emisar

Leave the agent working. Keep production authority bounded.

emisar gives MCP-capable agents a catalog of declared infrastructure actions instead of a shell. Policy decides what runs, what waits for a person, and what is denied. A small outbound-only runner checks the action again on the host before it executes anything.

Start with the public pack catalog and let emisar suggest the packs that match a host. Add your own actions without adding another MCP server to every client.

Start with one host

You need an emisar account, a Linux host with systemd, and sudo. GitHub CLI with gh attestation verify --bundle checks the release signature. Without GitHub CLI, the installer asks before it continues with only the checksum. With --yes, it warns and continues. Allow outbound HTTPS to emisar.dev:443, registry.emisar.dev:443, tuf-repo-cdn.sigstore.dev:443, and tuf-repo.github.com:443. The last two serve the public trust roots used to authenticate release checksums. No GitHub login is required.

GitHub is the optional release fallback. If you want that fallback, also allow api.github.com:443, github.com:443, and release-assets.githubusercontent.com:443.

1. In the console, choose Connect a runner. Copy the generated command; it contains a fresh, single-use enrollment key.

2. Run it on the host:

   curl -fsSL https://emisar.dev/install.sh \
     | sudo EMISAR_ENROLLMENT_KEY=emkey-enroll-... bash
   

   The installer authenticates the signed release checksum and verifies the archive against it. It then creates the service, installs host-matched starter packs, and starts the runner.

3. Confirm the runner is online in the console, then dispatch linux.uptime with a reason. You are done when the output appears and the run is present in the audit trail.

4. Open AI agents and connect your client. Remote MCP clients use OAuth; local stdio clients can use the emisar-mcp bridge and its browser approval flow.

The complete walkthrough, including expected output and troubleshooting, is at emisar.dev/docs/quickstart. An agent can perform and certify the setup with the public install-emisar skill.

How an action runs

AI client
    |  MCP: discover actions, request one with typed arguments
    v
emisar control plane
    |  authenticate, scope, apply policy, wait for approval when required
    v
outbound-only runner
    |  verify pack hash, validate arguments, enforce local limits
    v
declared host command
       stream redacted output, journal the attempt, update fleet audit

The action pack defines the contract: the executable, argv shape, argument schema, risk, timeout, output limits, redaction, and side-effect description. The model selects from that contract; it does not invent a command line for the runner to execute.

Adding a pack adds capabilities behind the same MCP surface. Operators do not need to deploy another tool server or reconfigure every agent when the catalog changes.

What holds the boundary