Skip to content
Back to skills

Headroom

ASecurity

"Use Headroom to compress LLM context, run a local proxy, wrap

  • 247 stars
  • 0 votes
  • 2 copies
  • 12 views
  • Added September 8, 2026
developmenttypescriptpythonbashapibackend

Works with

  • cli
  • api
  • mcp

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 20 files and shows the line behind each finding

Scanned September 8, 2026

npx -y skills add VectorSpaceLab/AREX-Skill --skill headroom --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Headroom?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Headroom
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/vectorspacelab-headroom/badge)](https://www.skillsdirectory.com/skills/vectorspacelab-headroom)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: headroom
description: "Use Headroom to compress LLM context, run a local proxy, wrap
  coding agents, manage memory and MCP retrieval, and integrate the Python or
  TypeScript SDK."
disable-model-invocation: true
metadata:
  disco-role: operating
license: Apache 2.0
---

# Headroom repo skill

Use this skill when a task involves Headroom / `headroom-ai`: context compression, local proxy routing, coding-agent wrappers, MCP/CCR retrieval, persistent memory, savings analytics, or Python/TypeScript SDK integration.

## Start with the route

- **Install, update, deploy, diagnose, report, or run evals:** read `sub-skills/ops/SKILL.md`.
- **Start a proxy, route a provider, wrap/unwrap an agent, or debug base URLs:** read `sub-skills/proxy-wrap/SKILL.md`.
- **Use memory, MCP, CCR retrieval, `learn`, or Codex recovery:** read `sub-skills/memory/SKILL.md`.
- **Call `compress`, use `HeadroomClient`, `SharedContext`, images/relevance/spreadsheets, or the TypeScript SDK:** read `sub-skills/sdk/SKILL.md`.

For a broad task that crosses routes, read `references/workflow-map.md` first and then load the smallest combination of sub-skills.

## Install and inspect

The public distribution is `headroom-ai`; the Python import is `headroom` and the CLI is `headroom`. The npm package is also named `headroom-ai`, but it is the TypeScript SDK and does **not** provide the Python CLI.

Common CLI install:

```bash
uv tool install --python 3.13 "headroom-ai[proxy,memory]"
# or
pip install "headroom-ai[proxy,memory]"
```

Add optional extras only for the requested surface: `code`, `relevance`, `image`, `spreadsheet`, `html`, `reports`, `otel`, or `evals`. Read `references/configuration-and-extras.md` before choosing a broad extra set.

Minimal import/CLI check:

```bash
python -c "import headroom; print(headroom.__version__)"
headroom --version
python scripts/check_headroom_environment.py --check-cli
```

## Core operating facts

- Headroom is local-first: the proxy runs on the user's machine or an explicitly chosen deployment host.
- A running proxy does not prove that an agent is routed through it; use `headroom doctor`, `perf`, and `savings` to correlate liveness, routing, and traffic.
- CCR is reversible compression: compressed content can carry hashes that are retrieved through `headroom_retrieve` or the proxy retrieval endpoints.
- Keep user-owned config and state scoped. Canonical state roots are `~/.headroom/config` and `~/.headroom`, with environment overrides.
- Cloud backends, MCP registration, durable wrappers, persistent deployments, model downloads, and external LLM evals are side-effectful or credentialed; do not perform them as an unrequested smoke test.

## Shared references

- `references/api-reference.md` summarizes verified Python and TypeScript entry points.
- `references/cli-reference.md` maps the top-level CLI to the owning sub-skill.
- `references/configuration-and-extras.md` covers extras, env vars, paths, and optional backends.
- `references/workflow-map.md` routes cross-surface tasks.
- `references/troubleshooting.md` covers package-wide failures.
- `references/repo-provenance.md` records the source snapshot; read it before deciding whether a refresh is required.
- `references/repo-routing-metadata.json` is structured metadata for managed router import.

## Safety boundaries

- Do not import this repo skill for a task that only needs generic LLM compression without Headroom-specific APIs, commands, config, or behavior.
- Do not run `headroom wrap`, `headroom init`, `headroom deploy`, `headroom install apply/remove`, `headroom update`, `headroom mcp install`, or destructive memory commands without explicit user intent.
- Never put API keys, OAuth tokens, cloud profiles, private paths, or temporary inspection-environment details into generated code or user-facing examples.
- Prefer loopback health checks and `--help` before starting a proxy, changing user config, downloading model assets, or contacting a provider.

Files in this skill

  • SKILL.md3.9 KB
  • references/api-reference.md2.8 KB
  • references/cli-reference.md1.8 KB
  • references/configuration-and-extras.md3.4 KB
  • references/repo-provenance.md2 KB
  • references/repo-routing-metadata.json498 B
  • references/troubleshooting.md2.4 KB
  • references/workflow-map.md2 KB
  • scripts/check_headroom_environment.py3 KB
  • sub-skills/memory/SKILL.md2.9 KB
  • sub-skills/memory/references/api-reference.md9.3 KB
  • sub-skills/memory/references/cli-and-mcp-reference.md12.9 KB
  • sub-skills/memory/references/troubleshooting.md6.2 KB
  • sub-skills/memory/references/workflows.md8.6 KB
  • sub-skills/memory/scripts/memory_smoke.py9.9 KB
  • sub-skills/ops/SKILL.md3 KB
  • sub-skills/ops/references/cli-reference.md4.8 KB
  • sub-skills/ops/references/troubleshooting.md4.4 KB
  • sub-skills/ops/references/workflows.md3.5 KB
  • sub-skills/ops/scripts/diagnose_headroom_install.py5.2 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.