Skip to main content

​
Grant an AI assistant read-only access to one Managed Host

Outcome: A verified AI client can request host/process information from branch-a but cannot execute commands or access unrelated hosts merely by supplying an AI display name.
Remote MCP needs single443 and trusted public HTTPS. Complete Claude/ChatGPT setup and use a separate least-privilege identity for this exercise.

​
Step 1 — confirm topology and Agent

Real Data Relay Link CLI capture — Captured Server status before policy setup: Remote Access default ALLOW; Internet Access and AI Access default DENY. Figure 1. Captured Server status before policy setup: Remote Access default ALLOW; Internet Access and AI Access default DENY. CLI output example; sensitive addresses and hostnames are masked. Server REPL:
The target branch-a must already be enrolled with a functioning Agent management path. A Remote Service or exposed SSH is not required for MCP operations. Public MCP over https://<host>/mcp is supported on single443, not direct mode. If you must change from direct to single443, plan a Server installer mode migration using the same product version and the deployment modes guide. Do not infer MCP readiness just because a stale certificate exists.

​
Step 2 — create an identity and read-only Permission Object

Real Data Relay Link CLI capture — Server menu: enter menu, then choose Remote Access 4, Internet Access 5, AI Access 6 or System 7. Figure 2. Server menu: enter menu, then choose Remote Access 4, Internet Access 5, AI Access 6 or System 7. CLI output example; sensitive addresses and hostnames are masked. Server REPL:
The set ai-identity wizard establishes the identity definition. For an interactive AI client, configure the supported OAuth Authorization Code authentication flow. Example CLI authentication-mode setting, subject to the actual client/Server contract:
A displayed identity name alone is never proof of authentication. Protect credentials; do not embed them in documentation or issue comments.

​
Step 3 — authorize only the necessary target and permission

Server REPL:
Expected: ALLOW for observer and DENY for exec-check, provided no other matching enabled Rule grants it. AI Access is WHITELIST only, default DENY; disabling enforcement is DENY ALL. Do not assign command-exec as part of a supposed read-only role.

​
Step 4 — prepare the public HTTPS MCP origin

Real Data Relay Link CLI capture — Direct-mode configuration warning: MCP TLS was not configured; single443 is required. This is NOT a successful MCP connection. Figure 3. Direct-mode configuration warning: MCP TLS was not configured; single443 is required. This is NOT a successful MCP connection. CLI output example; sensitive addresses and hostnames are masked. On an existing single443 Server, ensure a controlled DNS hostname, public HTTPS reachability and appropriate certificate authority validation. Server REPL, using your real hostname and contact email:
Only after successful preflight, planned certificate issuance and appropriate owner authorization:
Verify externally that https://mcp.example.net/mcp, /.well-known/oauth-authorization-server, and /.well-known/oauth-protected-resource/mcp resolve over trusted TLS and publish a consistent canonical issuer. An internal loopback test is not enough. For a user-provided certificate, choose the supported user-certificate mode instead.

​
Step 5 — connect Claude or ChatGPT and verify the read-only identity

  1. In a compatible remote-MCP client, add a custom remote MCP server using https://mcp.example.net/mcp. The exact client menu and plan capabilities are determined by that client; do not attempt an unsupported plan workaround.
  2. Complete its OAuth Authorization Code login/consent. Match the authenticated client principal to the intended auditor-ai identity according to the configured credential binding; approve a pending request only after verifying the principal.
  3. Discover the exposed tools. Request host-info on branch-a: expected authorized result.
  4. Request a command execution or another out-of-scope operation: expected policy DENY, not a successful command.
  5. In Server REPL, review:
The end-to-end result is only validated once the actual external AI client completed authentication, allowed invocation and denied invocation. Static configuration and CLI policy tests are preparation, not end-user qualification.

​
Recovery and least privilege

A failure may be OAuth authentication, external TLS, client capability, Agent trust or policy. Diagnose each boundary individually. Avoid broad permissions, file access without rule-bound paths, and unnecessary command execution. Revoking a credential with system credential revoke ai-identity auditor-ai interrupts that identity; use only when the security owner intends it. To retire the rule, review effects before unset ai-access auditor-host; do not remove unrelated identities or MCP certificates.

​
Current behavior check — 2026-10-28

Claude and ChatGPT real MCP tests are complete; follow the client-specific setup guide. Verify the complete effective policy, including the initial owner mcp-owner-full-access Rule. Adding observer does not remove an earlier command-exec grant. A distinct non-owner identity is required for this read-only exercise when the owner already has broader access. Current CLI inventory · MCP compatibility

​
Add a scoped log-reading exercise

If the operator has prepared a nonsensitive /var/log/myapp/health.log on branch-a, use the app-reader Rule in the AI Access file example. Ask Claude/ChatGPT for read_file on that path only. Do not grant command-exec or other paths. Include path in policy tests, then separately verify file existence/OS access and actual allowed/denied tool results. For a new Managed Host used only for MCP, use set enrollment bulk, count 1, with a blank SSH username for management-only registration. Choose Remote Services requires at least one service. Publishing SSH/RDP is unnecessary; reuse an enrolled host without re-enrollment.
Last modified on October 29, 2026