Infrabroker MCP Server

Infrabroker MCP server exists for a simple reason — assistants are far more useful when they can act on Infrabroker directly instead of describing what you should do. SSH & Kubernetes access broker for AI agents; the model never touches a credential.

What you get

The agent requests an action — run a command on a host, query or change a cluster. infrabroker checks it against policy, executes it with a credential minted for that single operation — an ephemeral, scope-limited SSH certificate from its own CA, or a short-lived bound ServiceAccount token — and returns only the output. Keys, certificates and tokens live in the broker's memory and are discarded after the call: nothing enters the model's context, so a prompt-injected agent has nothing to exfiltrate.

• Anti-exfiltration (prompt injection): — the ephemeral key/cert/token live
• Kubernetes without kubeconfigs: — the signer mints a short-lived **bound
• Anti-reuse: — each cert carries a TTL of minutes, source-address (broker or
• Controlled escalation: — allow_sudo / allowed_sudo_users live in the
• CA compromise bounded: — one CA per host group (ca_keys), each key
• Audit / non-repudiation: — append-only, Ed25519-chained log correlated by

What the assistant can call

Once Infrabroker is connected, these are the calls the assistant has available:

• Service — Endpoint
• Signer — POST /v1/sign

Setting it up

Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.

Choosing this one

Plenty of cloud and infrastructure servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Infrabroker's toolset — Service, Signer — is a fair guide to whether it matches your workflow. It is maintained by luisgf; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.

Before you rely on it

• Your data travels to the provider's service, so the usual questions apply about what you send and what they retain.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the infrabroker mcp server does with a few real requests.