Kobel vs. Docker MCP Toolkit
Two honest answers to the same worry, reached by different means. Docker locks the server process away. Kobel grades what may happen to your folders. Here is when each one fits.
Last verified:
Docker works by isolation, Kobel by permission. In the Docker MCP Toolkit, MCP servers run in containers. Docker's documentation puts it plainly: “By default, MCP Servers have no access to the host filesystem. The user explicitly selects the servers that will be granted file mounts.” The protection is that the AI never sees your real files at all — until you hand a folder in.
That handover is exactly where Kobel's job starts. Kobel gives the AI access to your real working folders, but each folder carries exactly one of five levels: blocked, read-only, write-to-copies-only, write with an automatic backup, or full access. If you never need to expose a real folder, isolation is the better fit. If you work with your real files every day, isolation only postpones the question until the first mount.
Two different places in the stack
Container isolation (Docker)
AI client → Docker MCP Gateway → container → mounted folders
- Unit of control: a server, a tool, a mount
- Default: no filesystem access
- Runs as: Docker Desktop, containers, partly CLI
- Audience per the docs: developers, teams, enterprises
- Blind to: what happens inside a mounted folder
Permission layer (Kobel)
AI client → Kobel → this device's folders, apps and accounts
- Unit of control: one folder, at one of five levels
- Default: nothing shared until a colour is chosen
- Runs as: a desktop app, no config file
- Audience: individuals, freelancers, agencies, small firms
- Blind to: what a container process does internally
The mount is where isolation ends
This is not a complaint about Docker; it is how containers work. A container protects as long as nothing is handed
in. The moment a real working folder is mounted, exactly one permission applies inside it — the one the mount carries.
The filesystem server definition in Docker's MCP registry exposes exactly one parameter for this, paths,
and contains no read-only switch. To get read-only you run the container yourself with a bind mount and the
ro option.
Microsoft states the same principle even more bluntly for Windows Sandbox: “Files and folders mapped from the host can be compromised by apps in the sandbox or potentially affect the host. Changes made during a Sandbox session to a mapped folder with write-permissions will persist after a Sandbox is disposed.” The sentence applies to every isolation approach with mounted folders.
Feature comparison
| Docker MCP Toolkit / Gateway | Kobel | |
|---|---|---|
| Core principle | Isolation in a container | Graded permission on real files |
| Runs on | Docker Desktop 4.62+ (Windows Pro/Enterprise/Education, macOS, Linux) | Windows and macOS desktop |
| Access by default | None until a mount is set | None until a colour is chosen |
| Permission levels per folder | Catalog entry: path list only, no read-only | Five levels |
| Read-only possible | Yes, via a manual bind mount with ro | Yes, one click |
| Write with backup | No | Yes |
| Read original, write copies | No | Yes |
| Per-tool permissions | Yes, allowlist via docker mcp profile tools | Per resource and function |
| Signed server images with SBOM | Yes, for images under mcp/ in the catalog | Not applicable — Kobel ships no server images |
| Block secrets in tool traffic | Yes (--block-secrets, on by default) | No |
| Resource limits per server | Yes (1 CPU, 2 GB by default) | No |
| Logging | Call log in the gateway (--log-calls) | Local activity log, not writable by the AI, CSV/JSON export |
| Setup | Install Docker Desktop, pick servers from the catalog, set mounts, partly CLI | Drag a folder in, pick a colour |
| Maturity | Beta per the docs | Released |
| Open source | The docker-mcp CLI plugin, MIT | No |
| Pricing | Docker Desktop free for personal use, education, OSS and firms < 250 employees / < $10M revenue; above that from $9 per user per month | Free tier; €49 once or €3.90/month; Team from €29/month |
Three things, none of them small. First, the supply chain: catalog images under mcp/ are built by
Docker, digitally signed and shipped with a software bill of materials — Kobel does not vet third-party MCP servers for
provenance. Second, the execution boundary: a container capped at 1 CPU and 2 GB cannot run away with the machine, and
--block-network takes the network away from a tool entirely. Third, per-tool allowlisting. If you want to
try an unknown third-party MCP server, do it in a container rather than unguarded on your machine.
When each one fits
Docker MCP Toolkit, if …
- You try out third-party or unknown MCP servers
- You already work with containers
- Signatures, SBOMs and resource limits matter
- Per-tool permissions matter more than per-folder ones
- You run Windows Pro, Enterprise or Education and Docker Desktop is already there
Kobel, if …
- The AI needs your real working folders, not a copy
- One folder must be read-only while the next one is writable
- Nobody involved is going to open a command line
- You need to show what the AI did, and when
- Your own software and accounts should follow the same rules
Running both
For technical users the sensible end state is not a choice but an order of operations: third-party server processes run in containers so they cannot touch the machine. Your own working folders sit behind a permission layer so that sharing stays graded and auditable. The container answers “may this process run here”; the permission layer answers “may this happen to this folder”.
Kobel's five permission levels
Every folder, app and account carries exactly one of these five levels. You set it by dragging a folder in and picking a colour — no configuration file.
- GreenRead and write. The AI may open files and save changes directly.
- TealWrite with an automatic backup. A copy is made before every change, so a bad edit can always be undone.
- OrangeRead the original, write only to copies. The AI can work with the data but cannot alter the source file.
- YellowRead only. Look, don't touch.
- RedBlocked. The resource is invisible to the AI.
Keep reading
Sources
- Docker – MCP Toolkit (beta label, “no access to the host filesystem”, resource limits, signed images)
- Docker – MCP Gateway
- Docker –
docker mcp gateway run(flags:--block-secrets,--block-network,--cpus,--memory,--log-calls) - GitHub – docker/mcp-gateway (CLI plugin, MIT, tool allowlist)
- GitHub – docker/mcp-registry, filesystem server catalog entry (
paths, noro) - Docker – Docker Desktop for Windows system requirements
- Docker – Docker Desktop licence terms
- Docker – Pricing
- Microsoft – Windows Sandbox, mapped folders and the accompanying warning
Try it with one folder
Install Kobel, drag in a single folder, set it to read-only, connect your AI. Two minutes. Free tier, no account needed.
Download KobelSee the featuresFrequently asked questions
What is the difference between Docker MCP Toolkit and Kobel?
Docker works by isolation: MCP servers run in containers and, in Docker's own words, have no access to the host filesystem by default until you explicitly grant a file mount. Kobel works by permission: the AI does touch your real files, but every folder carries exactly one of five levels, from blocked through read-only to full read and write. Docker governs which server may run at all; Kobel governs what may happen to an individual folder.
Can Docker MCP Toolkit make a folder read-only?
Not through the catalog entry. The filesystem server definition in Docker's MCP registry exposes exactly one parameter, paths, and no read-only switch. To get read-only you run the container yourself with a bind mount and the ro option. At tool level Docker does offer granularity: docker mcp profile tools enables and disables individual tools as an allowlist.
Do I need Docker Desktop, and what does it cost?
The MCP Toolkit is an interface inside Docker Desktop; the documentation refers to Docker Desktop 4.62 and later. Docker Desktop is free for personal use, education, non-commercial open source and for companies with fewer than 250 employees and less than 10 million US dollars in annual revenue. Above that it is paid; Docker lists Pro, Team and Business from 9 US dollars per user per month.
Is Docker safer than Kobel?
For the question of whether a third-party MCP server can harm your machine, container isolation is the stronger answer, and Docker adds signed catalog images with an SBOM, resource limits and secret blocking in tool traffic. For the question of what may happen to one specific folder it is the other way round: once a folder is mounted, exactly one permission applies inside the container, the one the mount carries. Kobel distinguishes five levels at that point and records every action.
Can I use both at the same time?
Yes. They solve different halves of the problem: Docker limits what an unknown server process can touch on your machine, Kobel limits what may happen to your own folders and keeps a log of it. They do not get in each other's way.
Is Docker MCP Toolkit finished?
Docker's own documentation labels the MCP Toolkit as beta, so flags, commands and interface may still change. Check the current state with Docker directly.