piherder
Secure fleet management for Raspberry Pi clusters. Backups, patching, and Docker control with zero plaintext secrets.
Install / Use
claude mcp add bjorngluck -- npx -y github:bjorngluck/piherderIf the server publishes to npm under a different name, use that package instead — check the repo README.
MCP Server
Model Context Protocol server
Quality Score
Category
SecuritySupported Platforms
Our assessment of piherder
piherder scores 71/100 on our quality scale, 1061st of 1,127 Security skills we index.
Its MCP Server is 8.1 KB long, well organised into 9 sections and no code examples: a thorough specification that gives an agent plenty to work with.
It has 3 GitHub stars, so there is little community track record yet; judge it on its content.
Maintenance, license and trust
- The repository was last updated today, so piherder is actively maintained.
- It is released under the MIT license, a permissive license that allows use, modification and commercial use with attribution.
- Its trust signals score 92/100, with 1 caution from licensing, adoption, age or documentation. These come from repository metadata, not a code audit — read the skill file before letting an agent act on it.
piherder compared with similar skills
All 4 of these similar skills score higher than piherder; compare them before choosing.
| Skill | Score | Stars | Updated | Format |
|---|---|---|---|---|
| piherder (this skill)by bjorngluck | 71 | 3 | today | MCP Server |
| Agent-Reachby Panniantong | 100 | 101.2k | today | CLAUDE.md |
| headroomby headroomlabs-ai | 100 | 77.6k | 1d ago | CLAUDE.md |
| CowAgentby zhayujie | 100 | 47.5k | today | CLAUDE.md |
| Scraplingby D4Vinci | 100 | 89.3k | today | MCP Server |
Frequently asked questions
- How do I install piherder?
- Run
claude mcp add bjorngluck -- npx -y github:bjorngluck/piherder. The install tabs above show the steps for each supported agent. - Which AI agents does piherder work with?
- It is written for Claude Code and Claude Desktop, as a MCP Server file. Other agents that read the same format can often use it too.
- Is piherder safe to use?
- It is MIT-licensed and scores 92/100 on trust signals. Skills are instructions an agent will follow, so read the file before installing it and do not approve commands you do not understand.
- Is piherder still maintained?
- The repository was last updated today, so piherder is actively maintained.
Skill content
View source on GitHubPiHerder
Self-hosted control plane for the Pis and Linux boxes you already SSH into — backups, patching, Compose, and an audit trail. Secrets in the database are encrypted; the master key stays on your disk.
Why PiHerder?
After 30+ years as an engineer, senior cybersecurity leader, tinkerer, hacker, and 3D designer/builder, I got tired of brittle bash scripts and manual processes across my Raspberry Pi clusters and homelab.
PiHerder was born the same way many great tools are: scripts that automate the boring stuff so I could focus on building and securing systems. It replaces manual workflows with an auditable web UI. Fleet secrets in the database are Fernet-encrypted; PIHERDER_MASTER_KEY stays in your host .env.
Inspired by projects like Nginx Proxy Manager — simple, powerful, self-hosted tools that just make life easier.
Key Features
- SSH key management with encrypted private keys
- Backups, OS patching (apt), HAOS hosts via SSH +
haCLI check/apply, container patching with schedules - Docker Compose browser, multi-file editing, compose sets (multiple compose files under one project), inventory cache
- Service templates (deploy wizard, variables, preview/confirm)
- Integrations: Uptime Kuma, Grafana, Pi-hole (v6), Nginx Proxy Manager + cert management
- LAN Discovery (opt-in nmap worker, devices, schedules, Hosts map overlay)
- Network Maps (DNS fabric, logical/physical topology, service paths, runtime stack view groups)
- Reports: backup dest, OS patches, LAN live, Docker deploys, console sessions (PiHerder history — not Grafana). Pin / hide / reorder cards per browser
- PWA + Web Push notifications
- RBAC, 2FA (TOTP + passkeys), optional SSO/OIDC, audit trail, self-backup with full DR
- Optional in-browser web SSH console (off by default). Per host, Console mux can attach
tmuxorscreenso Hide keeps the shell on the Pi - Optional Host Files jailed SFTP explorer (off by default;
PIHERDER_HOST_FILES) - Move a service — compose project host→host as one job (on by default; set
PIHERDER_SERVICE_MIGRATE=falseto turn it off). Runs on the Celery worker. A failure after names flip can be undone. A finished Move has no Undo - Token REST API for automation (n8n, Home Assistant, etc.). Home Assistant observes the fleet with HACS piherder-ha (not inside this image). v1.8.0 pairs with plugin 0.4.4. v1.7.0 pairs with plugin 0.3.0. Current plugin is 0.5.2 (poll-only, card served from
/piherder/). It pairs with PiHerder v1.12.1 and needs Home Assistant 2024.7 or newer. Areadtoken is sensors and the card.jobsandeditadd confirm actions, including host reboot. Agents use hostedPOST /mcp, or the air-gapped piherder-mcp adapter 0.4.3 (prune_docker, the backup schedule fields,start_move,read_discovery,start_discovery, and the LAN Discovery device tools)
Quick Start
See the full Getting Started guide.
- Clone this repo or copy
.env.example→.env - Generate
PIHERDER_MASTER_KEY(critical) - (Recommended) Set hostname + trusted TLS certs for PWA/push
docker compose up -d(pulls multi-archbjorngluck/piherder:latest)- Register first admin user and start adding servers
Open Source & Contributing
PiHerder is now open source under the MIT license. Contributions, issues, feature ideas, and PRs are very welcome.
See CONTRIBUTING.md for details.
If you find PiHerder useful, consider sponsoring the project or buying me a coffee — it helps fund continued development and infrastructure.
Documentation
- Full docs & wiki: piherder-docs.hacknow.info
- Admin guide: docs/ADMIN.md
- Ecosystem roadmap: docs/ROADMAP_ECOSYSTEM.md
- Current release: docs/RELEASE_v1.12.1.md. Tag v1.12.1. certifi 2026.10.19. Package 1.12.1. Image
bjorngluck/piherder:1.12.1·1.12·latest. Pin1.12.0stays that patch. Pin1.11.1/1.11is the previous minor image. Pin1.10.1/1.10stays valid. Plugin 0.5.2. MCP adapter 0.4.3. Wiki: Backups · Self-backup · Agents (MCP) · Home Assistant. - Plan: docs/PLAN_v1.13.0.md. Not a train. Prior image notes: docs/RELEASE_v1.12.0.md. QA signed 2026-10-20.
- Prior: docs/RELEASE_v1.9.0.md · docs/RELEASE_v1.8.1.md · docs/RELEASE_v1.8.0.md. Sync rule: docs/RELEASE_SYNC.md.
- Prior: docs/RELEASE_v1.5.0.md · docs/RELEASE_v1.4.0.md · docs/RELEASE_v1.3.0.md · docs/RELEASE_v1.2.0.md · docs/RELEASE_v1.1.1.md · docs/RELEASE_v1.0.0.md · operator wiki LAN Discovery · HAOS hosts
- API reference: docs/API.md
Public demo (view-only)
Explore the UI before installing: https://piherder-demo.hacknow.info
Shared viewer login — current username and password are on the wiki / Public demo page. The fleet is synthetic; there is no path to your machines. Limits and notes live on that wiki page.
Tech Stack
FastAPI + SQLModel + PostgreSQL + Paramiko + cryptography (Fernet) + Jinja2 + compiled Tailwind + HTMX + Alpine + APScheduler + Celery.
Offline / air-gapped ready — Once built, the container has no external CDN dependencies. Tailwind utilities are compiled CSS (no Play / no eval).
License
MIT — see LICENSE.
Repository: github.com/bjorngluck/piherder
Related Skills
Agent-Reach
101.2kGive your AI agent eyes to see the entire internet. Read & search Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu — one CLI, zero API fees.
headroom
77.6kCompress tool outputs, logs, files, and RAG chunks before they reach the LLM. 20% fewer tokens for coding agents, 60-95% fewer tokens for JSON, same answers. Library, proxy, MCP server.
CowAgent
47.5kOpen-source personal AI assistant & Agent Harness. Plans tasks, runs tools and skills, self-evolves with memory and knowledge. Multi-agent, multi-model, multi-channel. Lightweight, extensible, one-line install.
Scrapling
89.3k🕷️ A Web Scraping framework that handles everything from a single request to a full-scale crawl! Don't be shy, join here: https://discord.gg/EMgGbDceNQ and follow here for daily tips and tricks: https://x.com/Scrapling_dev
Languages
Trust signals
From repository metadata: license, adoption, age and documentation. Not a code audit — see the Safety scan above for what the skill file itself contains.