Heliograph runs on your own machine — the client starts it, so there is no endpoint to ping. 72 installs a week from npm. Last commit 3 Oct 2026.
Run commands on a machine you cannot SSH into. Air-gapped, bastion-only, change-controlled.
We read the source, 2 d ago · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
postinstall: node bin/install.mjs
пакет @dbhq/heliograph ссылается на dbhq-uk/heliograph
const child = spawn(bin, process.argv.slice(2), { stdio: 'inherit' });
Found in continuous integration, deployment or infrastructure files, or in a neighbouring package of the same monorepo. None of this is installed when you add the server: it describes how the project is built and released. We list it because a leaked key in a build pipeline is still a real problem, but it is not something this server does on your machine.
if s.Statuses, err = readStatuses(filepath.Join(dir, statusesDirName)); err != nil {
result = subprocess.run(
env = dict(os.environ)
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add heliograph -- npx -y @dbhq/heliograph
{
"mcpServers": {
"heliograph": {
"command": "npx",
"args": [
"-y",
"@dbhq/heliograph"
]
}
}
}
[mcp_servers.heliograph]
command = "npx"
args = ["-y", "@dbhq/heliograph"]
{
"mcpServers": {
"heliograph": {
"command": "npx",
"args": [
"-y",
"@dbhq/heliograph"
]
}
}
}
{
"servers": {
"heliograph": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@dbhq/heliograph"
]
}
}
}
Run commands on a machine you cannot SSH into. Air-gapped, bastion-only, change-controlled.
Run your coding agent's commands on machines you own: a sandboxed job slot, not an SSH login.
Run commands and manage files on your own machines. Needs a LetKite account; OAuth sign-in.
Run commands on your remote test machines over SSH without the agent ever seeing a secret.
Extract a repo's contribution gates into machine-readable contribution-gates.json.
Give your AI hands on every computer you own. One chat, all your machines — even from your phone.
Code changes and unit tests by local MLX models, behind a gate a machine can run.
Group your AI's changes into focused commit candidates; nothing lands until you approve.
Answers built from our own checks of this server.