Security & compliance
Built so your security team says yes.
emisar exists because giving an LLM raw shell access is reckless. Every layer here is designed so the LLM is the least-privileged participant in the system — and every action is auditable.
Trust boundary
Who can do what, by design.
The LLM is never trusted with privileged execution.
Claude, Cursor, or ChatGPT asks for one catalog action over MCP — with a required reason. Undeclared commands don't exist to it. The one pack that runs an arbitrary script is staging break-glass: critical risk, denied by default until you opt in.
Evaluates policy, checks scope and pack trust, routes, and writes the audit. A risky action waits for a human — and it never executes a shell itself.
Outbound WSS only — the host dials out, nothing listens. A non-root service user re-validates every argument against the schema, re-verifies the pack hash, drops to least privilege, runs argv arrays, and redacts before egress.
Portal audit records the decision and execution metadata. Run history retains bounded redacted output; the separate host journal keeps bounded previews and complete-stream digests in a SHA-256 chain.
The dashed line is optional and per runner: with signed dispatch, the runner trusts the bridge's signature on the MCP call, not the control plane above it — a compromised cloud can relay it, never forge it.
The approval loop
Watch one risky action cross the gate.
Claude proposes a config reload on a production edge host.
Here is everything that happens next.
Step 1 · Held
Policy holds the agent's request for a human — the exact command, the reason, and the risk on one screen.
Step 2 · Decide
Jordan reviews and writes the note the record will keep.
Step 3 · Approved
Approved — decider, time, and reason on the record.
Step 4 · Executed
Only now does the runner execute: exit 0, output scrubbed on the runner before it left the host.
Step 5 · Recorded
Seconds later, the run is in the audit log.
Step 6 · Evidence
The evidence one click deep — actor, target, request id, payload — exportable to your SIEM.
Demo uses real screenshots of the product.
Data handling
Boring, defensible defaults.
TLS-only transport
Runners connect to the control plane over WSS using TLS 1.2+. An enrollment key — single-use by default — is exchanged for a per-runner token that can be revoked from the console.
No inbound connections to runners
Runners are outbound-only. No ports to expose, no firewall holes, no NAT traversal. Your hosts initiate every connection.
Hash-chained audit journal
Every action is recorded to an append-only JSONL audit on the host, with each line carrying the SHA-256 of the previous entry. Verification covers the retained journal or retained suffix; it cannot prove that a privileged host operator did not replace or truncate the entire local journal.
Hash-pinned packs
Action packs are content-addressed. A hash the published catalog carries is trusted on sight; a custom or changed one blocks dispatch until an admin reviews the contents. Before execution, the runner recomputes the control-plane-pinned hash and rejects a mismatch.
Pattern redaction before egress
20 built-in patterns — common provider tokens (GitHub, Slack, Stripe, OpenAI, …), JWTs, bearer and basic auth, private-key blocks, and secret assignments — plus your own per-action rules scrub stdout and stderr on the runner before anything is forwarded. The control plane receives only the redacted stream. A novel secret shape can still pass a pattern-based filter, so this is defense in depth rather than a guarantee that every secret is recognized.
SIEM export
The cloud audit is the searchable system of record. Your SIEM can poll it continuously through a dedicated read-only credential.
Organizational controls
The knobs your IAM team expects.
RBAC
Roles for owner, admin, billing manager, operator, and viewer, plus per-user runner, runner-group, and pack scopes.
Governed LLM access
MCP bridge keys are short-lived and rotate themselves. Runner credentials rotate automatically and can be revoked independently.
MFA
TOTP MFA is available on every plan, with one-time recovery codes and replay protection. Enforce it org-wide with one switch.
SSO & SCIM
OIDC sign-in with Okta, Entra ID, JumpCloud, Google Workspace, or Keycloak, plus SCIM directory sync. Offboard someone in your IdP and their emisar sessions and keys are revoked automatically.
Independent standard
Built for “assume breach.”
Anthropic — the lab behind Claude — published Zero Trust for AI Agents, a framework for giving autonomous agents access to real systems: least agency, deny-by-default tools, human approval for high-risk actions, and a tamper-evident audit trail. emisar enforces that control set — and assumes the agent may already be compromised, so a jailbroken or prompt-injected model still can't exceed the declared, gated, audited catalog.
Not affiliated with or endorsed by Anthropic. We cite the framework as an independent security reference.
Local admission control
Beyond the cloud policy, an operator can set an allow/deny list on the runner itself. Denied actions are hidden from the catalog and refused at execution — fail-closed, even against a compromised control plane. The host always has the last word.
Signed dispatch — the cloud can't act for you
A runner can be set to refuse the control plane's authority entirely. A customer-authorized bridge signs each request with a key the control plane never holds. A fully compromised emisar control plane can relay that signed request — it can never forge, alter, replay, or originate one. The signature, not the cloud, is the authority. Opt-in per runner.
Responsible disclosure
Found a security issue? We want to hear about it. Email security@emisar.dev with a description and reproduction steps. We acknowledge reports within 72 hours and credit reporters in our security advisories.
Full policy in SECURITY.md.
Ready to evaluate emisar for your team?
Start free on the Free plan, or book a walkthrough and bring your security team's questions.
Three runners. Seven-day audit. No credit card.