Skip to main content

The best way to give your AI agents access to production.

A Zero-Trust gateway connecting Claude, Cursor, ChatGPT, and any AI agent to your infrastructure. One server handles production access, debugging, alerts, and internal operations, with new capabilities added as packs. No SSH keys, VPNs, or standing shell access — and every call is recorded.

Free for 3 runners · No credit card required · Apache-2.0 open-source runner & MCP bridge

claude · emisar MCP
nomad.alloc_logs checkout allowed
prom.query rate(http_5xx) allowed
nomad.job_history checkout allowed
nomad.job_revert checkout approval
then claude opens a PR with the durable fix — it fixes an application bug it found in the logs and updates the Nomad job spec.
1,689
audited actions · 100 packs
Zero-Trust for AI
built to Anthropic's control set
Audit logged
with a tamper-evident copy on the host
Open code
Apache-2.0 runner and MCP bridge.

With eyes on production

Your AI is brilliant. And blind.

Claude, Cursor, and ChatGPT reason about your stack all day — but they can't see it running. Emisar gives your agent eyes and secure hands on production.

Browse the full catalog it can reach 

Starts from real state

Before it writes a line, the agent reads live logs, metrics, configs, and process state. Its plan is based on what's actually running — not a stale guess from training data.

Debugs what it shipped

Deployed something that misbehaves? The agent inspects the running result, finds its own mistake, and proposes the fix. You don't have to gather the context for it.

Works the incident

When the page fires, it triages across the fleet, lines up logs against metrics, and narrows the cause. Then it hands you a fix it can run the moment you approve.

The change waits for you

When the fix actually changes something, that's the one moment you step in — one approval, scoped and logged. Everything safe runs without you.

Three pillars

A catalog, a gate, and a ledger.

Every request follows the same path. Packs group vetted actions into a versioned catalog. Your policy decides which actions run, wait for approval, or are denied.

Versioned action catalog

Packs live in a catalog, and each one is fingerprinted by its contents. The AI sees only the actions you declared — it can't ask for anything else. An exact hash in the published catalog auto-pins; anything else — a pack edited on a host, one you wrote yourself — waits for an admin to review it.

linux-core/actions/systemctl_status.yaml
schema_version: 1
id: linux.systemctl_status
title: "Systemd unit status"
kind: exec
risk: low
args:
  - name: unit
    type: string
    required: true
    validation:
      pattern: "^[a-zA-Z0-9@._][a-zA-Z0-9@._-]{0,127}$"
execution:
  command:
    binary: systemctl
    argv: ["status", "{{ args.unit }}", "--no-pager"]

Policy & approval

Set allow, ask-for-approval, or deny for each risk tier, then override specific actions or policy for a runner group. Approvals can require one person or several — or hand out a limited, revocable pass so routine calls don't ask every time.

Risk-tier defaults
lowallow
mediumallow
highrequire approval
criticaldeny
Overrides first match wins
*.delete_* deny
nomad.job_* require approval
Or scope a stricter ruleset to a single runner or a group.

Audit + runner journal

Portal records actor, decision, targets, exit code, and exact command executed with its output. And the runner host journal keeps a hash-chained copy for forensic analysis.

emisar.dev / audit
14:02
Run succeeded
action_run.success nomad.alloc_logs
api_key: claude-prod
14:01
Awaiting approval
action_run.pending_approval nomad.job_revert
api_key: claude-prod
13:58
Approval granted
approval.approved caddy.reload_config
user: ops@acme.co
13:52
Denied by policy
action_run.denied linux.reboot_host
api_key: claude-prod

Browse all 1,689 actions across 100 packs — Postgres, Docker, Nomad, Kubernetes, the AWS suite, and more 

Watch it work

A real incident, start to finish.

A CSI driver reformatted a live Pure FlashArray LUN and wiped 33 hours of metrics. Watch the agent investigate through declared actions, stop the writes behind one approval, and hand back the durable fix as a Terraform PR — over MCP, no SSH, every step on the record.

# nomad-hvn03 · Dell R640 · Pure FlashArray over iSCSI multipath · democratic-csi v1.9.5
curl -fsSL https://emisar.dev/install.sh | sudo bash
downloading emisar-0.16.0-linux-amd64.tar.gz
checksum verified sha256:9f2c1e7b4a0d… · installed v0.16.0
emisar connecting to wss://emisar.dev/runner/socket/websocket (group=storage packs=multipath,iscsi,pure,nomad,debugging,docker)
runner online · nomad-hvn03 · advertising 84 actions, every one policy-gated
level=INFO msg="run dispatched" action=nomad.alloc_stop run=run_5d36c9 via=approval
level=INFO msg="run complete" action=nomad.alloc_stop exit=0 dur=0.38s

The agent used fs, debugging, docker, and nomad packs from the catalog. Only the high-risk action was paused for human approval.

Why not just…

The alternatives, honestly.

A raw SSH key gives an AI full access to production — until it deletes your database. A weekend-built MCP server is hard to maintain, tied to one cluster, hides errors, and ends up abandoned. Copy-pasting works for one-off tasks, but it does not scale or use the full power of LLMs.

emisar Raw SSH key Custom MCP server
Typed action contract Yes No Partial
Pack drift blocks dispatch Yes No No
Risk-tier policy + overrides Yes No Partial
Approvals + standing grants Yes No No
Signed dispatch (bridge-attested) Yes Yes No
Per-user runner scopes Yes No Partial
No inbound port on hosts Yes No Partial
Audit trail; SIEM export on Team+ Yes No Partial
Setup time 5 min instant + nightmares 1-2 weeks

Case studies

Two incidents, in full.

The storage wipe from the demo, written up end to end — and a completely different failure on the network. Both real, both logged with the command output to prove it.

storage

A CSI driver wiped 33 hours of metrics

The incident from the demo, in full — including the twist. The obvious one-line fix was a no-op, so the durable fix the agent shipped is a guard that refuses to trust the driver.

Read the post-mortem 
ingress

A fleet-wide 502 no backend was causing

Every app behind one edge threw intermittent 502s — yet every backend was green. The agent traced it across five layers to an OOM loop and a wedged node still advertising a dead ingress, then stopped the bleed behind gated approvals.

Read the post-mortem 

See every use case — the daily wins and the war stories 

Zero Trust for AI Agents

The framework a frontier lab published — enforced by emisar.

Anthropic's Zero Trust for AI Agents guide says an agent with access to real systems needs four things: least agency, deny-by-default tools, human approval for high-risk actions, and durable audit evidence. emisar maps those controls to a portal audit and a separate hash-chained runner journal. We ship core action controls on the Free plan.

See emisar mapped to the framework, control by control 

Not affiliated with or endorsed by Anthropic. We cite the framework because emisar is built to the control set it describes.

Pricing

Pay per runner. Not per seat.

Free for 3 runners and 1 user. Team is $20/runner/month with unlimited users.

Free

For homelab and tinkering.

$0 / forever
Start free
  • 3 runners
  • 1 user
  • 7-day audit retention
  • Community support
Most popular

Team

For teams running real production.

$20 / runner / month
Start free
  • Up to 100 runners
  • Unlimited users
  • 90-day audit retention
  • Automated invoices, email support

Enterprise

For regulated environments & fleets.

Custom
Talk to sales
  • Unlimited runners & users
  • 365-day audit retention
  • Security and procurement review
  • Design-partner deployment planning

FAQ

The skeptical questions, answered.

Can the LLM run anything it wants?

No. The runner accepts only actions declared in a trusted pack and allowed by its local admission rules. Undeclared commands are not part of the agent's catalog and are rejected before execution.

What can it actually do?

Read and tail logs, query metrics, inspect processes, memory, disk, and containers, check your databases, and trace DNS, TLS, and connectivity — across your whole fleet. And, behind approval, act: restart a unit, stop a runaway job, fail over, scale. It's a finite catalog of declared actions, and you can add your own.

Where do approvals happen?

In the web UI and your email inbox. The approver sees the actor, the arguments, the target host, and the policy rule that triggered the gate. One click to allow, one to deny.

Do I have to approve every action?

No. Policy decides by risk tier, action, runner, or runner group. We all know that agents are most useful when they are unleashed so routine, bounded reads can run automatically. Risky mutations can require approval, and destructive actions can be denied. You choose where the agent keeps moving and where a person must step in.

What if my runner dies mid-run?

On Linux, the runner stops the action if it exits. If the runner stays offline, emisar marks its in-flight runs as errored within minutes, so nothing appears to run forever.

Is this MCP-compatible?

Yes. Claude.ai and ChatGPT connect to emisar's remote JSON-RPC MCP server through OAuth. Fifteen local clients — Claude Code, Claude Desktop, Cursor, Windsurf, Zed, Copilot CLI, Gemini CLI, Codex CLI, and more — plus almost any other MCP agent can use the emisar stdio bridge.

Can I self-host the control plane?

The current product uses the hosted emisar control plane. The repository includes deployable control-plane code for evaluation, but supported self-hosted and air-gapped deployments are not generally available today. Contact us if that boundary is a requirement.

What about secrets?

Runner output is redacted before leaving the host and retained in run history. The audit trail stores terminal outcome metadata, including who, when, action, runner, reason, and exit code. Patterns are declared per action; defaults catch about 20 built-in patterns.

Give your AI production access. Without losing sleep.

Three runners and a seven-day audit are included in the free plan. Sign up and let your AI agents take care of your infrastructure.

Prefer a walkthrough first? Book a 30-minute demo.

No credit card required. Cancel anytime.