AndrewDryga/emisar
An MCP that lets AI tools securely connect to your infrastructure, write IaaS code, debug issues, and assist during incidents - without risking production stability. Built for security teams to approve and infrastructure teams to experience like magic.
What it solves
AI agents often require access to system shells to be useful, but providing a raw shell creates significant security risks. Emisar solves this by replacing unrestricted shell access with a catalog of predefined, schema-bounded infrastructure actions, ensuring agents can only perform authorized tasks.
How it works
Emisar uses a Model Context Protocol (MCP) architecture consisting of a control plane and an outbound-only runner. Instead of an agent inventing arbitrary commands, it selects from a catalog of "action packs" that define exact executables, arguments, and risk levels. The runner on the host verifies these packs, enforces local limits, and redacts output before sending it back to the agent, ensuring the agent never has direct, unmediated control over the host.
Who it’s for
- AI Developers building agents that need to interact with real-world infrastructure safely.
- System Operators who want to grant AI agents specific, audited capabilities without opening inbound network ports.
- Security-conscious Organizations requiring strict policy enforcement, audit trails, and human-in-the-loop approvals for agentic actions.
Highlights
- Outbound-only connectivity: The host runner dials out to the control plane, meaning no inbound ports need to be opened.
- Declared actions only: Agents must use typed, schema-bounded arguments rather than raw command strings.
- Policy-driven execution: Supports risk-based policies, conditional approvals, and standing grants.
- Robust auditing: Maintains a dual audit trail via the control plane and a local, hash-chained JSONL journal on the host.