# emisar

Lets coding agents run pre-declared infrastructure actions on Linux without raw SSH access. Keeps risk bounded with approval checks and audit trails.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 330
- Author: AndrewDryga
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/AndrewDryga/emisar
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/emisar

## What it does

emisar replaces open terminal access with a fixed catalog of declared action packs. The AI client picks a pre-built task with schema-validated arguments instead of assembling shell commands. Before execution, the control plane checks policy rules, scope, and holds risky calls until an operator approves them.

Execution on the host relies on an outbound-only daemon using a TLS WebSocket, keeping inbound network ports closed. This runner verifies the cryptographic hash of each action pack on disk, strips sensitive tokens from stdout, and records every run in a local hash-chained JSONL log.

Setup fails immediately on systems without Linux `systemd` and `sudo`. Because the runner does not isolate operating system processes on its own, operators still need strict OS permissions or an external container sandbox like `coop`.

## Requirements
- Remote server: `https://emisar.dev/api/mcp/rpc`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http emisar https://emisar.dev/api/mcp/rpc
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add emisar --url https://emisar.dev/api/mcp/rpc
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "emisar": {
            "url": "https://emisar.dev/api/mcp/rpc"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "emisar": {
            "type": "http",
            "url": "https://emisar.dev/api/mcp/rpc"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http emisar https://emisar.dev/api/mcp/rpc
```

## When to use it
- Execute maintenance tasks on Linux hosts without handing over shell access
- Require human sign-off before running disruptive system operations
- Filter sensitive terminal output before it reaches the model
- Track host modifications in a tamper-resistant local log

## Example prompts
- Check system uptime and runner health on the staging server via emisar
- Run the linux.uptime declared action and provide a reason for the audit trail
- Trigger a maintenance pack task on the connected host

## Similar
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33918
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81115
- [Oh My Posh Validator](https://affpapa.org/en/nevibecode/mcp/oh-my-posh-validator.md) — MCP server · ★ 23643
- [Keploy](https://affpapa.org/en/nevibecode/mcp/keploy.md) — MCP server · ★ 18727
- [Coder](https://affpapa.org/en/nevibecode/mcp/coder.md) — MCP server · ★ 17160
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md