AndrewDryga/emisar

Let AI agents investigate and operate infrastructure through declared actions, bounded by policy and host-side checks. Approvals when required, with an audit trail. By Protectorate.

What it solves

Emisar provides a secure way for AI agents to perform infrastructure actions on a host without giving them full shell access. It prevents agents from inventing their own commands or executing arbitrary code, ensuring that production authority remains bounded and controlled.

How it works

Emisar replaces the shell with a catalog of declared "action packs"—predefined, schema-bounded commands with fixed executables and arguments.

  1. AI Client: An agent requests a specific action from the catalog via the Model Context Protocol (MCP).
  2. Control Plane: Authenticates the request, applies security policies, and handles approvals.
  3. Outbound-only Runner: A Go-based agent on the host connects via an outbound TLS WebSocket (no inbound listener), verifies the action pack's hash, and executes the declared command within specified limits.
  4. Execution: The runner redacts output before sending it back to the agent and logs the attempt in a hash-chained journal.

Who it’s for

System administrators and DevOps engineers who want to enable AI agents to manage infrastructure while maintaining strict security boundaries and audit trails.

Highlights

  • No Inbound Listeners: The runner uses outbound-only connections to eliminate attack surfaces.
  • Declared Actions Only: Agents are limited to typed, schema-bounded arguments and cannot execute arbitrary shell commands.
  • Content-Addressed Packs: Action packs are pinned by hash to ensure the code being executed is trusted.
  • Policy-Driven Execution: Actions can be configured to require human approval or be denied based on risk policy.
  • MCP Integration: Works with MCP-capable clients like Claude, ChatGPT, and Cursor through a dedicated bridge.

Related

  • Project
    canyonroad/agentsh

    A secure, policy-enforced execution gateway for AI agents that intercepts and governs file, network, process, and database activity at runtime.

  • Project
    PrismorSec/prismor

    Prismor is a runtime security framework for AI agents that observes and enforces security policies to prevent prompt injection, secret exfiltration, and destructive actions.

  • Project
    NVIDIA/OpenShell

    A secure, private runtime for autonomous AI agents that uses sandboxed execution environments and declarative YAML policies to protect data and infrastructure.

  • Project
    aaron-for-value/VeriRun

    A distributed runtime for reproducible and isolated executable evaluation of AI agents and code-generation models, ensuring safety and provenance.

  • Project
    dengyier/OpenWorkProof

    An open protocol for AI Agent work contracts and verifiable execution, ensuring that agent actions are authorized, evidenced, and formally accepted by humans.