The best way to give your AI agents access to production.
A Zero-Trust gateway connecting Claude, Cursor, ChatGPT, and any AI agent to your infrastructure. One server handles production access, debugging, alerts, and internal operations, with new capabilities added as packs. No SSH keys, VPNs, or standing shell access — and every call is recorded.
Free for 3 runners · No credit card required · Apache-2.0 open-source runner & MCP bridge
With eyes on production
Your AI is brilliant. And blind.
Claude, Cursor, and ChatGPT reason about your stack all day — but they can't see it running. Emisar gives your agent eyes and secure hands on production.
Starts from real state
Before it writes a line, the agent reads live logs, metrics, configs, and process state. Its plan is based on what's actually running — not a stale guess from training data.
Debugs what it shipped
Deployed something that misbehaves? The agent inspects the running result, finds its own mistake, and proposes the fix. You don't have to gather the context for it.
Works the incident
When the page fires, it triages across the fleet, lines up logs against metrics, and narrows the cause. Then it hands you a fix it can run the moment you approve.
The change waits for you
When the fix actually changes something, that's the one moment you step in — one approval, scoped and logged. Everything safe runs without you.
Three pillars
A catalog, a gate, and a ledger.
Every request follows the same path. Packs group vetted actions into a versioned catalog. Your policy decides which actions run, wait for approval, or are denied.
Versioned action catalog
Packs live in a catalog, and each one is fingerprinted by its contents. The AI sees only the actions you declared — it can't ask for anything else. An exact hash in the published catalog auto-pins; anything else — a pack edited on a host, one you wrote yourself — waits for an admin to review it.
schema_version: 1 id: linux.systemctl_status title: "Systemd unit status" kind: exec risk: low args: - name: unit type: string required: true validation: pattern: "^[a-zA-Z0-9@._][a-zA-Z0-9@._-]{0,127}$" execution: command: binary: systemctl argv: ["status", "{{ args.unit }}", "--no-pager"]
Policy & approval
Set allow, ask-for-approval, or deny for each risk tier, then override specific actions or policy for a runner group. Approvals can require one person or several — or hand out a limited, revocable pass so routine calls don't ask every time.
Audit + runner journal
Portal records actor, decision, targets, exit code, and exact command executed with its output. And the runner host journal keeps a hash-chained copy for forensic analysis.
Watch it work
A real incident, start to finish.
A CSI driver reformatted a live Pure FlashArray LUN and wiped 33 hours of metrics. Watch the agent investigate through declared actions, stop the writes behind one approval, and hand back the durable fix as a Terraform PR — over MCP, no SSH, every step on the record.
The agent used fs, debugging, docker, and nomad packs from the catalog. Only the high-risk action was paused for human approval.
Why not just…
The alternatives, honestly.
A raw SSH key gives an AI full access to production — until it deletes your database. A weekend-built MCP server is hard to maintain, tied to one cluster, hides errors, and ends up abandoned. Copy-pasting works for one-off tasks, but it does not scale or use the full power of LLMs.
| emisar | Raw SSH key | Custom MCP server | |
|---|---|---|---|
| Typed action contract | Yes | No | Partial |
| Pack drift blocks dispatch | Yes | No | No |
| Risk-tier policy + overrides | Yes | No | Partial |
| Approvals + standing grants | Yes | No | No |
| Signed dispatch (bridge-attested) | Yes | Yes | No |
| Per-user runner scopes | Yes | No | Partial |
| No inbound port on hosts | Yes | No | Partial |
| Audit trail; SIEM export on Team+ | Yes | No | Partial |
| Setup time | 5 min | instant + nightmares | 1-2 weeks |
Case studies
Two incidents, in full.
The storage wipe from the demo, written up end to end — and a completely different failure on the network. Both real, both logged with the command output to prove it.
A CSI driver wiped 33 hours of metrics
The incident from the demo, in full — including the twist. The obvious one-line fix was a no-op, so the durable fix the agent shipped is a guard that refuses to trust the driver.
Read the post-mortemA fleet-wide 502 no backend was causing
Every app behind one edge threw intermittent 502s — yet every backend was green. The agent traced it across five layers to an OOM loop and a wedged node still advertising a dead ingress, then stopped the bleed behind gated approvals.
Read the post-mortemZero Trust for AI Agents
The framework a frontier lab published — enforced by emisar.
Anthropic's Zero Trust for AI Agents guide says an agent with access to real systems needs four things: least agency, deny-by-default tools, human approval for high-risk actions, and durable audit evidence. emisar maps those controls to a portal audit and a separate hash-chained runner journal. We ship core action controls on the Free plan.
Not affiliated with or endorsed by Anthropic. We cite the framework because emisar is built to the control set it describes.
Pricing
Pay per runner. Not per seat.
Free for 3 runners and 1 user. Team is $20/runner/month with unlimited users.
Free
For homelab and tinkering.
- 3 runners
- 1 user
- 7-day audit retention
- Community support
Team
For teams running real production.
- Up to 100 runners
- Unlimited users
- 90-day audit retention
- Automated invoices, email support
Enterprise
For regulated environments & fleets.
- Unlimited runners & users
- 365-day audit retention
- Security and procurement review
- Design-partner deployment planning
FAQ
The skeptical questions, answered.
Can the LLM run anything it wants?
No. The runner accepts only actions declared in a trusted pack and allowed by its local admission rules. Undeclared commands are not part of the agent's catalog and are rejected before execution.
What can it actually do?
Read and tail logs, query metrics, inspect processes, memory, disk, and containers, check your databases, and trace DNS, TLS, and connectivity — across your whole fleet. And, behind approval, act: restart a unit, stop a runaway job, fail over, scale. It's a finite catalog of declared actions, and you can add your own.
Where do approvals happen?
In the web UI and your email inbox. The approver sees the actor, the arguments, the target host, and the policy rule that triggered the gate. One click to allow, one to deny.
Do I have to approve every action?
No. Policy decides by risk tier, action, runner, or runner group. We all know that agents are most useful when they are unleashed so routine, bounded reads can run automatically. Risky mutations can require approval, and destructive actions can be denied. You choose where the agent keeps moving and where a person must step in.
What if my runner dies mid-run?
On Linux, the runner stops the action if it exits. If the runner stays offline, emisar marks its in-flight runs as errored within minutes, so nothing appears to run forever.
Is this MCP-compatible?
Yes. Claude.ai and ChatGPT connect to emisar's remote JSON-RPC MCP server through OAuth. Fifteen local clients — Claude Code, Claude Desktop, Cursor, Windsurf, Zed, Copilot CLI, Gemini CLI, Codex CLI, and more — plus almost any other MCP agent can use the emisar stdio bridge.
Can I self-host the control plane?
The current product uses the hosted emisar control plane. The repository includes deployable control-plane code for evaluation, but supported self-hosted and air-gapped deployments are not generally available today. Contact us if that boundary is a requirement.
What about secrets?
Runner output is redacted before leaving the host and retained in run history. The audit trail stores terminal outcome metadata, including who, when, action, runner, reason, and exit code. Patterns are declared per action; defaults catch about 20 built-in patterns.
Give your AI production access. Without losing sleep.
Three runners and a seven-day audit are included in the free plan. Sign up and let your AI agents take care of your infrastructure.
Prefer a walkthrough first? Book a 30-minute demo.
No credit card required. Cancel anytime.