Skillsdbhq.uk (external site)

All sixteen skills

heliograph

Claude Code + CodexLiveApache 2.0

Debug a machine you cannot log into

Through an operator who cannot debug it, in an estate where nobody is going to give you SSH. You publish a step, it runs on the far side, and the whole run comes back as a log with every line stamped in UTC - so a hang reads as a gap rather than as slow progress, and the log returns whether the run passed or failed. The skill is one part of the heliograph toolkit: the CLI it drives, the bash and PowerShell stations, the relay and the MCP server are all documented on docs.heliograph.io.

Install heliograph

  1. Add the DBHQ marketplace, once

    /plugin marketplace add dbhq-uk/marketplace

  2. Install the skill

    /plugin install heliograph@dbhq

Both commands work in Claude Code and in Codex. The marketplace is a public repository you can read first: dbhq-uk/marketplace (external site)

What it is good at

  • Running the gap as a loop, not a relay

    You publish a step, the far side picks it up within seconds and runs it, and the whole run comes back as a log with every line timestamped in UTC - whether it passed or failed. Nobody has to paste half a terminal at you.

  • Asking as little of the far side as it can

    The station is plain text the operator can read before running it: bash 4 or newer and the tool its transport talks through, git by default, or the Windows PowerShell already on the box. No packages, no credentials, no tunnel. GNU coreutils are not required: on busybox the preflight warns and says what is lost. Choose the relay, or a trusted set of keys allowed to command the station, and a bash station also needs heliograph-seal, one compiled binary whose checksum is published with each release. The PowerShell station needs no binary for either. On a locked-down box where installing anything is its own change request, keeping that list short is the point.

  • Being read-only unless the operator said otherwise

    Every step declares itself read-only or an action, one that declares neither does not run, and the station refuses an action unless it was started to allow them. It will not run as root either.

  • Finding the stall by arithmetic

    Scanning the timestamp column for gaps before reading the content is the most valuable instruction in the method, and it is arithmetic rather than judgement. A long interval is attributed to the line before it, because that is what was running. A log where every line carries the same timestamp is reported as an error, not as "no gaps".

  • Serving the loop to an agent as MCP tools

    heliograph mcp is a local MCP server over stdio. An agent running the investigation can list estates, send a step, check status, wait on a run for no longer than it chooses, cancel the step, stop the station, read the log and its gaps, and run doctor, all as typed tools. Setting up stays on the CLI: bootstrap, init, plant and trust have no tool. The gates do not move: a tool call publishes a request, and the station still decides whether to run it.

What it does not do

  • It will not give you access you do not have

    Today it does not tunnel, proxy or hold a connection open to a host you control, and there is nothing in it to punch through a firewall with. No raw TCP transport is offered, for that reason: a persistent reverse connection is a C2 channel by any blue team's definition, which is a large part of why this class of tool is permitted at all where the boundary is enforced. A live two-way channel, the beam, is designed but not built, and the design keeps it off unless both ends enable it. Every command runs on the far side because someone with legitimate access chose to run it.

  • It is not a replacement for SSH

    If you can just log in, you do not need this. It exists for the estate where access is blocked by policy rather than capability.

  • The two stations do not carry the same transports

    The bash station carries git, share, relay, bundle, object store and blob. The PowerShell station, for an estate with no bash at all, carries git, share and relay - so bundle and object store need the bash far side. Blob is reached through the station payload rather than the CLI.

  • The skill needs the CLI

    It drives the heliograph binary and nothing else. When the binary is missing the skill prints the install command rather than pretending to work.

Read it before you install it

Every line is public and Apache 2.0 licensed. The README is the long version of this page, including the parts that are still rough.

heliograph-io/heliograph (external site)docs.heliograph.io (external site)