The problem
Giving an AI agent execute(command) over SSH solves the capability problem and
creates a much worse one. There is no audit trail, no input validation, no way to
bound what a mistaken tool call can reach, and the agent sees every credential
the session holds.
The useful framing: the agent should reason about infrastructure, and exactly one component should touch it.
The approach
Infrastructure MCP exposes high-level, auditable tools — disk_usage(),
docker_restart(), grafana_alerts() — rather than arbitrary command execution.
Every call is inventory-driven, structured and logged.
| | Raw SSH access | Infrastructure MCP |
| ---------------- | -------------------- | ------------------------------------------------------------------------ |
| Audit trail | none | structured log per call (tool, user, target, duration, result) |
| Input validation | none | every parameter validated, no shell interpolation |
| Output | free text | JSON, every response |
| Targeting | agent picks the host | resolved by name or tag from inventory only |
| Blast radius | unbounded | read-only by default; mutations require confirm: true |
| Credentials | visible to the agent | never leave the adapter layer |
What it manages
Linux, Docker, Kubernetes, Proxmox, Grafana and Cisco devices today, through an adapter layer that keeps credentials isolated from the protocol surface.
What it looks like in use
An agent investigating a slow server works through structured calls rather than guessing at shell commands:
cpu_usage(server: "archive") → 92% used, status: "warning"
docker_ps(server: "archive") → prometheus: "Restarting (1) 4s ago"
docker_logs(server: "archive", container: "prometheus") → "panic: too many open files"
grafana_alerts(instance: "main") → firing: HighDiskUsage on archive:/
Four calls, each one logged, validated and scoped to an inventory target — and a root cause the operator can verify independently.
Design decisions worth noting
- Read-only by default. Mutating operations require an explicit
confirm: true, which makes destructive actions a deliberate act rather than an accident of phrasing. - Inventory as the only addressing mechanism. The agent names a target; it cannot reach a host that isn't in the inventory.
- Client-agnostic. MCP is an open protocol, so it works with Claude Code, Cursor, Codex, Gemini CLI and any other spec-compliant client.
Case study
See this in production: Giving AI agents infrastructure access without giving them a shell.
Availability
Open source under the MIT licence. The repository is linked above; it is early and actively developed, and the roadmap in the README is honest about what is shipped versus planned.