box, as it would seem.

In my investigation, there are a few things that are true:

• nmap requires extra permissions to perform scans on the network
• docker mcp gateway does not give you an option to expose those permissions directly
• claude desktop does not want to connect to a SSE on http (meaning with out SSL)

My solution: use image docker/mcp-gateway:dind this is the "docker in docker" image. Meaning that the docker gateway runs inside with the docker servers. In order to do this, it requires nested virtualization which requires running the containers with the almighty docker --privilege flag. The same kind of privilege we need for our containers to access the network.

What's the catch? There's always a catch. that image does not run directly, it's meant to be run as as server. So you can to docker run mcp whatever, you have to launch it like any other container with a port mapping and using a transport protocol other than stdio. I tried sse first, seemed like the obvious choice since everything uses that, but claude wont connect to a localhost running plain old http and I didn't feel like setting up a dev cert and a proxy. So... turns out claude works pretty well with streaming protocol. Which, once I landed on this conclusion, was a pretty easy transition.

Your claude config should look like this:

{
  "mcpServers": {
    "local-mcp": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "http://localhost:8811/stream",
        "--allow-http"
      ]
    }
  }
}

running the gateway server looks like this

services:
  gateway:
    image: docker/mcp-gateway:dind
    ports:
      - "8811:8811"
    command:
      - --catalog=/mcp/catalog.yaml
      - --servers=kali-pentest
      - --registry=/mcp/registry.yaml
      - --transport=streaming
      - --port=8811
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ~/.docker/mcp/catalogs/custom.yaml:/mcp/catalog.yaml

IMPORTANT NOTE: You don't have to add any --privilege flags or --add-cap the docker image mcp-gateway:dind does it for you.