emisar documentation

The full runner install: every flag, the service it creates, the config file, and the user it runs as.

Run the runner in a container — what it can see, the two shared mechanics, and a sidecar.

One runner per node as a DaemonSet, with the pod spec as your blast-radius dial.

A Nomad system job placing one runner on every client node, with a worked HCL spec.

Enroll ephemeral runners from one reusable key as autoscaling groups — GCP MIG, AWS ASG, Azure VMSS — boot and terminate hosts.

What a runner host must reach on the way out — and why nothing has to reach in.

Groups and labels, enrollment keys, pack credentials, updates, and removal.

Go from one runner to a governed fleet, with a phased rollout and a checklist.

Canary a runner release, verify each batch, and keep the last known-good version ready.

Rotate enrollment keys, understand per-runner tokens, and swap the provider credentials packs read.

Wire Claude Code, Cursor, Claude Desktop, and the CLIs in with the emisar-mcp bridge or a raw API key.

Add emisar to Claude.ai as a custom connector — no key to manage.

Add emisar to ChatGPT through Developer mode — no key to manage.

Choose a local sandbox, connect your coding agent to emisar, and understand what remains accessible.

One MCP server entry per account, the CLI's stored accounts, and one cloud connector per account.

The agents connected to your account, what each row shows, and how to mint, rotate, and revoke the key behind one.

Re-run the installer per workstation, prove the client relaunched the bridge, and pin a rollback.

Choose, inspect, install, configure, and verify a published action pack.

Install the new pack version on a canary, trust the hash, and keep the prior version ready.

Write, validate, install, and trust a pack you maintain.

Run a private registry on GCS, S3, or any static host with packctl.

Action YAML reference: declared args, validation, limits, and redaction.

Select a runner and action, enter its arguments, dispatch it, and read the result.

The run list and filters, every lifecycle status, live output and byte caps, cancellation, and how one dispatch's runs group.

Create, publish, approve, and review a staged procedure built from declared actions.

Start from the symptom: the first check, the page that owns it, and what to send if you need us.

Contain leaked emisar authority, preserve evidence, restore a known-good path, and verify the old authority no longer works.

Compare credential authority, overlap, and revocation consequences before you rotate or contain one.

Risk-tier defaults, per-action overrides, approvals, and standing grants.

A customer-authorized bridge signs each request with a key the control plane never holds.

What gets recorded, the console, NDJSON export, and the runner journal.

Choose sign-in, enforcement, provisioning, and offboarding for your team.

Roles, invitations, per-member runner scopes, MFA, sessions, and API keys.

OIDC sign-in, provider operations, the generic contract, and troubleshooting.

SCIM 2.0 provisioning, lifecycle, protocol support, and group-driven authorization.

Okta end to end: the OIDC web app, the separate SCIM app, and group-driven roles.

Entra end to end: the app registration with oid, and the provisioning enterprise app.

JumpCloud end to end: one custom application for OIDC sign-in and directory push.

Keycloak sign-in with PKCE, and what its missing outbound SCIM leaves you to do.

Google Workspace sign-in with the locked issuer, and its directory-sync gap.

Plan limits, feature entitlements, upgrades and downgrades, invoices, and payment failures.

Use live MCP tools from the shell, and inspect the server methods, schemas, recovery rules, and errors.

The on-host emisar binary's operator verbs — connect, packs, events, audit, and signing — with their key flags.

Which component owns each decision, what crosses each boundary, and what happens when one drops out.

The v1 compatibility promise, frozen public contracts, and deprecation window.

Trust boundary, searchable audit, hash-chained journal, redaction on egress.

The output, MCP, audit-export, and retention caps emisar enforces — and what happens at each.

The supported product is the hosted emisar control plane today; plans and audit retention are on the pricing page.