execkit

execkit provides AI agents with stateful, structured, and secure command execution capabilities, covering local shell, SSH, and Docker environments. It is designed to supplement rather than replace an agent's built-in shell or sandbox, and is especially suitable for scenarios where the agent needs to work on remote hosts or containers, needs to record execution history, or needs to undo file changes in a remote workspace.

Main capabilities:

• Persistent, stateful sessions: supports local PTY, SSH, Docker; SSH can use host aliases from ~/.ssh/config. cd and environment variables persist across multiple calls.
• Structured execution result ExecResult: separated stdout/stderr, exit code, elapsed time, cwd, truncated, timed_out fields.
• Base64 command wrapping: comments, heredocs, !, trailing &, syntax errors, and long commands will not hang the session.
• Timeouts that preserve the session: commands default to a 120-second timeout (configurable per call via timeout_secs, up to 3600 seconds). After a timeout, the command is interrupted via Ctrl-C and returns timed_out: true with exit code 124, and the session retains its cwd and environment.
• Secret redaction: redacts common token forms (AWS, GitHub, GitLab, Slack, Stripe, Google, Anthropic, OpenAI, JWT, PEM private keys), passwords in URLs, password= / token= style key-value pairs, and values assigned to secret-named variables in the session. Echoed commands are also redacted.
• Output budgets: supports tail / head / head+tail by line, grep filtering with context, and character limits, configurable per call or as a session default, and results report what was retained.
• Remote undo: snapshots the workspace and restores files when a command fails (requires git on the remote and an explicitly specified workspace; files only, no side effects).
• Audit log and live viewer: sessions can be recorded to a JSONL audit log, viewed live in the terminal via execkit-mcp watch, or opened as a read-only browser viewer via execkit-mcp watch --serve --open.
• Embeddable, not a service: integrated into the process via cargo add, with no daemon,no vendor lock-in.

Usage:

• Use from an agent via MCP: the agent gets session_create (local, ssh, or docker), session_exec, session_list, and session_destroy, as well as session_checkpoint / session_checkpoints / session_restore for remote undo.
• Zero install (uv): add the configuration to the MCP client configuration, or install it and let execkit print the configuration for the client. execkit-mcp doctor can check the setup.
• Use as a library: in Rust, run the examples cargo run --example local, EXECKIT_SSH="user:password@host:22" cargo run --example ssh, EXECKIT_DOCKER=<container> cargo run --example docker. Python bindings via pip install execkit (native bindings, no Rust toolchain required).
• Observe agent behavior: after setting EXECKIT_MCP_AUDIT_DIR, every session is recorded.

Suitable scenarios: Suitable when an agent executes commands on a remote host or in a container, needs to audit execution records, or needs to undo file changes in a remote workspace.

Limitations and caveats:

• Status is early 0.x, and the API may change between minor versions.
• Not a sandbox: command policies are only advisory string matching and are easy to bypass (for example, deny: ["curl"] cannot prevent env curl, sudo curl, or sh -c curl). The real control is a least-privilege environment.
• Interactive input is not supported: stdin is /dev/null, and prompts, REPLs, and editors will not work. Use non-interactive flags (sudo -n, apt-get -y). The pager is set to cat by default; running less or vim directly will hang until timeout and close the session. Shell history is disabled.
• Timeout is an interrupt, not a kill-everything: execkit sends Ctrl-C. Commands that ignore Ctrl-C will end the session. Long tasks should be run in the background (nohup CMD > /tmp/job.log 2>&1 &) and poll the log.
• The target requires a POSIX shell and base64. Local sessions use bash. Windows is not supported.
• Synchronous core: suitable for typical agent usage, not tuned for thousands of concurrent sessions.
• SSH AcceptAny host key mode is for testing only, requires an explicit insecure opt-in, and must never be used in production.
• Upgrading to 0.9 has breaking changes: SSH host keys are pinned in ~/.execkit/known_hosts instead of ~/.ssh/known_hosts; stdin is /dev/null and the pager is set to cat; timeouts return exit code 124 with timed_out: true and preserve the session; session ids look like a3f9-1_local; SshConfig adds a connect_timeout field (default 15 seconds). See Upgrading to 0.9 for details.
• SSH host key changes fail explicitly rather than reconnecting and causing a man-in-the-middle attack.
• License: Apache-2.0, free to embed including for commercial use.