Add Deno Docker Environment for MCP Server Execution

[samuraikun]

📋 Overview

This PR adds support for running the AWS S3 MCP server in a Deno runtime via Docker, significantly enhancing security and deployment flexibility. Users can now run the MCP server with either Node.js or Deno environments.

flowchart LR
    Client[MCP Client] -->|MCP Protocol| Server[AWS S3 MCP Server]
    subgraph Container[Docker Container]
        Server -->|API Calls| S3[AWS S3 Service]
        Server -->|Local Storage| Deno[(Deno Runtime)]
    end

    style Container fill:#61affe,stroke:#333,stroke-width:2px,color:#333
    style Client fill:#9063cd,stroke:#333,stroke-width:1px,color:#333
    style Server fill:#ffffff,stroke:#333,stroke-width:1px,color:#333
    style S3 fill:#f5a623,stroke:#333,stroke-width:1px,color:#333
    style Deno fill:#85ea2d,stroke:#333,stroke-width:1px,color:#333

Loading

🔒 Security Background

MCP servers can present security risks when executed directly on local machines. According to a 2025 security analysis by Equixly, MCP servers frequently contain critical vulnerabilities:

Vulnerability Type	Percentage Affected
🚨 Command injection	43%
🔍 Path traversal	22%
🌐 Server-Side Request Forgery	30%

As noted in the article Crashing MCP Server, running MCP servers in Docker containers with Deno provides significant security benefits:

Using Deno for MCP servers allows users to grant permissions to scripts. If the user determines that the MCP server doesn't need network or disk access, they can remove those permissions. Specifying allowed domains through whitelisting can also prevent scenarios where sensitive information is sent externally.

flowchart TD
    subgraph Security[Security Layers]
        L1[Docker Container Isolation] --> L2[Non-root User: deno]
        L2 --> L3[Deno Permission System]
        L3 --> L4[Network Isolation]
    end

    Attacker[Potential Attacker] -.->|Blocked| L1
    Attacker -.->|Blocked| L2
    Attacker -.->|Blocked| L3
    Attacker -.->|Blocked| L4

    Host[Host System] -->|Protected| Security

    style Attacker fill:#e86c60,stroke:#333,stroke-width:2px,color:#333
    style Security fill:#61affe,stroke:#333,stroke-width:2px,color:#333
    style Host fill:#9063cd,stroke:#333,stroke-width:1px,color:#333
    style L1 fill:#85ea2d,stroke:#333,stroke-width:1px,color:#333
    style L2 fill:#85ea2d,stroke:#333,stroke-width:1px,color:#333
    style L3 fill:#85ea2d,stroke:#333,stroke-width:1px,color:#333
    style L4 fill:#85ea2d,stroke:#333,stroke-width:1px,color:#333

Loading

✨ Key Changes

🐳 Docker Configuration Integration

• Unified docker-compose.yml with:

  • 📦 MinIO service (S3-compatible storage)
  • 🦕 Deno MCP server
  • 🔌 Common network configuration

• Secure Dockerfile implementation:

  • 🔰 Based on official Deno image
  • 👤 Non-root user execution (deno user with UID 1993)
  • 🔐 Explicit permission model (allow-net, allow-env, allow-read, allow-sys)
  • 📂 Proper directory ownership and permissions

🛠️ Build and Runtime Process Improvements

• Added unified Makefile:

  • 📋 Standardized command structure
  • 🔄 Support for both Node.js and Deno environments
  • ✅ Environment variable validation

• Added run-inspector-deno.sh script:

  • ⚠️ Error handling
  • 🧹 Proper cleanup procedures
  • 🔄 Container lifecycle management

🔐 Security Features

• Permission-based security model: Deno's explicit permission system prevents unauthorized actions
• Docker isolation: Container-based execution provides additional isolation from host system
• Non-root execution: Reduced privileges minimize impact of potential exploits
• Network security: Controlled network access with Docker networking

🧪 Testing

Tested environments:

• 🍎 macOS with Docker
• ✅ Verified with MCP Inspector

Run on local with MCP Inspector

$ make deno-inspector
Launching MCP Inspector with Deno S3 MCP server...
This will open in your browser. If it doesn't, check the terminal output for a URL to open.
npx @modelcontextprotocol/inspector docker exec -i aws-s3-mcp-aws-s3-mcp-1 deno run --allow-net --allow-env --allow-read --allow-sys /app/src/index.ts
Starting MCP inspector...
⚙️ Proxy server listening on port 6277
🔍 MCP Inspector is up and running at http://127.0.0.1:6274 🚀

🔮 Future Work

• 🧪 Optimize testing strategy across Node.js and Deno environments
• 🦕 Add more comprehensive Deno-native tests
• 🔒 Explore more granular permission settings for even better security

📊 Command Usage

gantt
    title Docker MCP Server Command Flow
    dateFormat  YYYY-MM-DD
    section Setup
    make deno-build           :setup1, 2025-04-01, 1d
    make deno-start           :setup2, after setup1, 1d
    section Testing
    make deno-test            :test1, after setup2, 1d
    section Debugging
    make deno-inspector       :inspect1, after test1, 1d
    section Cleanup
    make deno-stop            :cleanup1, after inspect1, 1d

Loading

[Copilot]

Copilot reviewed 11 out of 16 changed files in this pull request and generated 1 comment.

Files not reviewed (5)

• Dockerfile: Language not supported
• Makefile: Language not supported
• biome.json: Language not supported
• deno.json: Language not supported
• run-inspector-deno.sh: Language not supported

Comments suppressed due to low confidence (1)

README.deno.md:54

• [nitpick] The documentation refers to 'docker-compose.deno.yml' while the diff provides 'docker-compose.yml'. Update the README or file name to ensure consistency and reduce confusion.

docker-compose -f docker-compose.deno.yml up -d

[Copilot]

[nitpick] Suppressing type checks with @ts-ignore may hide potential type mismatches. Consider explicitly casting tool.parameters to the expected type to improve type safety.

[samuraikun]

I quit supporting Deno below.

• aws-s3-mcp had already published an npm package
• Vitest doesn't support Deno
• Containerization is enough to ensure security