heliograph

Run it on the machine you cannot reach

Heliograph Cloud sends your steps across an access boundary, runs them on the far side, and brings back the whole log. No inbound port, no VPN, no credential of yours on their machine. The station that runs on their machine is published, so the thing they are being asked to install is a thing they can read.

Read the documentation Open the console

The round trip you are paying for

Somebody else operates the estate. You know what to run; they can reach it. So the work goes back and forth as instructions in a chat window and screenshots of output, and the record of what ran is whatever somebody remembered to paste.

What you get back

Each run is captured as it was produced and kept that way. Afterwards there is a record of what ran, where, and what came back, searchable and exportable, which is the thing you are buying.

edge-04 collect-diagnostics pushed back over git
09:14:02step accepted collect-diagnostics station edge-04
09:14:02+ systemctl status app.service
09:14:03 Active: inactive (exit-code) since 09:11:58 UTC
09:14:03+ terraform plan -no-color
09:17:15nothing was produced here. this is the answer.
09:17:15 Error: timeout while waiting for the state lock
09:17:16ended state: stopped 1842 lines captured
A synthetic run, written for this page. The three minutes between 09:14:03 and 09:17:15 are the point: a command that produced nothing is a finding, and it only exists if the whole run came back.

Why they will let you

The protocol, the CLI and the station are public, and a station on a customer's machine runs code that customer can read. Payload content is end-to-end encrypted and moves only through published components. The proprietary broker handles account, topology and authorisation metadata and can permit, deny or route a connection; it takes no part in the fingerprint comparison that pairs two ends, which happens out of band between two people.

The licensing boundary, in full

What is true today, with its condition

  • A station verifies against a signed trusted set and publishes that set, so a key nobody authorised is detectable. Detectable rather than prevented, and on a beacon revocation is eventual.
  • The longest a revoked authorisation can still work is 15 minutes, proved by a test that revokes and then steps a clock.
  • Both relay implementations build reproducibly, and a stranger can rebuild the published hash themselves. Nothing is signed yet, and no deployed hash has been compared against a build.

The source a station and a control node run

Try it

If there is an estate you cannot reach, read the source, then try it against one machine.

Open the console Read the source