High-risk tools in Yaver

Connect to another MCP server (local or remote).

Call a tool on a connected MCP peer.

Run a command on an Android device via ADB.

Install a selected Android app APK into Redroid. Arbitrary Play Store restore is intentionally not faked; provide apk_path or install manually.

Launch an installed package in Redroid and return visible UI text plus whether it appears installed.

Launch/query a package in Redroid and report whether visible UI contains query text, plus a needsUser hint for login/OTP handoff screens.

Run Android lint checks.

Extract a zip or tar.gz archive.

Start a local auth server for development. Replaces Clerk ($25/mo), Auth0, WorkOS.

Stop the local auth server.

Generate or inspect JWT tokens for API testing.

Test an OAuth flow end-to-end.

Start PocketBase backend (built-in DB + auth + storage + realtime).

Stop PocketBase backend.

Run project benchmarks. Auto-detects: go bench, cargo bench, npm bench.

Click an element by CSS selector. Returns a screenshot after clicking. Wait for any animations/navigation to settle.

Close a browser session and release the Chrome process.

Execute JavaScript in the browser and return the result. Use for complex interactions, reading localStorage/cookies, or extracting data that CSS selectors can't reach.

Start a GENERIC human-in-the-loop co-browse: opens a headful browser with a persistent profile, navigates to a URL, and returns frame/input HTTP paths so a human can solve a cap...

Stop an interactive co-browse session. The on-disk profile (cookies/auth) persists so later automation can reuse it.

Navigate to a URL. Returns a screenshot of the page after navigation plus the page title. Use this as the first step after browser_open.

Open a new Chrome browser session on the dev machine. Returns a session_id to use in subsequent browser_* calls. Sessions persist across tool calls — cookies, auth state, and cu...

Scroll the page by pixel offsets. Returns a screenshot after scrolling.

Select a value in a <select> dropdown by CSS selector. Returns a screenshot after selection.

Type text into an input field by CSS selector. Returns a screenshot after typing. Set clear=true to clear existing text first.

Wait for a CSS selector to become visible on the page. Use before clicking/typing elements that load dynamically.

Wait for the page URL to change (e.g., after a form submission or OAuth redirect).

Discover an Android-capable project in the repo, choose the correct builder for its stack (RN/Expo/Flutter/Kotlin), and start an AAB build.

Discover an iOS-capable project in the repo, choose the correct builder for its stack (RN/Expo/Flutter/Swift), and start an IPA build.

Evaluate a math expression.

Query Cloudflare D1 database.

Run all pre-deployment checks (typecheck, lint, format, tests, build, bundle size, security audit, env vars, git clean).

Run a single pre-deployment check.

Trigger a manual cloud backup.

Run AWS, GCP, or Azure CLI commands.

Deploy app to Yaver Cloud (managed Hetzner VPS). Provisions server, deploys Docker containers, sets up SSL/DNS/backups.

Start local cloud emulators. Provider: aws (MinIO/DynamoDB/ElasticMQ), azure (Azurite), gcp (Firebase Emulator Suite).

Stop local cloud emulators.

Rebuild and redeploy from latest code.

Arm the companion manifest (yaver.companion.yaml) at repo: schedule HTTP crons on the in-process scheduler and start/instal durable workers as OS units. Idempotent. Reboot-durable.

Continue a stopped or running task with additional input/instructions. Pass device_id to inject the follow-up into a task running on another device's daemon.

Run a Convex action via admin HTTP API.

Deploy Convex functions.

Run a Convex mutation via admin HTTP API.

Run a Convex query via admin HTTP API (no CLI).

Run a Convex function.

Generate a code completion via the dev's local Ollama model. Supports fill-in-the-middle via prefix+suffix for Qwen2.5-Coder / StarCoder / DeepSeek. Replaces GitHub Copilot / Cu...

Run a query (SQL for Postgres/Supabase/SQLite, function path for Convex, REST path for PocketBase/Appwrite).

Run pending database migrations. Auto-detects ORM (Drizzle, Prisma, Goose, Alembic).

Execute a database query via CLI (sqlite3, psql, mysql, redis-cli). For adapter-routed queries use data_query.

Run database seed file.

Open database GUI (Drizzle Studio or Prisma Studio).

Start cloning a coding-focused Yaver dev environment. Reuses toolchain sync, repo clone, runner auth verification, and yaver code config.

Push a BlackBox command directly to a paired SDK device (or broadcast to all) without needing an active dev-server. This is the Path-C/8 fallback for the cross-device reload wor...

Start Yaver re-auth on an owned remote machine through the existing /auth/recover path. auto picks the safest mode for the detected state: typically direct for auth-expired, pai...

Wait for remote Yaver auth recovery to complete. Preferred usage is recovery_id + wait_token from device_reauth_start; device_id-only fallback still probes machine health for ol...

Run the yaver self-check (binary paths, running procs, ports, auth state, workspace manifest, systemd unit, runtime deps). Returns the event list and final summary. Equivalent t...

Build a Docker image from Dockerfile.

Run docker compose actions (up, down, ps, logs, restart).

Execute a command inside a Docker container.

Pull a Docker image.

Push a Docker image to registry.

Restart a container.

Start a stopped container.

Stop a running container.

Start dynamic DNS updater (auto-update Cloudflare DNS when IP changes).

Full domain setup wizard — detects IP type, guides DNS, configures SSL.

Run drizzle-kit generate.

Run drizzle-kit push.

Relay a single input event to the Android device via adb: tap (x,y), text (types a string), key (keyevent keycode, e.g. 66=ENTER/67=DEL/4=BACK), or swipe (x1,y1→x2,y2 over dur m...

Launch an installed Android app whose package id contains the given substring, via its LAUNCHER intent (adb monkey). Returns the resolved package name.

Start an EAS Build (Expo).

Submit to App Store / Play Store via EAS.

ESLint check (with optional --fix).

Execute a shell command on this machine or an owned remote Yaver device and return the output. Commands are validated through the sandbox (dangerous patterns like rm -rf / are b...

Expose a local port to the internet. Replaces ngrok ($10/mo). Uses Cloudflare Quick Tunnel (free, zero config).

Stop a tunnel.

Build a Flutter app.

Run flutter doctor to check environment.

Run Flutter tests.

Run any `gh` (GitHub CLI) subcommand. Pass the args as a list (no leading `gh`). Pre-flights install + auth state, blocks credential-printing subcommands, and requires confirm:t...

Trigger a GitHub Actions workflow_dispatch run.

Run any `glab` (GitLab CLI) subcommand. Same shape as gh_run. Blocks credential-printing subcommands and requires confirm:true for destructive commands such as `repo delete` or ...

Build Go project.

Run Go generate.

Run Go CPU profiling via test benchmarks or pprof URL.

Run Go heap profiling.

Run staticcheck.

Run Go tests.

Run Go vet.

Run a Gradle build task.

Run Android unit tests.

Make an HTTP request (like curl). Returns status code and response body.

Run a managed power action. ALWAYS call action=report first: it is a read-only dry run that says which power actions this machine can actually perform, what each would really do...

Start, stop, restart, or inspect a managed service. Scope can be dev (.yaver/services.yaml) or system (systemd/brew services).

Enqueue a new background job. Handlers are registered at agent boot; common ones: newsletter.send, form.notify, pdf.render.

Requeue a DLQ job.

Query/transform JSON with jq expressions.

Run linter on the project. Auto-detects: go vet, eslint, ruff/flake8, clippy.

Deterministically repair an owned machine. restart_agent asks this connected watchdog agent to use Yaver's backup SSH/mesh channel to restart the target's Yaver agent, then call...

Run make clean.

Run a Make target.

Execute a migration plan (all steps or a specific step).

Run smoke tests after migration to verify everything works.

One-shot "put my app on my phone": take the React Native / Expo app in this directory and get it running inside the Yaver app on the paired phone — no TestFlight, no Xcode, no n...

Agent-friendly doctor for the common React Native / Expo phone reload path. Resolves the mobile project inside a monorepo, checks local tools, dependency install state, Hermes c...

Trigger a Hermes hot-reload of the React Native / Expo app currently under test. Thin wrapper over POST /dev/reload — computes a native-fingerprint delta against the dev-server ...

Start the project's dev server if needed and build the Hermes bundle that Yaver loads on the phone. Works locally or on an owned remote Yaver device. This is the MCP path for a ...

Prepare a fresh React Native / Expo clone on this machine or an owned remote Yaver device by auto-installing project dependencies when the machine has the right package manager ...

Quick inference with a local model.

Start Ollama server if not running.

Build or install a native iOS, Android, or Flutter app. Yaver discovers matching mobile projects under work_dir (including mobile/, app/, apps/*, packages/*). If more than one c...

Run an npm script (or list all scripts).

Open a URL in the default browser.

Run one verb on one machine. Single API for every Yaver capability (info, run, build, test, deploy, push, reload, logs, status, env, session, scale, provision, destroy, ...). Di...

Plan (and optionally run) a switch-engine migration from a phone project to any of the 19 switch targets (sqlite-local, sqlite-turso, postgres-local, postgres-neon, supabase-clo...

High-level runtime deploy for a phone sandbox. Can connect provider accounts, promote to Convex Cloud or Cloudflare Workers, push to Yaver Cloud or a custom/self-hosted Yaver ta...

Ping a host.

Install a package via any package manager (npm, pip, cargo, go, brew, gem, apt, dart).

Run pod install.

Scan common ports on a host (pure Go, no nmap needed).

Create a branch preview environment (git worktree + build + serve).

Stop a preview environment.

Stop all preview environments.

Stop serving the active preview/dev server, regardless of whether it is Expo Web, Vite, Next.js, Flutter Web, or another active preview surface.

Run prisma generate.

Run prisma db push.

One-shot fullstack project scaffold. Skips the interactive wizard and creates a self-hosted-first monorepo (apps/{web,landing,mobile}, packages/shared, backend/) at parentDir/<s...

Start local reverse proxy (Caddy) with HTTPS for local development.

Stop the local reverse proxy.

Alias of publish_run for CI-oriented clients. Use allow_github_fallback=true when you want GitHub dispatch as the fallback path after Yaver/local execution fails.

Run a publish target from .yaver/publish.yaml. Local/self-hosted execution is primary; GitHub fallback is used only when allowed and requested.

Alias of publish_run. Uses Yaver's uploader/register flow first, then the local submitter, then GitHub fallback only when allowed.

Discover an Android-capable project, build an AAB with the correct stack-specific builder, wait for completion, then upload it to Google Play internal testing.

Discover an iOS-capable project, build an IPA with the correct stack-specific builder, wait for completion, then upload it to TestFlight.

Run Python tests with pytest.

Test a regex pattern against input text.

One-shot remote/self-hosted dev setup: clone or update a repo on an owned Yaver device, set that repo as the target's yaver-code workdir, optionally install mobile dependencies,...

Execute a command on a remote machine.

Spin up a new VPS from phone. Supports Hetzner and DigitalOcean.

First-time setup of a remote dev machine (installs Docker, Node.js, Git, Yaver agent).

Run an Apple Shortcut (macOS only).

Run the project's test suite. Auto-detects framework (go test, jest, vitest, pytest, cargo test, make test) or accepts a custom command.

Attach to a live runner tmux session — flip it into user-driven mode so the keeper does NOT nudge while you're vibing.

Cancel a running runner browser-auth session on the local or a remote machine.

Start the interactive plan-OAuth browser/device-auth login flow for Claude Code or Codex on the local or a remote Yaver machine. Uses the user's Claude Pro/Max or ChatGPT Plus/P...

Deliver a localhost OAuth callback URL (http://localhost:<port>/callback?...) into a running runner browser-auth session on the local or a remote machine. Use when the user fini...

Submit a copied authentication code/token back into a running runner browser-auth session.

High-level runner bootstrap for a local or remote Yaver machine: install the runner if missing, report whether subscription OAuth is still pending, and register Yaver as an MCP ...

Force a session's keeper mode to on|off explicitly (bypasses attach/detach).

Detach the terminal AND flip the session into autorun mode (default). Pass autorun=false to leave the session dormant.

Probe which models the installed runner's LOGIN can actually run, by attempting a real generation for each. Use this instead of assuming from a model id — a subscription login r...

Enqueue a prompt for a named runner session. The keeper drains the queue one prompt at a time when the pane goes idle.

One-step containerization setup for Yaver. Picks a practical default, persists it, and optionally starts building the yaver-sandbox image so remote-dev and shared-infra tasks ca...

Run the Mobile Sandbox edit loop from a headless MCP client. Ships a phone-style React Native / Expo source tree to this machine or an owned remote Yaver device, runs OpenCode w...

Schedule a CONTINUATION of your own work to run later — the way to handle recurring or deferred tasks instead of looping in-process or busy-waiting. Pick exactly one cadence: `w...

Schedule a task to run at a specific time or on a recurring basis. Supports one-shot (runAt), interval-based (repeatInterval in minutes), and cron expressions.

Click a CSS selector in a Selenium session.

Close a Selenium/WebDriver session and release Chrome/ChromeDriver.

Navigate an existing Selenium session to a URL.

Open a search-results page in Selenium. Default provider is Google; also supports Bing and DuckDuckGo. This is normal browser navigation, not scraping or CAPTCHA bypass.

Start a first-class Selenium/WebDriver Chrome session on this runtime host. Use for daily browser tasks that should explicitly go through WebDriver instead of CDP. Does not bypa...

Type text into a CSS selector in a Selenium session.

Start, stop, restart, enable, or disable a system service.

Start all or specific local development services (Postgres, Redis, MinIO, etc.) from .yaver/services.yaml.

Stop all or specific local development services.

Transfer an AI agent session from THIS machine to another device in one step. The session (conversation history, agent state, optionally workspace) is packaged, sent to the targ...

Change the agent's working directory for task execution.

Boot an iOS simulator.

Provision a Let's Encrypt certificate for a domain via the installed `certbot` (http-01 challenge, standalone mode). Used on self-hosted yaver boxes that terminate TLS themselve...

Stop a running task.

Start local S3-compatible storage (MinIO).

Stop local MinIO storage.

Start a Redroid-backed Google Play permission-justification video job. Defaults to a narrative proof: start real work, show it running, background the app, show completion notif...

Execute SQL on Supabase database.

Deploy Supabase (db push or function deploy).

Open a TeamViewer-style remote-support window on this machine. Returns a 6-char code, a scoped bearer token, and shareable URLs. A guest who redeems the code gets terminal / exe...

Execute a previously-planned switch. HARD switches emit a rewrite prompt for the AI agent instead of running inline.

Manage systemd services (status, start, stop, restart, enable, disable, list, failed, timers).

Run the yaver-test-sdk specs end-to-end on the dev's machine via the embedded chromedp runner. Returns suite results inline. Use this to drive a 'fix → test → fix' loop without ...

Given a CSS selector that no longer matches and a DOM HTML snapshot, ask the user's vision/text LLM to propose a new selector. Returns the suggested replacement plus the model's...

TypeScript type checking.

Run type checker. Auto-detects: tsc, go build, mypy/pyright.

Record a short MP4 demo clip from a booted simulator/emulator while the running app is exercised by Maestro (Phase 7). source: 'sim-ios' uses xcrun simctl, 'sim-android' uses ad...

Start a vibe-preview session: headless Chrome captures the dev server URL at adaptive FPS. The mobile app + web dashboard see the same SSE stream you do. Returns the session met...

Stop a vibe-preview session by project. Idempotent.

Trigger a hot reload on the active web dev server.

Start a web dev server (Next.js, Vite, Flutter Web, Expo Web) for a named workspace app. Returns the iframe URL to embed.

Stop serving the active web preview.

Build a self-contained native binary (xcodebuild Release / gradle installRelease) and install it on a USB-attached phone via the agent's host machine. No Metro / dev server is i...

Reconnect a previously-paired Android phone over WiFi. Use this when wireless_detect shows the phone as visible-unpaired but it was paired in a past session (e.g. after a phone ...

Manual one-shot Android wireless pair when you already know the pair host:port (e.g. user typed it from the phone screen). Prefer wireless_setup_android when you don't have the ...

Build a self-contained native binary (xcodebuild Release / gradle installRelease) and install it on a WIFI-paired phone via the agent's host machine. Same long-running build pip...

First-time Android wireless pairing for AI agents. Prerequisite: the user has tapped 'Pair device with pairing code' on the phone (Settings → Developer options → Wireless debugg...

Wire every app declared in yaver.workspace.yaml: scaffold init.md, env-check, per-app setup. Call workspace_scaffold first if no manifest exists. Idempotent — re-runs skip alrea...

Build an Xcode project.

Run Xcode tests.

Run one poll of the device-code authorization. Returns status = pending | authorized | expired. On authorized, the token is saved to ~/.yaver/config.json, the daemon is started ...

Start a headless device-code sign-in for Yaver (Apple / GitHub / Google / Microsoft OAuth, passkey, or email-password if enabled on the deployment). Returns {url, user_code, dev...

Block until the device code is authorized, expires, or the timeout fires. Preferred over yaver_auth_poll for coding agents that can accept a ~2-minute tool call. On authorized: ...

Run a comprehensive system health check — auth, agent, runners, relay servers, tunnels, network, tmux sessions. Like 'yaver doctor' on the CLI.

One-shot install + auth + mobile-app handoff for a non-developer user being walked through setup by an AI agent. Call this FIRST instead of wiring up auth_status/start/wait manu...

High-level guided MCP flow for setting up Yaver on the user's own machine/VPS. Returns normie-friendly next steps for auth, serve, phone pairing, repo selection, runner setup, G...