# emisar

> emisar lets MCP-capable agents keep working on infrastructure through a finite catalog of declared actions instead of a shell. Policy decides what runs, what waits for a person, and what is denied; an outbound-only runner validates each action again on the host.

emisar provides the governed action surface an agent calls. It does not run the agent loop, provide process isolation, or make a permitted destructive action harmless. Action packs, policy, runner configuration, and host permissions are all part of the security boundary.

Remote MCP clients connect through OAuth at `https://emisar.dev/api/mcp/rpc`. Local clients can use the `emisar-mcp` stdio bridge described below.

## Start here

- [Quickstart](https://emisar.dev/docs/quickstart): Connect one Linux host, run the first declared action, and verify the audit record.
- [Connect a CLI agent](https://emisar.dev/docs/connect-cli-agent): Connect local stdio MCP clients through the emisar-mcp bridge.
- [Connect Claude.ai](https://emisar.dev/docs/connect-claude-ai): Add emisar to Claude.ai as a custom connector over OAuth.
- [MCP reference](https://emisar.dev/docs/mcp-reference): Review the fixed tools, parameters, continuations, errors, and signed-dispatch fields.

## Build and operate

- [Action pack catalog](https://emisar.dev/packs): Browse the published packs and the declared actions they provide.
- [Action pack format](https://emisar.dev/docs/action-packs): Define executables, typed arguments, risk, limits, redaction, and side effects.
- [Policies and approvals](https://emisar.dev/docs/policies-and-approvals): Decide which actions run, wait for a person, or are denied.
- [Runbooks](https://emisar.dev/docs/runbooks): Create, validate, approve, and review staged procedures built from declared actions.
- [Manage the runner fleet](https://emisar.dev/docs/runner-fleet): Enroll, group, update, troubleshoot, and remove runners.
- [Go to production](https://emisar.dev/docs/production): Shape the fleet, tighten policy, and walk the go-live checklist.
- [Audit and SIEM](https://emisar.dev/docs/audit-and-siem): Review control-plane events, export NDJSON, and verify the runner journal.

## Security

- [Security model](https://emisar.dev/docs/security-model): Review the guarantees, trust boundaries, threats, and limitations.
- [Signed dispatch](https://emisar.dev/docs/signed-dispatch): Require bridge-signed action intent with scoped certificates whose leaf keys are Ed25519 or ECDSA P-256.
- [Trust Center](https://emisar.dev/trust): Review infrastructure, delivery, assurance, privacy, and compliance controls.

## Optional

- [How emisar works](https://emisar.dev/how-it-works): Follow an action from MCP intent through policy, host execution, and audit receipt.
- [Guides](https://emisar.dev/guides): Read incident investigations and practical infrastructure guidance.
- [Changelog](https://emisar.dev/changelog): Review shipped product changes.
- [Pricing](https://emisar.dev/pricing): Compare hosted plans and included limits.