Standardize incident checks
Use configured runbooks for service status, disk usage or bounded logs. AI selects a known check and supplies validated parameters instead of composing unrestricted shell text.
Cloud & infrastructure · MCP Firewall integration
Let AI use reviewed runbooks. Keep server commands under control.
Use GateRook’s MCP Firewall to expose saved SSH runbooks with typed parameters. GateRook checks host identity and shows the rendered command before a change is approved. A runbook must already be configured: the current desktop build lists runbooks but does not yet include an editor. The SSH account’s permissions remain the execution boundary.
Connection in GateRook
stage-vm
SSH
stage / QA- Host
- stage-vm.internal
- Port
- 22
- User
- gw-runbooks
- Credentials method
- privateKey
The security boundary
Your AI requests a tool. GateRook checks its mode and policy, requires approval when configured, and resolves credentials locally before an allowed call runs.
Understand the request flowAsk your AI
Run the saved uptime check on stage-vm.
ssh_run · arguments
{
"connection": "stage-vm",
"runbook": "uptime"
}Example result
{
"connection": "stage-vm",
"runbook": "uptime",
"command": "uptime",
"exitCode": 0,
"exitSignal": null,
"stdout": "14:28:00 up 12 days, 3:10, 1 user, load average: 0.18, 0.22, 0.19\n",
"stderr": "",
"truncated": false,
"timedOut": false,
"durationMs": 230
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Useful access. Explicit control.
What you can do with SSH and AI
Review an operational change
When AI requests an existing maintenance runbook, the approval shows the fully rendered command, target host and parameters. Execution waits for your decision.
Reach private infrastructure
Use the network access already available on the GateRook computer, including its VPN and an optional SSH bastion. A Vault SSH CA can issue short-lived user certificates for calls.
From service to MCP Firewall
How to connect SSH
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select SSH. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Add the SSH target
Add an SSH connection named stage-vm in the stage environment. Enter the host, port and dedicated user. Choose a private key, password or Vault SSH CA credentials; Vault SSH CA requires an external Vault store configured in Secrets.
Verify the host identity
Run Test connection and compare the host fingerprint with your trusted record before accepting it. If you use a bastion, configure and verify its own user, credentials and host key as well.
Choose an existing runbook
In Connectors, open Templates and locate a configured SSH runbook whose Runs on connection is stage-vm. The desktop build currently has no runbook creation editor. The example below requires an existing uptime runbook with command uptime, reviewed and confirmed read-only; it is not created by adding an SSH connection.
Keep the execution scope small
Use Runbooks only and publish ssh_run on the endpoint. Existing runbooks expose their validated parameters to the AI client. Mutating runbooks wait for approval; arbitrary ssh_exec is a separate tool and is off by default. If the connection has no configured runbooks, ssh_run has nothing to execute.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure SSH in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Host | stage-vm.internal | The core connects from this computer, so its VPN, DNS and hosts file apply. |
Port | 22 | Change this if the SSH server listens on another port. |
User | gw-runbooks | Use a dedicated account with the permissions needed by the saved commands. |
Credentials method | privateKey | Enter an OpenSSH or PEM key in the protected field. An optional passphrase and user certificate are supported. |
Runbooks only | true | Rejects ssh_exec regardless of endpoint mode. This restriction defaults to true for prod connections. |
Host key | Confirm during Test connection | Verify the displayed fingerprint against a trusted source, then pin it. Existing known_hosts lines can also be supplied. |
Know what you expose
SSH tools and access boundaries
The connector defines available operations. GateRook’s MCP Firewall enforces endpoint modes and connection policies before an AI client can use them.
| Tool | Purpose | Access behavior |
|---|---|---|
ssh_run | Run a saved runbook with its validated parameters. Reviewed read-only runbooks can run in Read only mode; runbooks that may change state require approval. | Read only / Approval |
ssh_exec | Run an arbitrary command only when the connection and policy permit it. Every such command is treated as a mutation and requires approval. | Off by default |
Before you enable access
- The desktop build has no SSH runbook creation editor yet. A runbook must already be configured on the selected connection before AI can call it; the uptime example illustrates that prerequisite.
- Read-only is a human-reviewed declaration for the command, not a remote operating-system sandbox. A changed command needs its read-only confirmation again.
- ssh_exec is off by default, always requires approval when enabled, and is refused when Runbooks only is on.
- The SSH account still determines the operating-system permissions. Command timeouts and output limits bound a call; they do not make a powerful account unprivileged.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
SSH connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Where do I create an SSH runbook?
The current desktop build does not provide a runbook editor. Connectors > Templates lists existing runbooks and their connection, but New template > SSH runbook is unavailable. This guide demonstrates a preconfigured runbook; a new SSH connection alone does not supply one.
Do I need to give my SSH key to the AI client?
No. Configure the key or credential source in GateRook. The MCP call names a connection and runbook; it does not contain the SSH private key.
Can I connect through a bastion?
Yes. Configure the optional jump host with its own user, credentials and host key. The bastion must permit TCP forwarding.
What happens when I change a read-only runbook?
Its read-only confirmation is tied to the exact command. A changed command waits for approval until you review and confirm it again.
Keep exploring
Extend control across your stack
SSH log files
Read selected SSH log files through GateRook’s MCP Firewall. Verify host keys, restrict file access and inspect bounded results and call history in Activity.
Kubernetes
Protect Kubernetes access with GateRook’s MCP Firewall. Restrict namespaces, enable log access deliberately and approve enabled rollout or manifest changes.
HTTP API
Put HTTP APIs behind GateRook’s MCP Firewall. Protect API keys, restrict destinations and paths, and approve requests that change data.
Your MCP Firewall. Your access rules.
Control AI access to SSH.
Start with read-only access. Approve changes. Inspect the audit trail.