# bastn

> bastn turns the CLIs, scripts and services on your VMs, containers and sandboxes into typed tools, with a different menu for each agent. No MCP server to write. Each machine runs one small outbound program, the bastn connector, and it can only run what you approved: no SSH keys, no open ports, no shell by default. Every agent gets its own key. One switch disables an agent and its keys. Destructive actions are held for approval by default. New tools can be denied until you review them (new_tools: deny). Set rate limits per agent or caller. The audit log is hash-chained and verifies offline. Coming: gRPC, GraphQL and SQL named queries as tools, undo of a change's effect, and fully offline install, licensing and updates. Self-hosted only. bastn runs in your network. Early access. Request access at https://bastn.ai/#access.

dflux Ltd. https://bastn.ai

## Pages

- [Pricing](https://bastn.ai/pricing): bastn is self-hosted. Team checkout is through Paddle, the merchant of record.
- [Security and governance](https://bastn.ai/security): How bastn limits what agents can do on your hosts: outbound connectors, host-side limits, per-call policy and an audit log you can verify offline.
- [FAQ](https://bastn.ai/faq): Short answers on MCP, SSH, install, air-gap, agents and what is shipped.
- [Privacy Policy](https://bastn.ai/privacy): How dflux Ltd handles personal data collected through bastn.ai. The access form, hosting logs and cookieless analytics. No cookies.
- [Terms of Use](https://bastn.ai/terms): Terms for the bastn.ai website. Orders are sold by Paddle, the merchant of record. dflux Ltd, Israel.
- [Refund policy](https://bastn.ai/refund): Paid online orders may be refunded within 30 days. Paddle is the merchant of record and sends the refund.
- [Use cases](https://bastn.ai/use-cases): What teams use bastn for: fleets without SSH, internal tools as agent tools, approvals, audit.
- [Comparisons](https://bastn.ai/compare): How bastn relates to an MCP gateway and to SSH MCP servers.
- [Let an AI agent manage a VM fleet without SSH access](https://bastn.ai/use-cases/ai-agent-vm-fleet-without-ssh): Give an ops agent named, typed actions on 100 hosts instead of SSH keys or a shell. One outbound connector per host runs the actions you approved.
- [Turn any CLI or script into MCP tools without writing an MCP server](https://bastn.ai/use-cases/cli-to-mcp-tools): Describe a CLI once and serve it as typed, validated MCP tools, with a different set per agent and a connector on the host that runs the approved actions.
- [Give an on-call AI agent read-only access to every host](https://bastn.ai/use-cases/read-only-on-call-agent): Let an agent read logs, service status, disk, memory and network on your fleet with the read-only Linux pack. Nothing it can call changes a machine.
- [Let an AI agent fix things, with you approving each risky call](https://bastn.ai/use-cases/agent-remediation-with-approvals): Give a remediation agent restart and other write actions on your hosts. Destructive calls are held until you approve them, with the exact host and arguments in front of you.
- [Give AI agents your internal APIs as tools](https://bastn.ai/use-cases/internal-apis-as-agent-tools): Import an internal service's OpenAPI spec and serve its operations as typed MCP tools, with a different set per agent and the service credentials kept off the agent.
- [Put the MCP servers you already run behind per-agent policy](https://bastn.ai/use-cases/govern-existing-mcp-servers): Front the internal MCP servers you already run with bastn. Each agent gets its own key and its own tool list, new tools wait for review, and every call is audited.
- [Let an AI agent write a script, and run it only after you review it](https://bastn.ai/use-cases/agent-written-scripts): When no action fits the job, an agent can submit a script. It is held for review, approval pins its hash, and the connector re-checks the hash before every run.
- [MCP gateway vs tool gateway for internal systems](https://bastn.ai/compare/mcp-gateway-vs-tool-gateway): MCP gateways govern tools that already exist. A tool gateway for internal systems builds tools from your CLIs and services and enforces them on the host.
- [bastn vs SSH MCP servers for AI agents](https://bastn.ai/compare/ssh-mcp-servers): SSH MCP servers give an agent a shell with allow-lists. bastn gives it named, typed actions enforced by a connector on the host.

## Notes

- The bastn connector is the program on each machine. Later mentions say the connector.
- No shell by default. Raw commands are off unless you enable them, and every raw call waits for approval.
- Destructive actions are held for approval by default. New tools can be denied until you review them (new_tools: deny).
- Set rate limits per agent or caller.
- Every agent gets its own key. One switch disables an agent and its keys.
- Commands run as a dedicated non-root user (run_as). Running commands as root is refused. The connector process must run as root to switch to that user. The published image runs as uid 10001 and does not switch users.
- Release binaries for Linux, macOS and Windows (amd64, arm64). The Linux command pack is tested on Debian, Ubuntu and Alpine.
- Restart comes from a reviewed custom spec; the shipped Linux pack is read-only.
- The home policy and audit panels are captured from a bastn run. Restart comes from a reviewed custom spec; the shipped Linux pack is read-only. /security includes audit lines captured from a bastn run.
- gRPC, GraphQL and SQL sources are coming. OpenAPI 3, existing MCP servers, governed commands and reviewed scripts are described on the home page.
- Undo of a change's effect is coming. Fully offline install, licensing and updates are coming.
- Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns.
- Contact: comms@dflux.io