One control plane
for tools, sandboxes, and host operations.
infrastrActure is the open-source DevOps control plane for AI agents. Run an MCP marketplace of tools, spin up isolated sandboxes per user, and operate your fleet over SSH — all from a single signed surface that any LLM client can talk to.
GET /api/integrations/client?instanceId=acme-prod&client=claude
Authorization: Bearer mcp_sk_live_…
{
"mcpServers": {
"github": { "type": "streamable", "url": "https://mcp.acme.io/u/42/github" },
"browser-use": { "type": "streamable", "url": "https://mcp.acme.io/u/42/browser" },
"infra-ssh": { "type": "streamable", "url": "https://mcp.acme.io/shared/ssh" }
}
}Three things, well-shaped, instead of a hundred half-shaped ones.
Tools. Sandboxes. Host operations. Each is a clean control-plane primitive with the same lifecycle, identity, and audit semantics.
An MCP marketplace your agents can subscribe to.
Containerised tools, served over MCP, behind one signed URL per user. A marketplace UI lets users add what they need; the control plane handles install, lifecycle, OAuth callbacks, and rotation.
- GitHub, Google Workspace, Tavily, Notion, browser-use, code-runner, …
- One install per user — config persisted, container reused, OAuth bound to identity.
- Tier-gated at the catalog: API keys see only the tools their tier permits.
- Webhook deltas: installation_created / _updated / _deleted, signed.
Config that pushes, instead of config you redeploy.
Tool installations, sandbox lifecycle, host changes — all surface as signed webhook deltas. Your client app subscribes once and stays in sync.
- · Hand-roll a Docker image per integration.
- · Provision OAuth credentials per user, by hand.
- · Track which tool is which user’s in your own DB.
- · Redeploy your client every time the catalog changes.
- · Page yourself when a sandbox container leaks memory.
- · One API:
GET /api/integrations/clientreturns every tool a user has, signed. - · Marketplace handles install, OAuth, container lifecycle, rotation.
- · Webhook deltas push config changes to your client in real time.
- · Tier model gates the catalog at the API key — DB-level, not app-side.
- · Gaia tends sandbox lifecycle, host audits, and incident triage.
// Listen for config deltas — your client picks them up live.
app.post("/webhooks/infrastracture", verifySig, (req, res) => {
const { event, data } = req.body;
switch (event) {
case "installation_created":
case "installation_updated":
mcpClient.addServer(data.user_id, data.tool, data.url);
break;
case "installation_deleted":
mcpClient.removeServer(data.user_id, data.tool);
break;
}
res.sendStatus(200);
});Find. Configure. Run. Connect.
The path from ‘I want this tool’ to ‘my agent is using it’ should not require a Helm chart.
Browse the marketplace — GitHub, Google, Tavily, browser-use, code-runner, your own image.
Set env, OAuth, scopes. Per-user. Persisted. Rotatable.
Container starts on demand. The control plane manages lifecycle, logs, health.
One signed MCP URL is delivered to your client. Webhook deltas keep it live.
One key. Two surfaces. Same call.
The tier of your API key decides what the catalog returns. Filtering happens at the database, not in your app — there is no ‘forgot to check the role’ failure mode.
[
{ "name": "github" },
{ "name": "browser-use" },
{ "name": "tavily" }
][
{ "name": "github" },
{ "name": "browser-use" },
{ "name": "tavily" },
{ "name": "infra-ssh" },
{ "name": "infra-terminal" },
{ "name": "infra-logs" }
]Implementation: toolRegistryService.listTools(filter, keyTier) — SQL WHERE tier = $1.
Meet Gaia. The system that tends the system.
Gaia is the operator agent that ships with infrastrActure. She knows every primitive — installations, sandboxes, hosts — and uses them to keep your fleet healthy. She is not a chat toy. She is a steward.
Diagnose container, sandbox, and host issues using the same MCP tools your users have. Trace, decide, act.
Walk a new tool installation through the marketplace. Configure scopes, mint keys, hand a working URL back.
Watch lifecycle events. Reap stale sandboxes. Roll OAuth tokens. Surface incidents before they page anyone.
“This prompt can go stale. The tools can’t.”
Gaia’s system prompt is versioned. Her capabilities aren’t — they come from the same MCP catalog your users see. Swap her brain. The hands stay calibrated.
One MCP server. Nine families. Every primitive, addressable.
Whatever your agent client is, it speaks to infrastrActure the same way: as an MCP server. Operators get the full set; standard keys get a curated subset.
- containers.list
- containers.start
- containers.stop
- infra-logs.tail
- infra-logs.search
- ssh.hosts.list
- ssh.actions.list
- ssh.exec
- ssh.session.open
- ssh.session.close
- ssh.session.list
- + 8 more
- terminal.open
- terminal.exec
- terminal.read
- terminal.close
- terminal.list
- installations.list
- installations.create
- installations.delete
- marketplace.list
- marketplace.tool.detail
- sandboxes.list
- sandboxes.start
- sandboxes.stop
- sandboxes.destroy
- service.health
- shared.tools.list
Where infrastrActure sits in the stack.
Honest about what we are — and aren't.
Built so a single rogue agent can’t become an incident.
The control plane is opinionated about identity, lifecycle, and audit. These are not features you opt into.
Each deployment carries a unique instance ID. API keys are minted against that instance — keys from one deployment do not authenticate against another.
Every container started by the control plane is labelled with the user, tool, and tier that requested it. Reaping is identity-aware; nothing is reaped by name alone.
High-impact host actions (SSH exec, destroy, role-change) require a leased approval. Leases expire. Audit rows record requester, approver, and lease window.
All deltas are HMAC-signed with WEBHOOK_CLIENT_SECRET (falls back to your admin tier API key secret if unset). Replay window is enforced.
Tier filtering is wire-level: SQL WHERE clause in toolRegistryService.listTools. There is no app-side ‘forgot to check role’ bug to write.
Sessions, sandbox lifecycle, host actions and approvals all write append-only rows. Gaia (and you) read them through MCP — same surface, same identity model.
A boring, durable foundation under a new shape.
No magic. TypeScript, Node, Postgres, Docker. The interesting work happens at the control-plane layer.
Run it yourself.
Or have us run it with you.
Self-hosting is a one-line Docker pull and a Postgres URL. Want a sharper path — bring a use case, and we’ll plumb the first tool, sandbox, and host wired up for you.
Have us run it with you.
Self-hosting from GitHub is always free. If you’d rather not, we onboard early-beta teams hands-on — bring a use case and we’ll plumb the first tool, sandbox, and host wired up for you.