infrabroker

Infrastructure access broker for AI agents — SSH & Kubernetes. The model never touches a credential. (formerly ssh-broker)

The agent requests an action — run a command on a host, query or change a cluster. infrabroker checks it against policy, executes it with a credential minted for that single operation — an ephemeral, scope-limited SSH certificate from its own CA, or a short-lived bound ServiceAccount token — and returns only the output. Keys, certificates and tokens live in the broker's memory and are discarded after the call: nothing enters the model's context, so a prompt-injected agent has nothing to exfiltrate.

Three frontends share the same engine (internal/broker) and tool surface (internal/mcpserver):

• MCP stdio (local, recommended for personal use) — cmd/mcp-broker. Tools: ssh_execute, ssh_session_open / ssh_session_exec / ssh_session_close, ssh_list_servers, ssh_put_file / ssh_get_file; with clusters configured, also k8s_get / k8s_list / k8s_logs / k8s_apply / k8s_delete / k8s_list_clusters. No transport auth — isolation comes from the process being launched by the user (as the MCP spec recommends for stdio).
• MCP HTTP + OAuth2/OIDC (remote, multi-user) — cmd/mcp-broker-http, Streamable HTTP. Same tools, but each client authenticates with an OIDC bearer token validated locally against the issuer's JWKS; the user identity (and groups, for per-user RBAC) is propagated to the signer.
• HTTP + mTLS — cmd/broker, POST /v1/ssh_run (one-shot), for network agents authenticated with a client certificate.

Documentation

This README is a landing page. The detail lives in focused, single-source docs:

Why infrabroker

• Anti-exfiltration (prompt injection): the ephemeral key/cert/token live only in the broker's memory; they never enter the model's context.
• Kubernetes without kubeconfigs: the signer mints a short-lived bound ServiceAccount token (TokenRequest API) per operation; every cluster is default-deny with per-verb/resource/namespace policy and the same dry-run, approval and audit path as SSH.
• Anti-reuse: each cert carries a TTL of minutes, source-address (broker or bastion IP), and — for one-shot — a force-command. Useless outside its host/time/IP.
• Controlled escalation: allow_sudo / allowed_sudo_users live in the signer; a compromised broker cannot escalate where policy forbids it.
• CA compromise bounded: one CA per host group (ca_keys), each key optionally

... View full README on GitHub