← back to the download

What it can do, and what it can't.

Help Connect can run 15 commands and no others. 11 of them only look at things. Here is every one, in plain words, with what the person helping you learns from it.

Before a single command runs

You start it, nobody else. It is one file that does nothing until you open it. There is no installer, no background service, and nothing that starts it again tomorrow.
It asks, in writing, and waits. A full-screen warning names the exact server it is about to connect to and says plainly that the server will be able to run commands here. You have to type yes. Until then nothing has touched the network.
Two things about you are sent when you agree. Your computer's name and the account you are logged in as — that is how the helper tells your computer from everyone else's. Both are printed on the warning screen before you agree, so you can see exactly what they are. Note that a computer's name is often a person's name.
A log file is written as you go. Every command and its complete output is appended to a text file in your temporary folder, and the file is named on screen before anything runs. It is yours: it stays on your machine after the session, and it is the receipt if you ever want to check what happened.

The four things you control

  1. Closing the window ends everything Instantly, mid-command, no confirmation. The connection dies with the window and the helper is told the session is over. This is the panic button, and it works at any point.
  2. Every command is printed before it runs Not a summary afterwards — the command appears on screen first, then its result underneath. If something appears that you did not expect, you have the window open in front of you and step 1 is one keystroke away.
  3. The dangerous command is off 3 of the 15 commands need something extra before they will run, and the two that can run anything are refused outright unless the program was deliberately started with a switch the download does not use.
  4. Administrator rights are yours to refuse If the helper needs them, your own operating system asks you, in its own dialog. The program never sees your password. Saying no leaves the session running with fewer powers, which is a perfectly normal way to be helped.

What it cannot do at all

It cannot see your screen. There is no screen sharing and no screenshotting. Not switched off — not built.
It cannot move your mouse or type for you. Nothing in it touches input devices.
It cannot browse your files. None of the 15 commands opens, lists, reads or copies a document, a photo or an email. The two that could run something that does are the ones that are switched off.
It cannot see what you have been doing. No browsing history, no passwords, no keystrokes, no camera, no microphone.
It cannot outlive the window. Nothing is installed, no service is registered, nothing is added to startup. Close it and the only trace is the log file above, which is yours to read or delete.

The 3 that identify you

Most of these commands say nothing about you personally. These 3 do, and they are the ones worth knowing about before you agree: traceroute, get_network_config, get_public_ip. None of them is sinister — you cannot diagnose a broken connection without looking at the connection — but they are how the person helping you could work out roughly where you are and who your provider is.

Every command, one by one

look, do not touchreads something and changes nothing
changes somethingalters the computer's state
runs any commandthe escape hatch, off by default

get_system_info

look, do not touch runs once you agree facts about this computer

What kind of computer this is: which operating system, how much memory it has, and how long it has been switched on.

What they learn: The computer's name, which on a Mac or a Windows PC is usually the owner's own name, plus the operating system version, the processor, how much memory is fitted and how long the machine has been switched on. No files, no accounts, no browsing history.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

dns_resolve

look, do not touch runs once you agree tells them nothing about you

Look up which address a website's name points to, the way this computer would look it up on its own.

What they learn: Only the addresses for the one name the operator typed. It cannot show what you have been visiting: the machine is asked a single question about a single name, and it answers that.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

dns_query

look, do not touch runs once you agree tells them nothing about you

Look up one particular detail published about a website's name - where its email goes, for instance.

What they learn: Only the records for the one name the operator typed. Nothing about you, your machine or anywhere you have been.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

dns_flush

changes something runs once you agree tells them nothing about you

Make the computer forget the website addresses it looked up recently, so it asks again from scratch. A common fix when a site moved and this machine is still going to the old place.

What they learn: Nothing. It reports which flush command it ran and whether that worked. It empties a cache of recent name lookups rather than reading it.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

ping

look, do not touch runs once you agree tells them nothing about you

Check whether another computer on the internet answers, and how quickly.

What they learn: Round-trip times to the host the operator named, and how many packets came back. Nothing about the machine beyond the fact that it can reach that host.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

traceroute

look, do not touch runs once you agree identifies you or where you are

List every step a connection takes between this computer and another one, to find which step is failing.

What they learn: Every hop between this machine and the target, starting with your own router and continuing through your internet provider's network. That is enough to tell who your provider is and roughly what part of the country you are in.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

tcp_connect

look, do not touch runs once you agree tells them nothing about you

Knock on one service's door and see whether it opens - the honest test of whether this computer can reach it.

What they learn: Whether one port on one host the operator named accepted a connection, and how many milliseconds that took. Nothing is sent and nothing is read.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

web_fetch

look, do not touch runs once you agree facts about this computer

Open one web address from this computer and show what came back. Shows up the hotel wifi sign-in pages and company filters that only appear from where you are.

What they learn: The page the operator asked for, fetched as your machine. It carries no cookies and no browser profile, so it cannot reach anything you are signed in to. What it can reach is anything your machine can: a router's admin page, or a service running on the machine itself. So the answer can contain pages from your own network that the operator could not open from their side.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

http_head

look, do not touch runs once you agree facts about this computer

Ask a web address whether it is there and where it redirects, without downloading the page itself.

What they learn: The same as web_fetch with the page content left out: status, redirects and headers only. It reaches addresses only your machine can reach, and carries no cookies or browser profile.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

get_network_config

look, do not touch runs once you agree identifies you or where you are

List the ways this computer connects to a network - wifi, cable, VPN - with the settings each one is using.

What they learn: Every network adapter with its MAC address, which is a permanent hardware identifier for this machine, its local addresses, and the DNS servers the machine uses. A VPN or a work network usually shows up here by name.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

get_public_ip

look, do not touch runs once you agree identifies you or where you are

Find the address this computer appears as to the rest of the internet.

What they learn: The public address your internet connection is using. It identifies your household or office to your provider and places it in a city, and it names the provider. Anyone you connect to already sees this; the operator now sees it too.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

list_listening_ports

look, do not touch runs once you agree facts about this computer

List the programs on this computer that are waiting for something to connect to them, and answer 'is it even running?'.

What they learn: Which programs are waiting for network connections, with their names and process numbers, so it reveals part of what is installed and running. On macOS the listing also carries the user account each program belongs to. It shows no file contents and no documents.

What stops it: Nothing else stands in the way: you typed yes at the start, and you see it run.

run_shell

runs any command off unless switched on anything it can read

Run any command at all, whatever the helper types. This is the one with no limits, which is why it is switched off unless somebody deliberately turned it on.

What they learn: Whatever the command prints. It runs as your user account, so it can read any file that account can read, including documents and mail. This is why it stays shut unless the agent was deliberately started with --allow-shell, and why the command itself is printed on your screen before it runs.

What stops it: Refused unless the helper started the program with --allow-shell. The download does not do that.

request_privileged_access

changes something asks you again tells them nothing about you

Ask you, through your computer's own password box, for permission to do things a normal account cannot. You can say no and carry on.

What they learn: Nothing. The operating system asks for the password and checks it itself; the agent never sees it and never stores it. The operator learns only whether you agreed.

What stops it: Your computer's own administrator prompt appears and waits for you. Saying no ends it there.

run_shell_admin

runs any command needs both switches anything it can read

Run any command at all, with full administrator powers. The most dangerous thing here, and it needs two separate things to have gone your helper's way before it will work.

What they learn: Whatever the command prints, with administrator rights, which means any file on the machine including other people's accounts. It needs both --allow-shell and an administrator prompt you answered yes to.

What stops it: Refused unless --allow-shell was used and you already answered yes to an administrator prompt.

Checking any of this yourself

Don't take the page's word for it

This page is generated from the program's own command catalogue, so it cannot describe a command the program does not have, or miss one it does. If you want to check it against the machine in front of you:

⚠ None of this protects you if you were called out of the blue. A tool being safe and the person on the phone being honest are different questions. Only run this if you went looking for help from someone you already know.