heliograph
by heliograph-io·
io.github.heliograph-io/heliograph·v0.4.3Run commands on a machine you cannot SSH into. Air-gapped, bastion-only, change-controlled.
C59/100grade C
Grade C.Usable with care. Some checks failed or could not be verified.
Tools
Tool lists for local packages are only visible after install.
Public scan report
scanner v0.1.2 · 2026-09-17 · same rubric, same numbers if you re-run it
2 medium
- Code scan4 source files scanned15/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- Tool poisoningonly the listing description was available15/15
- Auth qualitylocal package, no credentials required12/15
- Maintenancerepository not readable: github 4013/15
- Maintainer identityno repository or website to verify2/10
Findings (2)
- mediumnpm install lifecycle script present
install.script - mediumnpm install lifecycle script present
install.scriptpackage.json: … "README.md" ], "scripts": { "postinstall": "node bin/install.mjs" }, "engines"…
Overall 59/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON
Install directly
Runs npx -y @dbhq/heliograph on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add heliograph -- npx -y @dbhq/heliograph