Meraki Read-Only

Clone the repository. The Docker backend lives in docker/ and ships a custom-catalog.yaml alongside the Dockerfile.

$ git clone https://github.com/rosarion97/meraki-readonly-mcp-server-public.git
$ cd meraki-readonly-mcp-server-public/docker

The image tag must match the image: field in custom-catalog.yaml (meraki-readonly-mcp:latest).

$ docker build -t meraki-readonly-mcp:latest .

You need two values, both validated at startup: MERAKI_API_KEY and MERAKI_ORG_ID. Grab the org ID with your key:

$ curl -H "Authorization: Bearer $MERAKI_API_KEY" \
    https://api.meraki.com/api/v1/organizations

Option A, MCP Toolkit secret (recommended). Store each value in Docker Desktop's encrypted store; the gateway injects them as env vars at launch. With Option A, continue through Steps 4–7 below.

$ docker mcp secret set MERAKI_API_KEY
$ docker mcp secret set MERAKI_ORG_ID
$ docker mcp secret ls   # values are masked

$ cp .env.example .env
$ chmod 600 .env   # then set MERAKI_API_KEY and MERAKI_ORG_ID

{
  "mcpServers": {
    "meraki": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "--env-file", "/absolute/path/to/docker/.env",
        "meraki-readonly-mcp:latest"
      ]
    }
  }
}

Steps 4–6 are the Option A (secret store) path. Used Option B? Skip to Step 7.

$ mkdir -p ~/.docker/mcp/catalogs
$ cp custom-catalog.yaml ~/.docker/mcp/catalogs/custom.yaml

Add the entry under the single top-level registry: key in ~/.docker/mcp/registry.yaml. Don't overwrite the file if it already exists.

registry:
  meraki-readonly:
    catalog: custom
    enabled: true

Add the gateway block to claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json). The gateway spawns the Meraki image on demand, reads your catalog and registry, and resolves your MERAKI_* secrets at request time. Replace <your-username> with your macOS username (run whoami to check):

{
  "mcpServers": {
    "mcp-toolkit-gateway": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "/var/run/docker.sock:/var/run/docker.sock",
        "-v", "/Users/<your-username>/.docker/mcp:/mcp",
        "-v", "/Users/<your-username>/Library/Caches/docker-secrets-engine/engine.sock:/root/.cache/docker-secrets-engine/engine.sock",
        "docker/mcp-gateway:latest",
        "--catalog=/mcp/catalogs/custom.yaml",
        "--registry=/mcp/registry.yaml",
        "--transport=stdio"
      ]
    }
  }
}

All three bind-mounts are required: the Docker socket lets the gateway spawn the server container; ~/.docker/mcp is where it reads your catalog and registry; the docker-secrets-engine socket is the resolver Docker Desktop exposes for the secret store, without it your MERAKI_* URLs resolve to empty strings and the server never starts. On Linux Docker Desktop the path is ~/.docker/desktop/secrets-engine/engine.sock; find it with find ~ -name engine.sock.

Then quit and reopen the client. claude_desktop_config.json never contains the API key, the gateway resolves it from Docker's secret store at request time. As a shortcut, docker mcp client connect claude-desktop (or MCP Toolkit → Clients in Docker Desktop) writes a similar block automatically; the explicit JSON above survives Docker Desktop updates that may rewrite the auto-managed entry.

$ docker mcp server list   # meraki-readonly → enabled
$ docker mcp tools list

Or run the image directly, it starts and waits silently on stdin (correct for an MCP stdio server). Press Ctrl+C to exit; a missing value fails fast on stderr.

$ docker run --rm -i --env-file .env meraki-readonly-mcp:latest

Clone the repository. The Podman backend lives in podman/.

$ git clone https://github.com/rosarion97/meraki-readonly-mcp-server-public.git
$ cd meraki-readonly-mcp-server-public/podman

On macOS / Windows, start a Podman machine first (podman machine init && podman machine start); Linux runs natively.

$ podman build -t meraki-readonly-mcp:latest .

Two required values: MERAKI_API_KEY and MERAKI_ORG_ID (one container serves one org). Option 1 keeps them in Podman's encrypted secret store and is recommended; Option 2 writes a plaintext .env.

$ printf '%s' 'YOUR_MERAKI_API_KEY' | podman secret create meraki_api_key -
$ printf '%s' 'YOUR_ORG_ID'         | podman secret create meraki_org_id -
$ podman secret ls   # confirm both (values not shown)

$ cp .env.example .env
$ chmod 600 .env   # then set MERAKI_API_KEY and MERAKI_ORG_ID

Add the entry matching your Step 3 choice. Option 1 injects each secret with type=env,target=NAME; Option 2 reads them from your .env.

{
  "mcpServers": {
    "meraki": {
      "command": "podman",
      "args": [
        "run", "--rm", "-i",
        "--secret", "meraki_api_key,type=env,target=MERAKI_API_KEY",
        "--secret", "meraki_org_id,type=env,target=MERAKI_ORG_ID",
        "meraki-readonly-mcp:latest"
      ]
    }
  }
}

{
  "mcpServers": {
    "meraki": {
      "command": "podman",
      "args": [
        "run", "--rm", "-i",
        "--env-file", "/absolute/path/to/podman/.env",
        "meraki-readonly-mcp:latest"
      ]
    }
  }
}

Claude Code uses the same shape in .claude/settings.json (project) or ~/.claude/settings.json (global). -i is required; paths must be absolute.

Run the image manually, it starts and waits on stdin. Press Ctrl+C to exit.

$ podman run --rm -i \
    --secret meraki_api_key,type=env,target=MERAKI_API_KEY \
    --secret meraki_org_id,type=env,target=MERAKI_ORG_ID \
    meraki-readonly-mcp:latest