Heinzel skill
Heinzel turns an agent into a cautious sysadmin for servers over SSH, with every command explained and approved first.
- 104 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The agent runs commands on live servers as root or through sudo.
- An open SSH connection is usable by any process of your user for 10 minutes.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/heinzelDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent runs commands on live servers as root or through sudo.
- An open SSH connection is usable by any process of your user for 10 minutes.
This is third-party code. Review the repository files before installing.
What it does
Heinzel is a ruleset with four skills that turns an agent into a cautious system administrator. A person describes the job in plain language ("Install postgresql on server1.example.com"), and the agent detects the OS, picks commands, explains each one and waits for approval. Linux, FreeBSD, NetBSD, OpenBSD and macOS work, over SSH or on the local machine. The skills: `heinzel-housekeeping` reports on disk, memory, updates, firewall, certificates and failed services, `heinzel-security` audits SSH, firewall, accounts and open ports by severity, `heinzel-email` sends command output by mail, and `heinzel-macos-cleanup` finds leftovers of removed apps. Each server gets a memory folder with state, a changelog and a to-do list. Configs are copied to `/var/backups/heinzel/` before editing.
Who it is for. Admins and developers who look after their own servers or Macs and want to hand routine work to an agent while approving every command.
Good fit when
- A weekly server report is needed: disk, memory, updates, certificates, failed services.
- A server was set up long ago and SSH, firewall and open ports need a check.
- A service goes onto machines with different operating systems and commands are checked against platform rules.
- Work was interrupted and the next session resumes from the server's saved state.
- A Mac collects leftovers of removed apps in `~/Library`.
Not a fit when
- Changes must roll out to many servers in waves on a schedule; the commercial Heinzel Pro does that, while the free version goes server by server.
- The agent must run without approval of commands; confirmation is the core of the workflow.
- The workstation runs PowerShell or `cmd.exe`, which are unsupported; WSL or Git Bash is needed.
Example request
Check server web1.example.com: a report on disk, memory, updates and firewall, with no changes.Limitations
The agent works on live systems as root or through sudo, so each command must be read before approval. Hard blocking of dangerous operations (halt, `mkfs`, writes to `sshd_config` and `sudoers`) is done by a hook for Claude Code. OpenCode does not run the hook, and written rules remain the only safeguard. SSH needs a key without a passphrase. An open connection lives for 10 minutes, and the socket in `~/.cache/heinzel` is usable by any process of your user. The lock file `/etc/heinzel.conf` is a promise kept by Heinzel, not a security boundary.
How to disable. Delete the cloned `heinzel` folder. Config backups sit in `/var/backups/heinzel/` on the servers and are cleaned after 30 days. SSH sockets in `~/.cache/heinzel` close themselves 10 minutes after the last call.
FAQ
Which operations are blocked outright?
The `guard-taboos.sh` hook in Claude Code blocks halt, `mkfs`, partition-table and boot-loader writes, deleting SSH keys, writes to `sshd_config`, `sudoers` and account files, even under `--dangerously-skip-permissions`. OpenCode has no such hook.
Where is server memory kept?
In `memory/servers/<hostname>/`: state, a changelog and a to-do list. An interrupted job shows up as pending on the next connection.
How do I protect a server from changes?
Add the host to `memory/readonly.md` to inspect it only. Hosts in `memory/blacklist.md` are never contacted. An owner can write `allow_changes = false` to `/etc/heinzel.conf` on the machine itself.
What does rollback do when access is lost?
Before a change that can cut off login (address, route, firewall, VPN, PAM), the server arms a 120-second timer that restores the old state. A fresh SSH login stops the timer.
How does free Heinzel differ from Pro?
The free version is for one admin, one terminal and servers one after another. Heinzel Pro covers a team, a web interface, a fleet and schedules.
Discussion
No questions or reviews yet.
Related
SkillsA command-line SSH tool for agents: remote execution, file upload and download, and command allow and block lists.
An agent guides a macOS install on an ordinary Windows PC: it checks hardware, prepares a USB drive and keeps Windows.
A WebSSH console for VPS with an MCP server: the agent works across several servers while ACL tokens limit tools and hosts.
A Go CLI that compares a server with its last snapshot, reports only changes that matter and serves them to an agent via MCP
A skill that teaches an agent to split Zentty windows into panes, read neighboring sessions, search history and notify you
HomelabHero turns a fresh LXC into a homelab command center with Claude Code and a credential broker in one command.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Heinzel (this card) | no | 104 | |
| SSH Skill | no | 561 | gives server commands, file transfer and tunnels with a single JSON reply; Heinzel adds approval, per-server memory and rollback |
| cc-devops-skills | no | 339 | 31 skills with config generators and validators for Terraform, Helm, CI and Docker; Heinzel runs server administration with vetted commands |
README in short
The repository holds per-platform rules, a safety hook, the `bin/heinzel-backup` and `bin/heinzel-update` scripts and three YouTube screencasts. The German outlet heise.de has covered the tool.