emisar MCP server

emisar

Leave the agent working. Keep production authority bounded.

emisar gives MCP-capable agents a catalog of declared infrastructure actions instead of a shell. Policy decides what runs, what waits for a person, and what is denied. A small outbound-only runner checks the action again on the host before it executes anything.

Start with the public pack catalog, let emisar suggest the packs that match a host, and add your own actions without adding another MCP server to every client.

Start with one host

You need an emisar account, a Linux host with systemd, and sudo. GitHub CLI with gh attestation verify --bundle checks the release signature; without it the installer asks, or warns and continues when run with --yes, on the checksum alone. Allow outbound HTTPS to emisar.dev:443, registry.emisar.dev:443, tuf-repo-cdn.sigstore.dev:443, and tuf-repo.github.com:443. The last two serve the public trust roots used to authenticate release checksums; no GitHub login is required.

GitHub is the optional release fallback. To permit that fallback, also allow api.github.com:443, github.com:443, and release-assets.githubusercontent.com:443.

it contains a fresh, single-use enrollment key.

1. In the console, choose Connect a runner. Copy the generated command;

1. Run it on the host:

curl -fsSL https://emisar.dev/install.sh \
     | sudo EMISAR_ENROLLMENT_KEY=emkey-enroll-... bash

The installer authenticates the signed release checksum, verifies the archive against it, creates the service, installs host-matched starter packs, and starts the runner.

linux.uptime with a reason. You are done when the output appears and the run is present in the audit trail.

1. Confirm the runner is online in the console, then dispatch

local stdio clients can use the emisar-mcp bridge and its browser approval flow.

1. Open LLM agents and connect your client. Remote MCP clients use OAuth;

The complete walkthrough, including expected output and troubleshooting, is at emisar.dev/docs/quickstart. An agent can perform and certify the setup with the public install-emisar skill.

How an action runs

AI client
    |  MCP: discover actions, request one with typed arguments
    v
emisar control plane
    |  authenticate, scope, apply policy, wait for approval when required
    v
outbound-only runner
    |  verify pack hash, validate arguments, enforce local limits
    v
declared host command
       stream redacted output, journal the attempt, update fleet audit

The action pack is the contract. It fixes the executable, argv shape, argument schema, risk, timeout, output limits, redaction, and side-effect description. The model selects from that contract; it does not invent a command line for the runner to execute.

Adding a pack adds capabilities behind the same MCP surface. Operators do not need to deploy another tool server or reconfigure every agent when the catalog changes.

What holds the boundary

Shortened. The full README is on GitHub.