The problem
Giving an AI agent unrestricted SSH access creates the wrong trust boundary. Credentials, hostnames, and arbitrary remote execution all become part of the agent’s operating surface, while review often happens after the fact.
The approach
safessh turns servers into named projects and exposes a constrained command
vocabulary for execution, file access, and forwarding. Every action passes
through the same policy gate whether the caller is a human or an agent.
Mutating commands pause for explicit approval. Gating events are written to an append-only JSONL audit log before user-visible output, with a rebuildable SQLite index for fast queries.
Why it matters
The agent receives a predictable interface without receiving the underlying credentials. The operator keeps control of policy, approvals, and the audit record.
The project includes a terminal review interface, multi-target projects, SSH config import, command categorization, redaction, and adapters for several coding-agent environments.