Infrabroker MCP server

infrabroker

Infrastructure access broker for AI agents — SSH & Kubernetes. The model never touches a credential. (formerly ssh-broker)

The agent requests an action — run a command on a host, query or change a cluster. infrabroker checks it against policy, executes it with a credential minted for that single operation — an ephemeral, scope-limited SSH certificate from its own CA, or a short-lived bound ServiceAccount token — and returns only the output. Keys, certificates and tokens live in the broker's memory and are discarded after the call: nothing enters the model's context, so a prompt-injected agent has nothing to exfiltrate.

One binary — infrabroker — exposes the same engine (internal/broker) and tool surface (internal/mcpserver) over three transports, chosen by subcommand. (The legacy per-transport binaries broker / mcp-broker / mcp-broker-http remain as thin deprecated wrappers over these subcommands, so existing configs keep working.)

Tools: sshexecute, sshsessionopen / sshsessionexec / sshsessionclose, sshlistservers, sshputfile / sshgetfile; with clusters configured, also k8sget / k8slist / k8slogs / k8sapply / k8sdelete / k8slistclusters. No transport auth — isolation comes from the process being launched by the user (as the MCP spec recommends for stdio).

• MCP stdio (local, recommended for personal use) — infrabroker serve-mcp.

Streamable HTTP. Same tools, but each client authenticates with an OIDC bearer token validated locally against the issuer's JWKS; the user identity (and groups, for per-user RBAC) is propagated to the signer.

• MCP HTTP + OAuth2/OIDC (remote, multi-user) — infrabroker serve-mcp-http,

network agents authenticated with a client certificate.

• HTTP + mTLS — infrabroker serve-http, POST /v1/ssh_run (one-shot), for

Documentation

This README is a landing page. The detail lives in focused, single-source docs:

Why infrabroker

Shortened. The full README is on GitHub.