Docker Hub MCP: Discover images first, then decide whether to manage repositories with a token

Who it's for

People who need a model to do image-content discovery through the Docker Hub API, and—after attaching a personal access token—to manage repositories. It fits operators who already have Docker installed locally, have Node.js 22+, and accept this premise: the token is optional, but once you send HUB_PAT_TOKEN over HTTP, anyone who can reach that endpoint can create and modify repositories as that identity. It is not a fit if you only want to browse the web catalog, or if you plan to expose the HTTP port on a network without having read the source security notes. Official page: https://github.com/docker/hub-mcp

First try in 3 minutes

Follow one official path only: after building at the repository root, start with the default stdio. Do not switch to http on the first try.

Prerequisites: Docker is installed, plus Node.js 22+. A personal access token is optional; on the first try, do not bind a token to the HTTP transport.

Install and start location: open the official repository root and run:

npm install
npm run build
npm start

The source default transport is stdio; it also allows npm start -- [--transport=http|stdio] [--port=3000] [--host=127.0.0.1]. Keep the defaults the first time.

Low-risk action: after the MCP client connects to the stdio process, only make calls in the content-discovery direction. The excerpt only mentions intelligent content discovery and repository management; it does not give concrete tool names or parameters, so do not invent query commands. Use the tools the client lists, and prefer the one whose name looks like discovery/query rather than create or modify.

Success signal: npm start stays running on default stdio, and the client can list tools—rather than exiting immediately because the build is missing or the Node version is too old. If the process ends right away, first check Node.js 22+ and whether npm run build completed.

Use cases

Case 1: Public content discovery. This maps to the source phrases “interfaces with Docker Hub APIs” and “intelligent content discovery”. On default stdio, without requiring a token, have the client issue one discovery-style call. The evidence does not name the tool, filter parameters, or return fields, so you can only confirm whether the call reached the Docker Hub API and whether the client returned a result or a clear API error; do not assume a particular search syntax exists.

Case 2: Repository management, with side effects. The source says the http transport uses the operator’s HUB_PAT_TOKEN for every tool call, and anyone who can reach that HTTP endpoint can be creating and modifying repositories. If you must manage repositories, provide the token to the process locally before starting; the source example is HUB_PAT_TOKEN=... npm start -- [--username=...]. After confirming the client is connected to your own process and HTTP is still bound only to 127.0.0.1, then issue create or modify calls. Confirmation: the expected change appears on the corresponding repository on Docker Hub. The evidence does not list parameters for the repository-management tools; the missing part can only stop at “has the ability to create/modify repositories.”

Boundaries

HTTP binds to 127.0.0.1 by default and requires authentication; the source tells you to read Securing the HTTP transport before exposing it on a network. Do not treat an unhardened HTTP endpoint as a shared entry point.

Once HTTP carrying the operator token is reached by someone else, they can create and modify repositories as that Docker Hub identity. A read-only hint is not zero risk either: the process will call the Docker Hub API and will act with the token you provided.

The token is optional in the prerequisites, but the excerpt does not spell out which private content is visible when unauthenticated; do not assume you can read private repositories.

The evidence does not give a client list or a complete MCP tool inventory; do not fill in commands from other Hub plugins. Docker and Node.js 22+ are required; if either is missing, do not switch to an install method that does not appear in the excerpt.