Infrastructure MCP that keeps agents away from the shell

What it does

emisar is an MCP (Model Context Protocol) server that exposes infrastructure operations to AI clients as a catalog of typed, schema-bounded action packs. A lightweight Go runner lives on each host and dials out to an Elixir/Phoenix control plane over TLS, so hosts never need an inbound listener. When an agent requests an action, policy engines evaluate risk, enforce approval workflows, and only then does the runner verify the pack hash, clamp execution limits, and run the exact declared binary with the exact declared arguments.

The interesting bit

The model never sees a shell. The action pack is the contract: it fixes the executable, argument shape, timeout, and output redaction rules, so the AI selects from a menu rather than inventing command lines. Paranoid operators can even require an Ed25519 intent signature from the MCP client itself, meaning a compromised control plane still cannot originate a call.

Key highlights

• Outbound-only runner: hosts need only HTTPS egress, no open inbound ports
• Content-addressed packs: the runner recomputes pack hashes before execution and rejects unknown or tampered actions
• Dual audit trail: the control plane logs denied and pending requests; each host writes execution attempts to a local hash-chained JSONL journal
• Break-glass exception: a shell pack exists for emergencies but is critical-risk, default-denied, and never auto-suggested
• Split licensing: the on-host runner, MCP bridge, and packs are Apache 2.0; the hosted portal is source-available under BSL 1.1

Caveats

• Not a sandbox or process isolator; the authors recommend pairing it with something like coop for isolation
• The safety boundary is only as strong as the declared actions, pack trust, and host permissions in use
• Explicitly not a generic remote-execution tool or SSH replacement

Verdict

Teams already nervous about giving Cursor or Claude production credentials should look here; if you were hoping for a drop-in sandbox that makes destructive commands harmless, the README explicitly warns this is not it.