Context
AI coding agents were already useful for diagnosis, and the obvious next step was letting them look at real infrastructure during an incident. The obvious implementation — hand the agent SSH — was rejected.
The problem
execute(command) over SSH solves the capability problem and creates several
worse ones. There is no audit trail beyond shell history. There is no input
validation, so a malformed argument becomes a shell injection. Output is free
text, so the agent parses prose and occasionally parses it wrong. The blast radius
is every host the key reaches. And every credential in the session is visible to
the model.
The framing that resolved it: the agent should reason about infrastructure, and exactly one component should touch it.
What we built
A self-hosted Model Context Protocol server exposing high-level operations —
disk_usage(), docker_ps(), docker_logs(), grafana_alerts() — instead of
arbitrary command execution.
- Inventory-driven targeting. The agent names a host or tag; it cannot reach anything absent from inventory.
- Validated parameters, no shell interpolation. Arguments are typed and checked before anything executes.
- Structured JSON responses, so the agent reasons over data rather than scraping text.
- Read-only by default. Mutations require
confirm: true, making destructive actions deliberate rather than an accident of phrasing. - Credentials isolated in the adapter layer, never crossing into the protocol surface.
- A structured log per call recording tool, user, target, duration and result.
Challenges
The design tension was granularity. Too coarse and the agent cannot investigate anything the tool author did not anticipate; too fine and you have reinvented a shell with extra steps. Settling on operations that map to what an engineer would actually do during an incident — check CPU, list containers, read logs, check alerts — kept the surface both useful and bounded.
The second was being honest about coverage. The roadmap distinguishes what is implemented from what is planned, because an agent that believes a tool exists behaves worse than one that knows it does not.
Outcome
Agents can now work through an incident using structured calls, each one logged, validated and scoped. A representative diagnosis reaches a verifiable root cause in four calls — and every one of them is independently auditable afterwards.
This one is open source under MIT: see Infrastructure MCP.
Lessons learned
Capability and safety are a design problem, not a policy problem. Writing "the agent should be careful" in a prompt is not a control.
Structure the output, not just the input. Most agent misbehaviour we saw came from misreading free-text output rather than from choosing the wrong action.
Default to read-only. The confirmation flag costs one token and removes an entire category of incident.