# emisar

> emisar gives MCP agents a catalog of infrastructure actions. You choose which requests can run, which need approval, and which are denied. The runner checks each action again before executing it on your host.

Your AI client runs the agent and calls emisar's tools. Emisar does not isolate the agent's other tools, and an allowed action can still cause damage. Review the installed packs, policy, runner settings, and host permissions together.

Remote MCP clients connect through OAuth at `https://emisar.dev/api/mcp/rpc`. Local clients can use the `emisar-mcp` stdio bridge; see Connect a CLI agent below.

## Start here

- [Quickstart](https://emisar.dev/docs/quickstart): Connect a Linux host, run linux.uptime, review the result, and repeat the check through your agent.
- [Investigate a service](https://emisar.dev/docs/investigate-a-service): Inspect a test service, request one restart, review the approval, and verify recovery.
- [Connect a CLI agent](https://emisar.dev/docs/connect-cli-agent): Connect local stdio MCP clients through the emisar-mcp bridge.
- [Connect Claude.ai](https://emisar.dev/docs/connect-claude-ai): Add emisar to Claude.ai as a custom connector over OAuth.
- [MCP reference](https://emisar.dev/docs/mcp-reference): Review the fixed tools, parameters, continuations, errors, and signed-dispatch fields.

## Build and operate

- [Action pack catalog](https://emisar.dev/packs): Browse the published packs and the declared actions they provide.
- [Action pack format](https://emisar.dev/docs/action-packs): Define executables, typed arguments, risk, limits, redaction, and side effects.
- [Policies and approvals](https://emisar.dev/docs/policies-and-approvals): Decide which actions run, wait for a person, or are denied.
- [Runbooks](https://emisar.dev/docs/runbooks): Create, validate, approve, and review staged procedures built from declared actions.
- [Manage the runner fleet](https://emisar.dev/docs/runner-fleet): Enroll, group, update, troubleshoot, and remove runners.
- [Go to production](https://emisar.dev/docs/production): Shape the fleet, tighten policy, and walk the go-live checklist.
- [Audit and SIEM](https://emisar.dev/docs/audit-and-siem): Review control-plane events, export NDJSON, and verify the runner journal.

## Security

- [Security model](https://emisar.dev/docs/security-model): Review the guarantees, trust boundaries, threats, and limitations.
- [Signed dispatch](https://emisar.dev/docs/signed-dispatch): Require bridge-signed action intent with scoped certificates whose leaf keys are Ed25519 or ECDSA P-256.
- [Trust Center](https://emisar.dev/trust): Review infrastructure, delivery, assurance, privacy, and compliance controls.

## Optional

- [How emisar works](https://emisar.dev/how-it-works): Follow an action from your agent through policy to host execution, then review the result.
- [Technical guide](https://emisar.dev/guides/how-emisar-works): Read how pack trust, policy, runner checks, audit records, and signed dispatch work.
- [Guides](https://emisar.dev/guides): Read practical guidance on production access and prompt injection.
- [Changelog](https://emisar.dev/changelog): Review shipped product changes.
- [Pricing](https://emisar.dev/pricing): Compare hosted plans and included limits.