emisar

Name: emisar
Author: AndrewDryga

440stars78forks

How to install emisar?

andrewdryga/emisar

$git clone https://github.com/AndrewDryga/emisar

Installs into the current project.

Summary

Leave the agent working. Keep production authority bounded.

Files · 1

View on GitHub

README.md

1	# emisar
2
3	Leave the agent working. Keep production authority bounded.
4
5	emisar gives MCP-capable agents a catalog of declared infrastructure actions
6	instead of a shell. Policy decides what runs, what waits for a person, and what
7	is denied. A small outbound-only runner checks the action again on the host
8	before it executes anything.
9
10	Start with the public pack catalog, let emisar suggest the packs that match a
11	host, and add your own actions without adding another MCP server to every
12	client.
13
14	## Start with one host
15
16	You need an [emisar account](https://emisar.dev/sign_up), a Linux host with
17	systemd and `sudo`, and outbound HTTPS access to `emisar.dev:443`. You do not
18	open an inbound port on the host.
19
20	1. In the dashboard, choose Connect a runner. Copy the generated command;
21	it contains a fresh, single-use enrollment key.
22	2. Run it on the host:
23
24	```sh
25	curl -sSL https://emisar.dev/install.sh \
26	\| sudo EMISAR_ENROLLMENT_KEY=emkey-enroll-... EMISAR_URL=https://emisar.dev bash
27	```
28
29	The installer verifies the release checksum, creates the service, installs
30	host-matched starter packs, and starts the runner.
31	3. Confirm the runner is online in the dashboard, then dispatch
32	`linux.uptime` with a reason. You are done when the output appears and the
33	run is present in the audit trail.
34	4. Open LLM agents and connect your client. Remote MCP clients use OAuth;
35	local stdio clients can use the `emisar-mcp` bridge and its browser approval
36	flow.
37
38	The complete walkthrough, including expected output and troubleshooting, is at
39	[emisar.dev/docs/quickstart](https://emisar.dev/docs/quickstart). An agent can
40	perform and certify the setup with the public
41	[`install-emisar` skill](skills/install-emisar/SKILL.md).
42
43	## How an action runs
44
45	```text
46	AI client
47	\| MCP: discover actions, request one with typed arguments
48	v
49	emisar control plane
50	\| authenticate, scope, apply policy, wait for approval when required
51	v
52	outbound-only runner
53	\| verify pack hash, validate arguments, enforce local limits
54	v
55	declared host command
56	stream redacted output, journal the attempt, update fleet audit
57	```
58
59	The action pack is the contract. It fixes the executable, argv shape, argument
60	schema, risk, timeout, output limits, redaction, and side-effect description.
61	The model selects from that contract; it does not invent a command line for the
62	runner to execute.
63
64	Adding a pack adds capabilities behind the same MCP surface. Operators do not
65	need to deploy another tool server or reconfigure every agent when the catalog
66	changes.
67
68	## What holds the boundary
69
70	- No inbound runner listener. The runner dials the control plane over a TLS
71	websocket.
72	- Declared actions only. Cloud input is limited to typed, schema-bounded
73	arguments. The runner rejects unknown actions and arguments.
74	- Content-addressed packs. The control plane pins the trusted pack hash; the
75	runner recomputes it from disk before execution. New or changed custom packs
76	wait for trust.
77	- Policy before side effects. Runner scope, risk policy, action overrides,
78	standing grants, and conditional approval are evaluated before dispatch.
79	- Host-side enforcement. The runner clamps execution options to the pack's
80	limits, runs the declared binary and argv, and redacts output before it leaves
81	the host.
82	- Two records. The control-plane audit includes denied and pending requests;
83	every runner also writes its execution attempts and local refusals to a
84	hash-chained JSONL journal.
85	- Optional client-attested dispatch. A runner can require an Ed25519 intent
86	signed by the MCP client, so the control plane cannot originate or widen a
87	permitted call.
88
89	Read the exact guarantees, limitations, and threat model in
90	[`docs/security-model.md`](docs/security-model.md).
91
92	## What emisar is not
93
94	- It is not a sandbox or process isolator. We recommend using one, such as
95	[coop](https://github.com/AndrewDryga/coop).
96	- It is not a generic `execute(com

People who liked this also viewed

6 picks

Type

mcp-proxy-for-awsAWS MCP Proxy ServerMCP ServersJul 20262.0M327
pydantic-ai-backendFile Storage & Sandbox Backends for Pydantic AI: console tools for file operations, Docker-isolated sandboxes for safe execution, and permission system with presets for access control. Enables secure multi-user handling and testing in agents via in-memory, local, or containerized storage.MCP ServersJul 2026197k114
mcp-for-argocdAn implementation of Model Context Protocol (MCP) server for Argo CD.MCP ServersJul 202690k541
heroku-mcp-serverHeroku Platform MCP Server using the Heroku CLIMCP ServersJul 202626k80
ghost-mcpA Model Context Protocol (MCP) server for interacting with Ghost CMS through LLM interfaces like Claude. Allow you to control your Ghost blog by simply asking Claude etc.MCP ServersApr 202620k215
Google DriveUpload, organize, and share files in the cloud. Manage folders, set permissions, and search across stored documents.MCP Serversrecently15k0

emisar

440stars78forks

View on GitHub

How to install emisar?

andrewdryga/emisar

$git clone https://github.com/AndrewDryga/emisar

Installs into the current project.

Summary

Leave the agent working. Keep production authority bounded.

Files · 1

View on GitHub

README.md

1	# emisar
2
3	Leave the agent working. Keep production authority bounded.
4
5	emisar gives MCP-capable agents a catalog of declared infrastructure actions
6	instead of a shell. Policy decides what runs, what waits for a person, and what
7	is denied. A small outbound-only runner checks the action again on the host
8	before it executes anything.
9
10	Start with the public pack catalog, let emisar suggest the packs that match a
11	host, and add your own actions without adding another MCP server to every
12	client.
13
14	## Start with one host
15
16	You need an [emisar account](https://emisar.dev/sign_up), a Linux host with
17	systemd and `sudo`, and outbound HTTPS access to `emisar.dev:443`. You do not
18	open an inbound port on the host.
19
20	1. In the dashboard, choose Connect a runner. Copy the generated command;
21	it contains a fresh, single-use enrollment key.
22	2. Run it on the host:
23
24	```sh
25	curl -sSL https://emisar.dev/install.sh \
26	\| sudo EMISAR_ENROLLMENT_KEY=emkey-enroll-... EMISAR_URL=https://emisar.dev bash
27	```
28
29	The installer verifies the release checksum, creates the service, installs
30	host-matched starter packs, and starts the runner.
31	3. Confirm the runner is online in the dashboard, then dispatch
32	`linux.uptime` with a reason. You are done when the output appears and the
33	run is present in the audit trail.
34	4. Open LLM agents and connect your client. Remote MCP clients use OAuth;
35	local stdio clients can use the `emisar-mcp` bridge and its browser approval
36	flow.
37
38	The complete walkthrough, including expected output and troubleshooting, is at
39	[emisar.dev/docs/quickstart](https://emisar.dev/docs/quickstart). An agent can
40	perform and certify the setup with the public
41	[`install-emisar` skill](skills/install-emisar/SKILL.md).
42
43	## How an action runs
44
45	```text
46	AI client
47	\| MCP: discover actions, request one with typed arguments
48	v
49	emisar control plane
50	\| authenticate, scope, apply policy, wait for approval when required
51	v
52	outbound-only runner
53	\| verify pack hash, validate arguments, enforce local limits
54	v
55	declared host command
56	stream redacted output, journal the attempt, update fleet audit
57	```
58
59	The action pack is the contract. It fixes the executable, argv shape, argument
60	schema, risk, timeout, output limits, redaction, and side-effect description.
61	The model selects from that contract; it does not invent a command line for the
62	runner to execute.
63
64	Adding a pack adds capabilities behind the same MCP surface. Operators do not
65	need to deploy another tool server or reconfigure every agent when the catalog
66	changes.
67
68	## What holds the boundary
69
70	- No inbound runner listener. The runner dials the control plane over a TLS
71	websocket.
72	- Declared actions only. Cloud input is limited to typed, schema-bounded
73	arguments. The runner rejects unknown actions and arguments.
74	- Content-addressed packs. The control plane pins the trusted pack hash; the
75	runner recomputes it from disk before execution. New or changed custom packs
76	wait for trust.
77	- Policy before side effects. Runner scope, risk policy, action overrides,
78	standing grants, and conditional approval are evaluated before dispatch.
79	- Host-side enforcement. The runner clamps execution options to the pack's
80	limits, runs the declared binary and argv, and redacts output before it leaves
81	the host.
82	- Two records. The control-plane audit includes denied and pending requests;
83	every runner also writes its execution attempts and local refusals to a
84	hash-chained JSONL journal.
85	- Optional client-attested dispatch. A runner can require an Ed25519 intent
86	signed by the MCP client, so the control plane cannot originate or widen a
87	permitted call.
88
89	Read the exact guarantees, limitations, and threat model in
90	[`docs/security-model.md`](docs/security-model.md).
91
92	## What emisar is not
93
94	- It is not a sandbox or process isolator. We recommend using one, such as
95	[coop](https://github.com/AndrewDryga/coop).
96	- It is not a generic `execute(com

People who liked this also viewed

6 picks

Type