Self-host emisar
v0.53.0AI agent gateway for infrastructure actions with policy
- Stars
- 330
ghcr.io/andrewdryga/emisar-runner
What is emisar?
emisar connects AI agents like Claude, Cursor, and ChatGPT to your infrastructure through a governed MCP server. Instead of SSH keys or raw shell access, agents discover and call versioned action packs — declared, schema-bounded operations for databases, containers, observability, cloud, and Linux systems. The control plane evaluates policy (allow, require approval, deny) per risk tier and action, with overrides for specific runners or groups. Every action runs on an outbound-only runner that re-validates arguments, verifies pack content hashes, redacts secrets from output, and writes a hash-chained local journal. The runner installs on Linux (systemd), macOS (launchd), Docker, Kubernetes (DaemonSet), or Nomad. The runner and MCP bridge are Apache-2.0 open source; the control plane is source-available under BSL-1.1 and currently offered as a hosted service. Free tier includes 3 runners and 7-day audit retention.
Should you self-host emisar?
emisar scores 47/100 on selfhost.directory (how scoring works) and ranks #64 of 125 in AI. It has 330 GitHub stars.
It shipped 10 stable releases in the past year. The latest, v0.53.0, came out on 11 October 2026.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is Other-licensed and written mostly in Elixir.
Its closest alternative on selfhost.directory is ComfyUI (93/100, 143 714 stars). It scores higher overall, so compare the two before you pick. See emisar vs ComfyUI side by side.
Features
- 103 action packs, 1840 actions
- Air-gapped deploymentNot generally available
- Audit trail with host journal
- Local admission control
- MCP Server
- Outbound-only runner
- Output redaction
- Pack trust & drift blocking
- Per-runner scopes & credentials
- Policy & approval gates
- Runbooks
- SCIM directory syncEnterprise only
- SIEM exportPaid plans only
- Signed dispatch (optional)Optional feature
- Versioned action catalog
emisar README
FAQ
Do you support SSO and SCIM?
Yes. OIDC single sign-on (Okta, Entra ID, JumpCloud, Google Workspace, Keycloak, or any compliant provider) is on Team and Enterprise. SCIM 2.0 directory sync is on Enterprise.
What counts as a runner?
One installation of the emisar binary on one host (VM, container, or bare metal). Human users are unlimited on Team and Enterprise.
What about secrets?
Runner output is redacted before leaving the host using 20 built-in patterns plus custom per-action rules. The audit trail stores metadata only.
Can I self-host the control plane?
The current product uses the hosted emisar control plane. The repository includes deployable control-plane code for evaluation, but supported self-hosted and air-gapped deployments are not generally available today.
Is this MCP-compatible?
Yes. Claude.ai and ChatGPT connect via OAuth to the remote JSON-RPC MCP server. 15+ local clients (Claude Code, Cursor, VS Code, etc.) work via the emisar-mcp stdio bridge.
What if my runner dies mid-run?
On Linux, the runner stops the action if it exits. If the runner stays offline, emisar marks in-flight runs as errored within minutes.
Do I have to approve every action?
No. Policy decides by risk tier, action, runner, or runner group. Routine reads can run automatically; risky changes require approval; destructive actions can be denied.
Where do approvals happen?
In the web UI and email inbox. The approver sees actor, arguments, target host, and the policy rule that triggered the gate.
What can it actually do?
Read and tail logs, query metrics, inspect processes, memory, disk, and containers, check databases, trace DNS/TLS/connectivity. Behind approval: restart units, stop jobs, fail over, scale.
Can the LLM run anything it wants?
No. The runner accepts only actions declared in a trusted pack and allowed by its local admission rules. Undeclared commands are rejected before execution.
More in Infrastructure
EneruSelf-hosted UPS monitor that manages orderly shutdown of virtual machines, containers, and remote servers when power fails, with a web dashboard, terminal UI, and API.
ganetiGaneti is a self-hosted, open-source VM cluster manager for Xen/KVM with high availability, live migration, and automated allocation across 3-100 nodes.
home-enterprise-labopsHELO is a self-hosted, open-source Kubernetes infrastructure for learning GitOps, service meshes, and production patterns in your homelab.
IncusSelf-hosted, open-source system container and VM manager with unified REST API for local and remote management, scaling from single machine to clusters.
Jitsi Video BridgeJitsi Videobridge is an open-source, self-hosted WebRTC SFU that routes video for scalable multiparty conferencing.
LXCSelf-hosted, open-source low-level Linux container runtime for privileged and unprivileged system containers, driven by dotted lxc.* config keys and a stable C API.
my-self-hosting-servicesSelf-hosted Docker homelab with Authentik SSO, Traefik automated SSL, Cloudflare DNS automation, and Portainer. Includes n8n, OpenClaw AI, and microservices.
nanoclNanocl is a self-hosted, open-source orchestrator for containers and VMs using declarative Statefiles to manage workloads on your infrastructure.
nsdNSD is an open-source, self-hosted authoritative DNS name server optimized for speed and reliability, used by root servers and TLD registries worldwide.
os-modaA self-hosted NixOS operating system where an AI agent manages your server through structured tools, with tamper-proof audit logs and instant rollback.
Proxmox Kubernetes EngineSelf-hosted tool to deploy HA Kubernetes clusters on Proxmox VE using Cluster API with native storage, load balancing, and CNI.
PulumiOpen-source infrastructure-as-code CLI and engine for AWS, Azure, GCP and Kubernetes in TypeScript, Python or Go, with self-hosted state in S3 or PostgreSQL.
0 comments