Infrabroker MCP Server

SSH & Kubernetes access broker for AI agents; the model never touches a credential.

What you get

The agent requests an action — run a command on a host, query or change a cluster. infrabroker checks it against policy, executes it with a credential minted for that single operation — an ephemeral, scope-limited SSH certificate from its own CA, or a short-lived bound ServiceAccount token — and returns only the output. Keys, certificates and tokens live in the broker's memory and are discarded after the call: nothing enters the model's context, so a prompt-injected agent has nothing to exfiltrate.

• Anti-exfiltration (prompt injection): — the ephemeral key/cert/token live
• Kubernetes without kubeconfigs: — the signer mints a short-lived **bound
• Anti-reuse: — each cert carries a TTL of minutes, source-address (broker or
• Controlled escalation: — allow_sudo / allowed_sudo_users live in the
• CA compromise bounded: — one CA per host group (ca_keys), each key
• Audit / non-repudiation: — append-only, Ed25519-chained log correlated by

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.