Tidesman app icon: a lit harbor lantern over a calm tide

Tidesman

A free native MCP server for running, understanding, and debugging Linux containers with Apple's container tool.

A watchful guide for your local containers. It talks straight to Apple's engine, so your AI assistant can see and steer them from any MCP client.

Install Tidesman View on GitHub
macOS 26 · Apple Silicon Free Signed & notarized Runs locally over stdio
How it works

It speaks to Apple's engine directly

Most tools shell out to the container command line and parse its text output. Tidesman links against Apple's own Swift client library and talks to the container engine directly: fewer moving parts, faster calls, structured results instead of scraped strings.

No CLI scraping. Because Tidesman uses the same client library Apple's own container command uses, it doesn't break when output formatting changes, and it returns structured data your assistant can reason about.

Safe by default

You decide how much it can touch

One --mode flag sets what the server is allowed to do. It starts read-only. Nothing runs, stops, or gets deleted unless you opt in. Your assistant always sees all twenty tools; the mode decides which ones actually run.

Default --mode=read-only

Read-only

Inspect everything, change nothing. The safe place to start.

  • List and inspect containers
  • Read logs
  • List and inspect images
  • Ping the engine and report disk use
--mode=safe

Safe

Everything in Read-only, plus the power to run and manage workloads.

  • Run and exec into containers
  • Start, restart, stop, and kill containers
  • Pull and tag images, repair the engine's own
  • No deletes or prunes
--mode=full

Full

Everything in Safe, plus destructive operations. Grant deliberately.

  • Delete containers and images
  • Prune stopped containers and unused images
  • All read and write tools

Host mounts are off

Tidesman won't mount folders from your Mac into a container unless you explicitly pass --allow-host-mounts=/path, naming the folders it may reach. Your filesystem stays out of reach by default.

Every call is audit-logged

Each tool invocation is written to a local audit log (what ran, when, with which arguments, and what a destructive call removed), so there's always a record of what the assistant did.

Twenty tools

The full surface, grouped by risk

All twenty tools are always visible to your assistant; the mode controls which are callable. Read tools are callable in every mode. Write tools need Safe or Full. The destructive tools need Full. Destructive here means containers or images are removed; a write tool can still end or change what runs inside a container, and your MCP client may flag that on its own.

Read

All modes
system_pingCheck the engine is up and reachable.
system_disk_usageReport disk use for images, containers, and volumes.
container_listList containers and their status.
container_inspectFull configuration and state for one container.
container_logsRead a container's stdout and stderr.
image_listList the images already downloaded.
image_inspectFull details for one image.

Write

Safe + Full
container_runStart a new container from an image.
container_execRun a command inside a running container.
container_startStart an existing stopped container.
container_restartGracefully stop, then start, as one operation.
container_stopGracefully stop a running container.
container_killForce-terminate a container immediately.
image_pullDownload an image from a registry.
image_tagGive an existing image another name.
system_repairRe-download the engine's own infrastructure images.

Destructive

Full only
container_deletePermanently remove a container.
container_pruneRemove every stopped container in one sweep.
image_deletePermanently remove an image.
image_pruneRemove untagged (or all unused) images in one sweep.
Requirements

What you need

  • macOS 26 "Tahoe"

    Built for the current macOS. Apple Silicon only.

  • Apple Silicon

    M-series Mac required. Intel is not supported.

  • Apple's container engine

    Apple's container tool installed and started before you launch Tidesman.

Trust

Runs locally, verifiable

  • Signed & notarized

    Developer-ID signed and notarized by Apple, so Gatekeeper opens it without a fight.

  • Verify your download

    Every release ships a SHA256SUMS file. Check it with shasum -c before you run anything.

  • No network listener

    Tidesman speaks to your client over stdio. It opens no port and listens on no socket.

  • Honest tool annotations

    Every tool declares what it can touch, read-only or destructive, so your MCP client can ask before anything risky runs.

Bring a lantern to your containers

Install Tidesman, point your MCP client at it, and let your assistant see what's running.

Get started View on GitHub