Emisar

emisar is an MCP gateway that lets AI agents investigate and operate infrastructure through a catalog of declared actions rather than a shell. An agent connected over MCP can read live logs, metrics, configs, and process state, debug what it deployed, and triage incidents, while policy decides which actions run, which wait for a person, and which are denied.

Every request follows the same path. The AI client discovers actions and requests one with typed arguments, the control plane authenticates, scopes, applies policy, and waits for approval when required, and a small outbound-only runner on the host verifies the pack hash, validates the arguments, enforces local limits, and runs the declared command. Output is redacted before it leaves the host, and the attempt is journaled.

Actions come in packs. Each pack fixes the executable, argument shape and schema, risk tier, timeout, output limits, redaction, and a side-effect description, so the model selects from a contract instead of inventing a command line. Packs are content-addressed: a hash that matches the published catalog is pinned automatically, and edited or custom packs wait for an admin to trust them. Adding a pack adds capabilities behind the same MCP server without reconfiguring every client.

Policy sets allow, ask, or deny per risk tier, with per-action and per-runner-group overrides, standing grants, and conditional approvals. Two audit records are kept: the control-plane audit (including denied and pending requests) and a hash-chained journal on each runner. A runner can also require intent signed by the customer's MCP bridge, so the control plane cannot originate or widen a call.

emisar is not a sandbox, a generic command executor, or a replacement for OS least privilege or change management. A staging-only shell pack exists as a default-denied break-glass exception. The runner, MCP bridge, and packs are open source, and the control plane is source-available and also offered as a hosted service.