Every setup I found for letting an AI agent work on a server asked for one of two things. Either I paste a private key somewhere the agent can read it, or I install a daemon on the box and leave it running. I wasn't willing to do the first and didn't want to maintain the second, so for about a year I just didn't use agents for ops work. I'd have one open in a window, describing a problem to it, then type the commands myself.
What eventually bothered me about that: I already have an authenticated SSH session open. It's sitting in the file manager I use every day, connected, host key verified, ready. The agent doesn't need credentials. It needs that session, and it should have to ask me before it touches it.
That's the Agent Bridge in Faro, the SFTP/SSH client I maintain. I'd been using it for read-only things, mostly tailing logs and diffing config between staging and prod. Last week I pointed it at something with more consequences: two brand new DigitalOcean droplets, one prompt, install a full server control panel on both.
Two minutes, no narration. Faro and ServerKit are both MIT if you want to follow along.
What the agent could actually see
