Agenten stärken
Der eigene Befehl des Herausgebers. Kein PlugMCP-Endpunkt.
Host a copy with our keys and logs.
docker run -i --rm ghcr.io/luisgf/infrabroker:3.1.3Claude Code hat keinen Installationslink für einen lokalen Befehl. Kopieren Sie den Befehl unten und führen Sie ihn in einem Terminal aus.
claude mcp add io.github.luisgf-infrabroker -- docker run -i --rm ghcr.io/luisgf/infrabroker:3.1.3In einem Terminal ausführen.
{ "mcpServers": { "io.github.luisgf-infrabroker": { "command": "docker", "args": [ "run", "-i", "--rm", "ghcr.io/luisgf/infrabroker:3.1.3" ] } }}claude_desktop_config.json
Remote-URL oder ein Befehl auf Ihrem Rechner? Worin sich die beiden Installationen unterscheiden
Auf PlugMCP ausführen
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
StartenInfrastructure access broker for AI agents — SSH & Kubernetes. The model
never touches a credential. (formerly ssh-broker)
The agent requests an action — run a command on a host, query or change a cluster. infrabroker checks it against policy, executes it with a credential minted for that single operation — an ephemeral, scope-limited SSH certificate from its own CA, or a short-lived bound ServiceAccount token — and returns only the output. Keys, certificates and tokens live in the broker's memory and are discarded after the call: nothing enters the model's context, so a prompt-injected agent has nothing to exfiltrate.
One binary — infrabroker — exposes the same engine (internal/broker) and tool
surface (internal/mcpserver) over three transports, chosen by subcommand. (The
legacy per-transport binaries broker / mcp-broker / mcp-broker-http remain as
thin deprecated wrappers over these subcommands, so existing configs keep
working.)
infrabroker serve-mcp.
Tools: ssh_execute, ssh_session_open / ssh_session_exec / ssh_session_close,
ssh_list_servers, ssh_put_file / ssh_get_file; with clusters configured,
also k8s_get / k8s_list / k8s_logs / k8s_apply / k8s_delete /
k8s_list_clusters. No transport auth — isolation comes from the process
being launched by the user (as the MCP spec recommends for stdio).infrabroker serve-mcp-http,
Streamable HTTP. Same tools, but each client authenticates with an OIDC
bearer token validated locally against the issuer's JWKS; the user identity
(and groups, for per-user RBAC) is propagated to the signer.infrabroker serve-http, POST /v1/ssh_run (one-shot), for
network agents authenticated with a client certificate.This README is a landing page. The detail lives in focused, single-source docs:
source-address (broker or
bastion IP), and — for one-shot — a force-command. Useless outside its
host/time/IP.allow_sudo / allowed_sudo_users live in the
signer; a compromised broker cannot escalate where policy forbids it.ca_keys), each key
optionally in Azure Key Vault or ssh-agent (YubiKey PIV / SoftHSM / TPM)
— the private key never leaves the HSM.serial across signer, broker, and sshd.The full threat model — including what the system deliberately does not defend — is in THREAT_MODEL.md.
AI model ──tool call──> broker ──mTLS──> [control-plane] ──mTLS──> signer
(no credential) (ephemeral key (approval + (CA key +
in RAM, never guardrails, policy + RBAC,
on disk) no CA key) signs the cert)
│
└── SSH with the ephemeral cert ──> bastion ──> target host
└─ stdout/stderr/exit_code ─> model
The broker sends an intent ({host, role, purpose, command?, sudo?, pty?, pubkey, …}); the signer derives every certificate constraint from policy and
returns the signed cert. The ephemeral private key is generated in the broker
and never leaves it. See ARCHITECTURE.md for the request flow,
the design decisions, and the per-hop ProxyJump certificate diagrams.
Several tools address SSH access control or AI-agent credential security, but none cover the full combination that infrabroker targets in a lightweight, self-hosted package.
Teleport is the closest commercial equivalent — short-lived SSH certs, RBAC, and since 2025 Secure MCP; its Jan-2026 Agentic Identity Framework targets the same threat model. The difference is operational weight: Teleport needs a dedicated control-plane cluster, recording proxy, and web UI — orders of magnitude heavier than a Go binary + signer.
HashiCorp Vault SSH secrets engine
is an SSH CA with full HSM/KMS support and (2025) its own MCP server, but it
provides only the signing piece — you still build the execution layer
(engine.go, session.go, the MCP tools) yourself.
StrongDM hides credentials but stores
long-lived secrets rather than generating ephemeral certs in memory, making it
weaker against exfiltration. Smallstep SSH CA is a
lightweight OIDC-integrated SSH CA (close to cmd/signer) with no execution
broker or MCP layer. ssh-mcp exposes
SSH to LLMs over MCP but uses a static SSH key — the exact vulnerability this
broker prevents. CyberArk PAM offers
comparable JIT cert access but is a closed enterprise platform for human
operators, not AI workloads.
Where it fits: MCP-native AI-agent access + in-memory ephemeral certs + separate signer + ASCIIcast recording + chained audit, as a small set of Go binaries without a cluster. Enterprise features (web UI, multi-region HA) are on the roadmap (see HANDOFF.md).
infrabroker_<ver>_{linux,darwin}_{amd64,arm64}.tar.gz with all binaries,
plus the installer tarball (infrabroker-v<ver>.tar.gz) that
deploy/install.sh consumes for the systemd production path.go install github.com/luisgf/infrabroker/cmd/infrabroker@latest
(pure Go, no CGO; same for the other cmd/ binaries).ghcr.io/luisgf/infrabroker (docker or podman, multi-arch;
entrypoint is the stdio MCP frontend). See CONTAINERS.md,
including a compose demo that runs the full stack against a toy host:
cd examples/compose && docker compose up --build -d (or make demo).Register with Claude Code in one line — native binary or container:
claude mcp add infrabroker -- ~/bin/infrabroker serve-mcp -config /secure/path/config.json
claude mcp add infrabroker -- docker run -i --rm -v /secure/path:/config \
ghcr.io/luisgf/infrabroker -config /config/config.json
Fastest path (local, single binary): QUICKSTART.md takes
you from git clone to your first ssh_execute in under 10 minutes with one
binary and one config.json — no signer service, no PKI. The steps below set up
the full remote stack (a separated signer); the containerised demo is under
Install.
# 1. Build (make injects the version from the git tag into every binary)
make install # → ~/bin/{infrabroker,signer,broker,broker-ctl,mcp-broker,...}
# or a single binary: make signer
# (plain `go build ./cmd/...` also works; it reports a dev-<commit> version)
# 2. Generate the local PKI + the two-service config (signer.json + config.json)
infrabroker init # writes pki/, signer.json, config.json; --force to redo
# add --import-ssh-config to import hosts from ~/.ssh/config (Include followed;
# ProxyJump/ProxyCommand hosts are skipped with a note), --register-mcp to run
# `claude mcp add` for you
# 3. Start the signing service (must be running before the broker)
./signer.sh start
# 4. Add a host and reload
broker-ctl host add --name web01 --addr web01.example.com:22 --user deploy --scan \
--groups prod-web --sudo
broker-ctl reload
# (--config is a global flag, before the subcommand; every binary takes --version)
broker-ctl --config /secure/path/signer.json host list
broker-ctl --version # short; add --verbose for build details
Register the stdio MCP with your client:
// Claude Code — ~/.claude.json
"infrabroker": { "type": "stdio", "command": "/Users/<you>/bin/infrabroker",
"args": ["serve-mcp", "-config", "/secure/path/config.json"] }
// OpenCode — ~/.config/opencode/opencode.json (note: type "local", command is an array)
"infrabroker": { "type": "local",
"command": ["/home/<you>/bin/infrabroker", "serve-mcp", "-config", "/secure/path/config.json"],
"enabled": true }
Full setup — local vs external signing mode, the remote OAuth frontend, host
fields, sudoers, PKI, and broker-ctl — is in OPERATIONS.md.
Tool usage for the model is in USAGE.md.
Full reference: API.md.
The security posture — trust boundaries, the layered controls (RBAC, command
policy, approval gate, guardrails, source-address/TTL pinning, chained audit,
default-on secret redaction), and the explicit non-goals (mode=exec
sessions are broker-preflighted but not host-enforced unless the host opts into
sealed_exec, no KRL, secret redaction is best-effort regex matching rather
than a guarantee, …) — is documented in
THREAT_MODEL.md.
To report a vulnerability, see SECURITY.md. CI enforces gofmt,
go vet, go test -race, and govulncheck on every push and PR.
make test # go test -race ./... (cert build, policy/RBAC/sudo/PTY, hops, …)
bash lab/run_signer_lab.sh # external signer: broker without ca_key + policy + denial
bash lab/run_mcp_lab.sh # bastion + target (ProxyJump) MCP scenario
bash lab/run_lab.sh # HTTP/mTLS frontend
Copyright (C) 2026 Luis González Fernández.
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License v3.0 as published by the Free Software Foundation. It is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY. See LICENSE for the full text.
SSH & Kubernetes access broker for AI agents; the model never touches a credential.
{ "mcpServers": { "io.github.luisgf-infrabroker": { "command": "docker", "args": [ "run", "-i", "--rm", "ghcr.io/luisgf/infrabroker:3.1.3" ] } }}Tools
Noch keine Tool-Liste. Remote-Server erhalten eine nach dem ersten Health-Check.
FAQ
Kopieren Sie auf dieser Seite die stdio-Konfiguration für Cursor, Claude Desktop, Claude Code oder VS Code. Sie nutzt die Installation des Herausgebers, keinen PlugMCP-Proxy.
In diesem Eintrag ist keine erforderliche Umgebungsvariable aufgeführt.
Infrabroker läuft lokal über stdio.
Zuletzt geprüft: 2026-11-09. SSH & Kubernetes access broker for AI agents; the model never touches a credential.