# mobile_deploy_to_phone One-shot "put my app on my phone": take the React Native / Expo app in this directory and get it running inside the Yaver app on the paired phone — no TestFlight, no Xcode, no native install. Chains the whole Hermes flow in order: checks the project (mobile_project_status), installs dependencies if missing (mobile_project_prepare), diagnoses blockers and native-module compatibility (mobile_hermes_doctor), compiles the Hermes bundle (mobile_project_build), and reloads it onto the phone (mobile_hermes_reload). Stops at the first blocker and returns a single next_action sentence plus a per-step trace. This is the verb to call when a human says "deploy/preview my app on my phone" — prefer it over calling the five mobile_* tools by hand. The phone must have the Yaver app open and signed in with the same account. Returns { ok, done, steps[], blockers?, next_actions?, next_action }. Agent View of the PolicyLayer registry record for `mobile_deploy_to_phone`. HTML page: https://policylayer.com/tools/io-github-kivanccakmak-yaver/mobile-deploy-to-phone ## Facts - Tool: `mobile_deploy_to_phone` - Server: Yaver (`yaver-cli`) — https://policylayer.com/tools/io-github-kivanccakmak-yaver.md - Install: `npx -y yaver-cli` - Homepage: https://github.com/kivanccakmak/yaver.io - Risk category: Execute (High risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 6 - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `mode` | string | no | Reload mode passed to the final step: "dev" (Metro fast-refresh, default) or "bundle". | | `platform` | string | no | Target platform for the Hermes bundle: "ios" (default) or "android". | | `device_id` | string | no | Optional owned Yaver device id/name/alias to build on. Empty = this machine (the common case: agent, project, and daemon all local). | | `directory` | string | no | Project directory (default: agent work dir). Should be a React Native / Expo app or a monorepo containing one (apps/mobile, mobile/, …). | | `framework` | string | no | Optional framework override (expo or react-native); auto-detected when omitted. | | `plan_only` | boolean | no | When true, run only the fast checks (status/prepare/doctor) and return the ordered remaining steps instead of running the slow build + reload. Use when your too | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "mobile_deploy_to_phone", "arguments": {} } } ``` ## Why mobile_deploy_to_phone is rated High This tool executes a multi-stage deployment pipeline including dependency installation, compilation, and deployment to a physical device. While primarily intended for legitimate development use, misuse could compile and deploy malicious code to a paired mobile device. The blast radius depends on app contents and phone permissions. From the tool's own definition: "Tool 'mobile_deploy_to_phone' performs code compilation and deployment via 'Chains the whole Hermes flow': checks project, installs dependencies, diagnoses blockers, compiles Hermes bundle, and reloads onto the phone." Risk signals: Accepts file system path (directory) ## Use case AI agents invoke mobile_deploy_to_phone to trigger actions in Yaver. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Yaver: ```json { "version": "1", "default": "deny", "tools": { "mobile_deploy_to_phone": { "limits": [ { "counter": "mobile_deploy_to_phone_rate", "window": "minute", "max": 10, "scope": "grant" } ] } } } ``` ## Other tools on Yaver (644) - `acl_remove_peer` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/acl-remove-peer.md - `cancel_schedule` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/cancel-schedule.md - `cloud_destroy` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/cloud-destroy.md - `companion_down` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/companion-down.md - `data_delete` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/data-delete.md - `db_push` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/db-push.md - `db_reset` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/db-reset.md - `db_restore` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/db-restore.md - `dns_flush` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/dns-flush.md - `dns_remove` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/dns-remove.md - `docker_prune` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/docker-prune.md - `docker_rm` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/docker-rm.md - `docker_rmi` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/docker-rmi.md - `feedback_delete` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/feedback-delete.md - `forgot_password` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/forgot-password.md - `git_member_remove` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/git-member-remove.md - `git_stash` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/git-stash.md - `guest_delete` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/guest-delete.md - `guest_revoke` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/guest-revoke.md - `jobs_cancel` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/jobs-cancel.md - `machine_onboarding_remove` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/machine-onboarding-remove.md - `machine_remove` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/machine-remove.md - `migrate_rollback` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/migrate-rollback.md - `models_remove` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/models-remove.md - `monitor_remove` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/monitor-remove.md - `phone_project_delete` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/phone-project-delete.md - `proxy_remove` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/proxy-remove.md - `relay_clear_password` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/relay-clear-password.md - `release_rollback` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/release-rollback.md - `remote_destroy` — Destructive — https://policylayer.com/tools/io-github-kivanccakmak-yaver/remote-destroy.md - …and 614 more: https://policylayer.com/tools/io-github-kivanccakmak-yaver.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-kivanccakmak-yaver · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-kivanccakmak-yaver