Emisar

Emisar is a governed gateway that gives AI agents access to production infrastructure without SSH keys, VPNs or standing shell access. One MCP server connects tools such as Claude, Cursor and ChatGPT to a finite catalog of declared actions, and policy decides whether each request runs, waits for approval or is refused. The work itself is done by a small program called a runner, installed on the host, which opens an outbound TLS connection and exposes no inbound listener. It is built for platform and operations teams who want an agent to read live logs, metrics, configs and process state, triage an incident across a fleet and propose a fix, without handing it a blank shell. Actions are grouped into versioned packs that are fingerprinted by content: a pack whose hash matches the published catalog is trusted automatically, while an edited or locally written pack waits for an admin to review it. Every call lands in a searchable audit log with a tamper evident copy on the host, and runner output is redacted before it leaves the machine using built in patterns plus per action rules. Pricing is per runner rather than per seat. Free is $0 and covers 3 runners, one user, seven day audit retention and all policy features. Team is $20 per runner per month or $200 per runner per year, covering up to 100 runners with unlimited users, single sign on through OIDC, 90 day audit retention, audit export to CSV and SIEM, email support and a 99.95% uptime target. Enterprise is custom and adds unlimited runners, SCIM directory sync, 365 day audit retention and a 99.99% uptime SLA. Billing runs through Paddle as merchant of record. The runner, MCP bridge and packs are open source under Apache 2.0, but the vendor states the current product depends on its hosted control plane rather than offering a full self hosted deployment.