Dev MCP

The image's entry point starts a development server with its own defaults. There is nothing to configure and nothing to name — pull the image and run it:

docker run -i --rm \
  --cap-add=SYS_PTRACE \
  --cap-add=SYS_ADMIN \
  --cap-add=NET_ADMIN \
  --security-opt seccomp=unconfined \
  --security-opt apparmor=unconfined \
  --network=none \
  inventory.forallsecure.com/<environment-name>:<tag>

-i holds standard input open, which is how the server speaks: it talks the Model Context Protocol over standard input and output rather than over a port, so there is nothing to publish and nothing to connect to. --rm cleans up when your client disconnects.

This is the fastest way to see an environment respond, and it is what to point a new harness at while you are still getting the plumbing right.

What it is not for

The development server has no resistance to reward hacking. It will grade an attempt and hand you a number, and that number says nothing about how an agent would do against the real thing — only that your client and the environment are talking to each other.

If a score is going into a report, a comparison or a decision, it has to come from Custom, where you choose the tools, the weights and the attempt budget and know what was measured.

If it does not start

unshare: operation not permitted, or every run of the target failing, means SYS_ADMIN was not granted. The pre-flight checklist has a single-call smoke test and the rest of the symptoms.