Compare

Why not just give the LLM SSH?

You can. Some people do. It works on the days it works. Here's what changes when it doesn't.

Both approaches run real commands

emisar isn't a sandbox. When the runner executes nomad job revert, it really rolls back the deploy — exactly like SSH would. The difference is what happens before exec, and what's left after.

Raw SSH · a full shell

# one key opens the whole box

$ nomad job revert api 17

↳ done — no who, no why, no record

$ cat /srv/api/.env

DB_PASSWORD=hunter2…

↳ now sitting in the chat scrollback

claude · emisar MCP

nomad.job_revert(job: api, version: 17)

reason: roll back the 502 spike

⏸ approval — nomad.job_* is gated

✓ approved · one use · recorded

↳ output redacted · hash-chained journal

Same revert.

Side-by-side

Concern	Raw SSH	emisar action pack
What can the LLM run?	Anything in the user's shell	Only declared actions; everything else rejected
What are the args?	Free-text command line	Typed, validated, redacted at the boundary
What actually ran?	Whatever was on PATH that day	Content-addressed pack — the runner recomputes the SHA-256, published hashes auto-pin, and changed contents are blocked until an admin reviews them
Approvals?	One chat approval can trust the SSH prefix — and every production command behind it.	Policy gates with approver email + audit; skipping means a policy change, itself audited
Audit trail?	Whatever lands in .bash_history	Hash-chained JSONL on host, plus a searchable cloud audit trail
Output redaction?	None — passwords leak into chat logs	20 patterns (bearer/JWT, AWS/GitHub/Slack keys, secret assignments + your custom ones) masked on the host before egress
Lateral movement?	SSH key on the model's box ≈ key everywhere	Per-runner token + per-user runner scopes every API key inherits — revoke the user, every key they minted shrinks
Credential leaked?	Rotate the SSH key on every host that trusts it	Revoke one scoped API key; host credentials never reached the model. MCP bridge keys are short-lived and rotated automatically
Recovery story?	“Read the chat scrollback and the logs and hope”	emisar audit verify checks the retained host journal; the portal keeps inputs and output in run history, with approvals and state changes in the audit trail

What can the LLM run?

Raw SSH

Anything in the user's shell

emisar

Only declared actions; everything else rejected

What are the args?

Raw SSH

Free-text command line

emisar

Typed, validated, redacted at the boundary

What actually ran?

Raw SSH

Whatever was on PATH that day

emisar

Content-addressed pack — the runner recomputes the SHA-256, published hashes auto-pin, and changed contents are blocked until an admin reviews them

Approvals?

Raw SSH

One chat approval can trust the SSH prefix — and every production command behind it.

emisar

Policy gates with approver email + audit; skipping means a policy change, itself audited

Audit trail?

Raw SSH

Whatever lands in .bash_history

emisar

Hash-chained JSONL on host, plus a searchable cloud audit trail

Output redaction?

Raw SSH

None — passwords leak into chat logs

emisar

20 patterns (bearer/JWT, AWS/GitHub/Slack keys, secret assignments + your custom ones) masked on the host before egress

Lateral movement?

Raw SSH

SSH key on the model's box ≈ key everywhere

emisar

Per-runner token + per-user runner scopes every API key inherits — revoke the user, every key they minted shrinks

Credential leaked?

Raw SSH

Rotate the SSH key on every host that trusts it

emisar

Revoke one scoped API key; host credentials never reached the model. MCP bridge keys are short-lived and rotated automatically

Recovery story?

Raw SSH

“Read the chat scrollback and the logs and hope”

emisar

emisar audit verify checks the retained host journal; the portal keeps inputs and output in run history, with approvals and state changes in the audit trail

When raw SSH is the right answer

Single-operator side projects, throwaway environments, dev clusters you can wipe. The cost of declaring an action pack only pays back when there's another human who needs to audit, override, or recover from the AI's decisions.

When it isn't

Production. Anything regulated. Anything where post-incident your VP of Engineering will ask "what did the model do, exactly, and on whose authority?". That's the question raw SSH can't answer without a forensic budget. emisar makes the answer a query.

Try it: install the runner from the quickstart, declare one action you'd otherwise SSH for, and point your model at it. The free tier covers 3 runners.

How the trust boundary works See it on a real incident Guide: safe production access for AI agents Guide: prompt injection for ops teams

Stop handing AI agents raw SSH.

The same real commands — declared, policy-gated, approval-checked, and journaled. Recovery you're not betting your weekend on.

Start free Talk to sales

Three runners. Seven-day audit. No credit card.