luisgf/infrabroker

**Infrastructure access broker for AI agents — SSH & Kubernetes. The model
never touches a credential.** *(formerly ssh-broker)*
The agent requests an *action* — run a command on a host, query or change a
cluster. infrabroker checks it against policy, executes it with a credential
minted for that single operation — an **ephemeral, scope-limited SSH
certificate** from its own CA, or a **short-lived bound ServiceAccount token**
— and returns **only the output**. Keys, certificates and tokens live in the
broker's memory and are discarded after the call: nothing enters the model's
context, so a prompt-injected agent has nothing to exfiltrate.
One binary — infrabroker — exposes the same engine (internal/broker) and tool
surface (internal/mcpserver) over three transports, chosen by subcommand. (The
legacy per-transport binaries broker / mcp-broker / mcp-broker-http remain as
thin **deprecated wrappers** over these subcommands, so existing configs keep
working.)
- **MCP stdio (local, recommended for personal use)** — infrabroker serve-mcp.
Tools: ssh_execute, ssh_session_open / ssh_session_exec / ssh_session_close,
ssh_list_servers, ssh_put_file / ssh_get_file; with clusters configured,
also k8s_get / k8s_list / k8s_logs / k8s_apply / k8s_delete /
k8s_list_clusters. No transport auth — isolation comes from the process
being launched by the user (as the MCP spec recommends for stdio).
- **MCP HTTP + OAuth2/OIDC (remote, multi-user)** — infrabroker serve-mcp-http,
Streamable HTTP. Same tools, but each client authenticates with an **OIDC
bearer token** validated locally against the issuer's JWKS; the user identity
(and groups, for per-user RBAC) is propagated to the signer.
- **HTTP + mTLS** — infrabroker serve-http, POST /v1/ssh_run (one-shot), for
network agents authenticated with a client certificate.
Documentation
This README is a landing page. The detail lives in focused, single-source docs:
| Document | Contents |
|---|---|
| QUICKSTART.md | First ssh_execute in under 10 minutes — single-binary local mode, no signer/PKI |
| ARCHITECTURE.md | Diagram, request flow, design decisions, sudo elevation, sessions, multi-CA |
| THREAT_MODEL.md | Actors, trust boundaries, security controls, and explicit non-goals/gaps |
| OPERATIONS.md | Runbook: startup, adding hosts, hot-reload, broker-ctl, PKI rotation, configs |
| MESH.md | Running infrabroker over a NetBird / Tailscale mesh — the session layer on top of the overlay path |
| HA.md | Why it is single-instance today: state inventory, the blockers, and what degrades under replication |
| API.md | HTTP endpoint reference for all services |
| USAGE.md | Guide to the MCP tools (SSH + Kubernetes), dry-run, and audit review (for the model / operator) |
| SECURITY.md | Vulnerability disclosure policy |
| CONTRIBUTING.md · CODING_STYLE.md | Workflow, versioning, Go style |
Why infrabroker
- **Anti-exfiltration (prompt injection):** the ephemeral key/cert/token live
only in the broker's memory; they never enter the model's context.
- **Kubernetes without kubeconfigs:** the signer mints a short-lived **bound
ServiceAccount token** (TokenRequest API) per operation; every cluster is
**default-deny** with per-verb/resource/namespace policy and the same
dry-run, approval and audit path as SSH.
- **Anti-reuse:** each cert carries a TTL of minutes, source-address (broker or
bastion IP), and — for one-shot — a force-command. Useless outside its
host/time/IP.
- **Controlled escalation:** allow_sudo / allowed_sudo_users live in the
signer; a compromised broker cannot escalate where policy forbids it.
- **CA compromise bounded:** one CA per host group (ca_keys), each key
optionally in Azure Key Vault or ssh-agent (YubiKey PIV / SoftHSM / TPM)
— the private key never leaves the HSM.
- **Audit / non-repudiation:** append-only, Ed25519-chained log correlated by