Letting AI Agents Deploy to Your Own Servers With MCP (Without Handing Them Root)
Coding agents got good at writing code long before they got safe at running it. The moment you ask Cursor or Claude to "deploy this and check the logs", you hit a real question: what exactly is the agent allowed to touch? The lazy answer is an SSH key or a cloud admin token pasted into a config file. It works, and it is also how you end up with an agent that can rm -rf a production volume because…
The article discusses a method for securely deploying AI agents to self-hosted infrastructure without granting them excessive privileges. The key point is the Model Context Protocol (MCP), which provides a standardized way for AI clients to discover and call specific server tools, rather than letting agents execute arbitrary shell commands.
With MCP, the agent sees a predefined set of tools like `list_services`, `deploy`, `get_logs`, and `set_env`, each with its own schema and server-defined permissions. This explicit approach solves several security issues:
1. Agents cannot accidentally or maliciously damage infrastructure by only having access to specific, controlled actions.
2. Authorization is handled server-side, preventing agents from bypassing permission checks.
3. All tool calls are logged in the same API as your dashboard, enabling easy auditing of the agent's actions.
The article outlines a checklist for implementing this security model:
- Use per-person, per-workspace tokens that cannot be shared or reused across teams.
- Create separate user accounts or memberships for automation roles.
- Inherit permissions based on the roles of the human who issued the token.
- Avoid interactive shells, relying instead on actions that can be performed through the API.
- Implement least privilege access, keeping deployments and deployments-related tasks within the scopes of the agent's role.
- Avoid using tokens stored in repositories or as plain passwords.
In practice, the author tested this approach using Peon's MCP server. The client configuration involves adding a streamable HTTP server with a bearer token from the Peon dashboard, scoped to a specific workspace with inherited permissions. The article emphasizes that shell access is prohibited and that all actions are performed through explicit API calls.
The article provides a realistic example of an agent's workflow, where an agent reads service logs, identifies a missing configuration variable, explains the fix, and asks for permission to set the variable before redeploying the application. This demonstrates how agents can perform operations without needing root access, with every step auditable and reversible if necessary.
Overall, the article emphasizes that while AI agents can greatly benefit operations work, they must be carefully scoped and controlled to prevent unintended consequences. By following the MCP protocol and implementing the recommended security practices, teams can leverage the benefits of AI-powered deployment without compromising their infrastructure's integrity.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
