infrabroker — Claude Code MCP server: SSH and Kubernetes access
An access broker for infrastructure. The agent asks for an action, the broker runs it with a throwaway credential and hands back only the output.
claude mcp add infrabroker -- docker run -i --rm ghcr.io/luisgf/infrabroker:3.1.3What infrabroker does
The model never holds a key. It sends an intent — a host and a command, or a cluster operation — and infrabroker checks that intent against policy before doing anything. Execution uses a certificate minted for that one call by the broker's own CA, or a bound ServiceAccount token with a short lifetime. Both are dropped once the call returns, so a prompt-injected agent finds nothing worth stealing in its context.
A single infrabroker binary carries the same engine and tool surface across three transports, picked by subcommand. infrabroker serve-mcp runs over stdio for local use and relies on the user launching the process rather than transport auth. infrabroker serve-mcp-http speaks Streamable HTTP and validates an OIDC bearer token against the issuer's JWKS, passing user identity and groups down to the signer for per-user RBAC. infrabroker serve-http exposes POST /v1/ssh_run for agents that authenticate with a client certificate. Available tools include ssh_execute, the ssh_session_open / ssh_session_exec / ssh_session_close trio, ssh_list_servers, ssh_put_file and ssh_get_file; with clusters configured you also get k8s_get, k8s_list, k8s_logs, k8s_apply, k8s_delete and k8s_list_clusters.
Escalation is decided on the signing side, through allow_sudo and allowed_sudo_users. A broker that gets compromised still cannot raise privileges where policy says no.
What it helps with
- run a command on a remote host without exposing a private key to the agent
- pull pod logs from a cluster with no kubeconfig
- block risky commands through allow/deny policy
- permit sudo only where policy allows it
- trace who ran what through the audit chain
Example prompts for the agent
- Run
uptimeon web-01 through infrabroker - Show me the logs for pod
api-7d9fin the prod cluster - Copy
deploy.shto build-02
How to install infrabroker
Platform CLI
claude mcp add infrabroker -- docker run -i --rm ghcr.io/luisgf/infrabroker:3.1.3Platform CLI
codex mcp add infrabroker -- docker run -i --rm ghcr.io/luisgf/infrabroker:3.1.3Config file
{
"mcpServers": {
"infrabroker": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/luisgf/infrabroker:3.1.3"
]
}
}
}Config file
{
"servers": {
"infrabroker": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/luisgf/infrabroker:3.1.3"
]
}
}
}Platform CLI
gemini mcp add infrabroker docker run -i --rm ghcr.io/luisgf/infrabroker:3.1.3Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about infrabroker
How do I install infrabroker in Claude Code?
Run claude mcp add infrabroker -- docker run -i --rm ghcr.io/luisgf/infrabroker:3.1.3. That registers the MCP server, which starts inside a container.
What does infrabroker do?
It sits between the agent and your infrastructure. The agent requests an action, the broker validates it against policy, executes it with a single-use certificate or token, and returns just the command output.
Do credentials ever reach the model's context?
No. Certificates and tokens are minted for one operation, kept in the broker's memory, and discarded after the call.
