High-risk tools in Yaver

Run a command on an Android device via ADB.

Start a dependency-aware agent graph. Pass allowed_devices to choose the Yaver mesh pool and allowed_runners to constrain which runners remote nodes may use. Custom nodes can re...

Stop a running agent graph.

Start a self-hosted analytics stack via Docker. Replaces PostHog Cloud ($0-450/mo), Mixpanel, Plausible.

Stop the analytics Docker stack.

Launch an installed package in Redroid and return visible UI text plus whether it appears installed.

Run Android lint checks.

Start a local auth server for development. Replaces Clerk ($25/mo), Auth0, WorkOS.

Stop the local auth server.

Start a yaver autoideas run on a local project. Long-lived loop that asks the AI for fresh single-PR-sized ideas every tick and appends them as `- [ ] <title>` lines to ideas.md...

Bootstrap a project init.md (cached project context for autonomous yaver runs). Drastically cuts the per-kick token + wall-clock cost of autoideas because runners read init.md i...

Start PocketBase backend (built-in DB + auth + storage + realtime).

Stop PocketBase backend.

Run Bandit Python security analysis.

Run project benchmarks. Auto-detects: go bench, cargo bench, npm bench.

Run Brakeman Ruby/Rails security scanner.

Execute JavaScript in the browser and return the result. Use for complex interactions, reading localStorage/cookies, or extracting data that CSS selectors can't reach.

Start a GENERIC human-in-the-loop co-browse: opens a headful browser with a persistent profile, navigates to a URL, and returns frame/input HTTP paths so a human can solve a cap...

Stop an interactive co-browse session. The on-disk profile (cookies/auth) persists so later automation can reuse it.

Navigate to a URL. Returns a screenshot of the page after navigation plus the page title. Use this as the first step after browser_open.

Wait for a CSS selector to become visible on the page. Use before clicking/typing elements that load dynamically.

Wait for the page URL to change (e.g., after a form submission or OAuth redirect).

Discover an Android-capable project in the repo, choose the correct builder for its stack (RN/Expo/Flutter/Kotlin), and start an AAB build.

Discover an iOS-capable project in the repo, choose the correct builder for its stack (RN/Expo/Flutter/Swift), and start an IPA build.

Run Rust benchmarks.

Build Rust project.

Clean Rust build artifacts.

Build Rust docs.

Start an agent-side terminal recording. Wraps the given command via the asciinema CLI. Only one recording at a time.

Stop the active terminal recording and save it to the cast index.

Deploy Cloudflare Worker.

Compile C/C++ with Clang.

Start a local screen recording on the agent's Mac or Linux box via ffmpeg. Returns the session id; call clip_stop to finalise.

Stop the active screen recording. Finalises the mp4 with a flushed moov atom.

Trigger a manual cloud backup.

Run AWS, GCP, or Azure CLI commands.

Deploy app to Yaver Cloud (managed Hetzner VPS). Provisions server, deploys Docker containers, sets up SSL/DNS/backups.

Start local cloud emulators. Provider: aws (MinIO/DynamoDB/ElasticMQ), azure (Azurite), gcp (Firebase Emulator Suite).

Stop local cloud emulators.

Change Yaver Cloud plan tier.

Build CMake project.

Start a headless CMS (Keystatic, Tina, Decap, or PocketBase).

Stop the CMS.

Run a deployment from the current `yaver code` target or from an explicitly selected repo/machine. Supports direct host deploys to TestFlight, Play internal testing, Convex, Clo...

Run a dev-loop action against the current `yaver code` target. Supported actions today: `status`, `reload`. Optional device_id targets another owned Yaver machine's code control...

Start a `yaver code --mesh` run: plan → implement → verify chat chain across the available machine pool. Thin wrapper over agent_graph_start with defaults matching the yaver cod...

Arm the companion manifest (yaver.companion.yaml) at repo: schedule HTTP crons on the in-process scheduler and start/instal durable workers as OS units. Idempotent. Reboot-durable.

Run a Convex action via admin HTTP API.

Deploy Convex functions.

Run a Convex mutation via admin HTTP API.

Run a Convex function.

Run cppcheck C/C++ static analysis.

Run database seed file.

List deploy history for a project.

Roll back to a prior deploy's commit.

Run a deploy: git pull → build → swap containers → healthcheck → auto-rollback on failure.

Start cloning a coding-focused Yaver dev environment. Reuses toolchain sync, repo clone, runner auth verification, and yaver code config.

Start Yaver re-auth on an owned remote machine through the existing /auth/recover path. auto picks the safest mode for the detected state: typically direct for auth-expired, pai...

Wait for remote Yaver auth recovery to complete. Preferred usage is recovery_id + wait_token from device_reauth_start; device_id-only fallback still probes machine health for ol...

Run the yaver self-check (binary paths, running procs, ports, auth state, workspace manifest, systemd unit, runtime deps). Returns the event list and final summary. Equivalent t...

Build a Docker image from Dockerfile.

Run docker compose actions (up, down, ps, logs, restart).

Execute a command inside a Docker container.

Restart a container.

Start a stopped container.

Stop a running container.

Start dynamic DNS updater (auto-update Cloudflare DNS when IP changes).

Launch an installed Android app whose package id contains the given substring, via its LAUNCHER intent (adb monkey). Returns the resolved package name.

Start an EAS Build (Expo).

Execute a shell command on this machine or an owned remote Yaver device and return the output. Commands are validated through the sandbox (dangerous patterns like rm -rf / are b...

Expose a local port to the internet. Replaces ngrok ($10/mo). Uses Cloudflare Quick Tunnel (free, zero config).

Stop a tunnel.

Deploy to Firebase (hosting, functions, etc.).

Build a Flutter app.

Run flutter doctor to check environment.

Deploy to Fly.io.

Personal Agent Gateway: perform an ACTION (write) as you on one of YOUR connectors — start a charge, buy a ticket, place an order, pay. By DEFAULT (execute omitted/false) this i...

Personal Agent Gateway: confirm + execute a previously previewed act (from gateway_act dry-run). The confirm call IS the second key: answer 'approve' to execute, anything else d...

Personal Agent Gateway: route a natural-language utterance to the right engine — a coding task (runner), a gateway READ (runs it, returns the answer), or a gateway ACT (returns ...

Compile C/C++ with GCC.

Run any `gh` (GitHub CLI) subcommand. Pass the args as a list (no leading `gh`). Pre-flights install + auth state, returns a clear error when the CLI is missing or unauthed. Use...

Start a GitHub or GitLab Device Flow (RFC 8628) authorization on the local machine or a remote owned peer. Returns a short user_code + verification_uri the user opens in any bro...

Trigger a GitHub Actions workflow_dispatch run.

Run any `glab` (GitLab CLI) subcommand. Same shape as gh_run. Use for MR/issue/CI/snippet/release ops not covered by gitlab_* tools.

Build Go project.

Run Go CPU profiling via test benchmarks or pprof URL.

Run Go heap profiling.

Run staticcheck.

Run gosec Go security analysis.

Run a Gradle build task.

Call a Home Assistant service — turn on/off lights, start vacuum, set thermostat, trigger scenes. Works with Xiaomi, Hue, IKEA, and all HA integrations.

Run heaptrack for heap allocation profiling (Linux).

Run a managed power action. Supports agent_shutdown and host_reboot. Requires confirm=true.

Start, stop, restart, or inspect a managed service. Scope can be dev (.yaver/services.yaml) or system (systemd/brew services).

Execute a command in a Kubernetes pod.

Invoke an AWS Lambda function.

Start local webhook listener for Lemon Squeezy events.

Stop the Lemon Squeezy webhook listener.

Run linter on the project. Auto-detects: go vet, eslint, ruff/flake8, clippy.

Run lizard code complexity analysis (supports 20+ languages).

Start local SMTP catch-all server (mailpit). Replaces Resend ($10-30/mo), Mailtrap. Catches all outgoing email for testing.

Stop the local mail server.

Draft a reply to a message. Pulls the thread + recent sent-folder mail for tone, then pipes through the configured AI runner when execute=true and returns the draft text. Otherw...

Run make clean.

Run a Make target.

Run Yaver quality checks for the project on this Yaver CPU (tests/lint/typecheck/format when detected). Presents as quality checks for normies, not raw CI.

Agent-friendly doctor for the common React Native / Expo phone reload path. Resolves the mobile project inside a monorepo, checks local tools, dependency install state, Hermes c...

Trigger a Hermes hot-reload of the React Native / Expo app currently under test. Thin wrapper over POST /dev/reload — computes a native-fingerprint delta against the dev-server ...

Build/verify/upload Yaver platform-specific mobile surfaces. target=tv runs Android TV + tvOS, android-tv verifies leanback metadata and uploads the shared Play AAB, tvos archiv...

Start the project's dev server if needed and build the Hermes bundle that Yaver loads on the phone. Works locally or on an owned remote Yaver device. This is the MCP path for a ...

Start recording mode — capture real API responses as mock routes.

Start an API mock server.

Stop the mock server.

Quick inference with a local model.

Start Ollama server if not running.

Return the most recent morning match-report — what shipped overnight from an autodev run. One line per task: title, status (shipped/failed/rolled-back), files changed, commit sh...

Build or install a native iOS, Android, or Flutter app. Yaver discovers matching mobile projects under work_dir (including mobile/, app/, apps/*, packages/*). If more than one c...

Run an npm script (or list all scripts).

Run a Lighthouse audit on a URL. Returns performance, accessibility, best practices, SEO scores and Core Web Vitals.

Run a load test on a URL. Returns RPS, latency percentiles, error rate.

High-level runtime deploy for a phone sandbox. Can connect provider accounts, promote to Convex Cloud or Cloudflare Workers, push to Yaver Cloud or a custom/self-hosted Yaver ta...

Compile pip requirements.

Run a local CI/CD pipeline from GitHub Actions or GitLab CI YAML. Executes on the dev machine — no cloud runner needed. Hardware-aware, supports matrix builds, Docker services, ...

Cancel a running pipeline.

Deploy an app to Yaver Platform.

Create a preview deploy from a branch.

Set up GitHub/GitLab push-to-deploy webhook.

Stop a preview environment.

Stop all preview environments.

Stop serving the active preview/dev server, regardless of whether it is Expo Web, Vite, Next.js, Flutter Web, or another active preview surface.

Fetch the repo's agent-guidance files (CLAUDE.md, AGENTS.md, AI_ARCH.md, REMOTE_WORKER.md) plus the project's init.md. Every result is prefixed with a stale-docs warning. Use th...

One-shot fullstack project scaffold. Skips the interactive wizard and creates a self-hosted-first monorepo (apps/{web,landing,mobile}, packages/shared, backend/) at parentDir/<s...

Start a new fullstack project wizard session. Returns sessionId + first question. Call project_wizard_answer repeatedly, then project_wizard_generate.

Start local reverse proxy (Caddy) with HTTPS for local development.

Stop the local reverse proxy.

Create PlanetScale deploy request.

Run Python tests with pytest.

Deploy to Railway.

Trigger a Raycast extension (macOS).

Start capturing a video for the morning reel. Picks the best-available driver for the requested target, falling back to full-screen capture if the specific target (ios-sim/andro...

Finalize the recording started for (run_id, task_id). Returns duration_ms + size_bytes. After this the video is served at /recordings/{run_id}/{task_id}/video.mp4 with byte-rang...

Start auth recovery against an explicit remote Yaver base URL when the caller is not signed into Yaver locally. Requires either bootstrap_secret or bearer_token. direct/device-c...

Poll a previously-started explicit-target recovery session until it completes, fails, or times out. Requires target_url plus the recovery_id/wait_token returned by recovery_targ...

Execute a command on a remote machine.

Fire a routine immediately, out of band. Does not reset its cron cadence — useful for testing the verb invocation without waiting.

Run Ruff (check, format, or fix).

Run an Apple Shortcut (macOS only).

Run the project's test suite. Auto-detects framework (go test, jest, vitest, pytest, cargo test, make test) or accepts a custom command.

Start the interactive browser/device-auth login flow for Claude Code or Codex on the local or a remote Yaver machine.

Add Redis caching layer.

Add CDN in front of your app (Cloudflare or Bunny).

Analyze resource usage and generate scaling recommendations.

Run automatic performance optimizations (compression, caching, DB tuning).

Preview what upgrading/downgrading a plan would change.

Return the local screenlog audit trail (start/stop/deny/policy events with caller remoteness + peer id). Lets the recorded machine's owner see who started recording and when.

Get or set the reboot-durable 'keep recording' intent. With set=true + enabled, the agent auto-resumes screenlog on every start — local, auth/internet-independent — so a reboote...

Report whether local screen-frame capture works on this host and which driver is used (macOS screencapture / Linux scrot-or-gnome / Windows PowerShell / WSL→Windows interop). Ru...

Start a LOCAL-ONLY screen-frame recording (the talos PC-monitor 'screen as images', local-only). Periodically screenshots every display, perceptually de-duplicates near-identica...

Stop the active screenlog recording. Returns the session id, kept-frame count, and local viewUrl.

Run Semgrep multi-language static analysis.

Run a full SEO audit on the site (meta tags, headings, images, sitemap, schema, speed).

Start, stop, restart, enable, or disable a system service.

Start all or specific local development services (Postgres, Redis, MinIO, etc.) from .yaver/services.yaml.

Stop all or specific local development services.

Run ShellCheck on shell scripts.

Build the static site.

Deploy the site to Yaver Platform.

Run SonarQube/SonarCloud scanner.

Stop a running task.

Start local S3-compatible storage (MinIO).

Stop local MinIO storage.

Start Stripe webhook listener for local development. Forwards webhooks to localhost.

Stop the Stripe webhook listener.

Trigger a test Stripe webhook event.

Execute SQL on Supabase database.

Deploy Supabase (db push or function deploy).

Manage systemd services (status, start, stop, restart, enable, disable, list, failed, timers).

Read the most recent failed run from local history. Returns the spec name, the failing step, the screenshot path, and the error — exactly what an AI agent needs to propose a patch.

Run the yaver-test-sdk specs end-to-end on the dev's machine via the embedded chromedp runner. Returns suite results inline. Use this to drive a 'fix → test → fix' loop without ...

Run Valgrind callgrind for call graph profiling.

Run Valgrind massif for heap profiling.

Run Valgrind memcheck for memory leak detection.

Start a vibe-preview session: headless Chrome captures the dev server URL at adaptive FPS. The mobile app + web dashboard see the same SSE stream you do. Returns the session met...

Stop a vibe-preview session by project. Idempotent.

Trigger a hot reload on the active web dev server.

Start a web dev server (Next.js, Vite, Flutter Web, Expo Web) for a named workspace app. Returns the iframe URL to embed.

Stop serving the active web preview.

Build an Xcode project.

Connect an ADDITIONAL OAuth provider to the currently signed-in account — e.g., user signed up with Apple but wants to also sign in with GitHub, GitLab, Google, or Microsoft. Re...

Poll the account's linked identities until the requested provider appears (or timeout). Preferred over manual polling after yaver_auth_link_start. Default timeout 120s.

Start a headless device-code sign-in for Yaver (Apple / GitHub / Google / Microsoft OAuth). Returns {url, user_code, device_code, qr_ascii, expires_at_ms}. Render the URL + QR t...

Block until the device code is authorized, expires, or the timeout fires. Preferred over yaver_auth_poll for coding agents that can accept a ~2-minute tool call. On authorized: ...

Run a comprehensive system health check — auth, agent, runners, relay servers, tunnels, network, tmux sessions. Like 'yaver doctor' on the CLI.

Drive the first-run onboarding flow for a fresh Yaver install. Returns the ordered checklist of steps the user still needs to complete (auth, bootstrap secret, tunnel, runner, e...

High-level guided MCP flow for setting up Yaver on the user's own machine/VPS. Returns normie-friendly next steps for auth, serve, phone pairing, repo selection, runner setup, G...