OdyshellGive a durable Agent temporary shell authority on private Linux Machines.
An Agent is a persistent programmatic identity inside one Organization. Authentication proves who the Agent is; it does not grant access to any Machine. Machine authority exists only inside an expiring Task.
Agents are the primary Odyshell operators. Humans establish trust, define policy, optionally decide exceptions, and inspect evidence through the dashboard.
For an MCP-compatible runtime, add the Server's /mcp resource and complete OAuth in the browser:
https://mcp.example.com/mcpOdyshell uses Authorization Code with PKCE for interactive MCP installations. Unattended Agent runtimes use Organization-bound OAuth Client Credentials against the canonical HTTP interface. Both transports call the same authorization module and expose the same Task and Command state.
The CLI does not host a separate stdio MCP server. It is reserved for installing, diagnosing, and recovering the Machine Client.
An Agent can discover only online Linux Machines whose Local Policy includes that Agent. To work, it requests a Task with:
The Machine owner controls the Local Policy ceiling. The Organization's Autonomy Policy decides whether a Task inside that ceiling opens automatically or waits for an Owner, Admin, or Supervisor. A human decision cannot widen Local Policy.
An active Task authorizes arbitrary non-interactive shell Commands as the operating-system user running that Client Profile. This is same-user authority, not a sandbox or a safe-command claim. Commands can access files, credentials, network, and services available to that user, and their side effects may persist after the Task ends.
The Agent polls Task state after requesting authority. A Task may be pending approval, opening, active, cancelling, completed, cancelled, expired, or failed. Transport loss does not create a new Task: the Agent reads the existing resource again using its ID.
Each Command is asynchronous. It accepts shell text, an optional absolute working directory, and a bounded timeout. Caller-provided environment variables and standard input are not accepted. The Agent polls Command state and reads transient stdout/stderr chunks with a sequence cursor, then explicitly completes the Task after every Command reaches a terminal state.
Reusing an idempotency key with different Task or Command input is rejected. Cancellation stops the Client process tree when it is reachable; expiry and reconnect reconciliation fail closed instead of silently restoring stale authority.
Audit evidence binds the Organization, Agent, Machine, Task, human decision, exact command, working directory, timeout, status, and timestamps. Credentials and retained command output are excluded. Output is a short-lived delivery buffer for reconnect, not a session recording.
The dashboard's Tasks view shows pending decisions first and recent Agent work separately. Human supervision is optional when policy allows autonomous execution.