# yeet

> Yeet is a programmable kernel runtime for Linux. A single daemon (`yeetd`) that turns any machine into a programmable, queryable node — enabling developers and AI agents to build bespoke infrastructure tools using JavaScript, with visibility down to the kernel. No code changes. No logs. No vendor storage. No data leaving your systems.

## What Yeet Is

Yeet is the first platform where AI agents can read live infrastructure at the kernel level. Install the daemon, and the host exposes a typed, structured, streaming data layer — the system graph — that any developer or AI agent can query, subscribe to, and act on in real time.

The mission: make eBPF accessible to every developer. When people who barely know what a kernel is are using it to solve their problems, that mission is coming to fruition.

## Core Architecture

Yeet combines three technologies in a single daemon:

- **SysGraph (GraphQL):** A live, typed, queryable graph of the entire system — processes, threads, containers, GPUs, network sockets, file descriptors, hardware sensors — all interconnected and queryable in real time. The schema itself is the documentation. GraphQL is exactly the format AI tool-calling works in: typed schema, structured queries, structured responses.

- **eBPF:** The instrumentation and actuation layer. Attach programs directly to the Linux kernel — observe syscalls, network packets, scheduling decisions, memory operations — with near-zero overhead. eBPF in Yeet isn't just observation; it's also actuation — enforcing security policies, blocking traffic, and shaping behavior at the kernel level.

- **V8 (JavaScript engine):** Serves three load-bearing roles: (1) transform engine for user-defined data processing; (2) BPF polyfill layer that abstracts over kernel version differences for fleet-wide deployment; (3) OS-enforced process-isolated security boundary (jail architecture) for safe execution of untrusted and AI-generated code.

Data pipeline: eBPF captures kernel events → shared-memory IPC ring buffer delivers millions of events per second with zero-copy → V8 transforms and processes → SysGraph makes it queryable → agents, dashboards, and alerts consume results.

## What You Can Build

- **Bespoke observability tools** — Custom-built for each application's specific failure modes, in minutes. A Python profiler that parses your specific HTTP traffic. A GPU monitor for your specific workload patterns.
- **On-demand profiling** — Full CPU profiler across any language (compiled and interpreted) in ~100 lines of JavaScript. Symbolized stack traces streaming in real time. No always-on overhead.
- **Autonomous remediation** — AI agents that detect GPU memory leaks, gather evidence across multiple snapshots, and kill offending processes autonomously.
- **Kernel-level security** — Credential file protection at the syscall level. HTTP/2 firewalls that decode HPACK headers in BPF and make per-request blocking decisions at XDP speed, before packets reach your proxy.
- **Contextual alerting** — When a PagerDuty alert fires, Yeet snapshots relevant system state and delivers a structured investigation summary alongside the page.
- **USB protocol analysis, deploy correlation, network anomaly detection** — each built as a single Yeet Script.

## Why Yeet Matters for AI Agents

The system graph is a tool-use interface purpose-built for LLM agent workflows. An agent doesn't need to parse `ps aux` output and hope the columns didn't shift — it queries the graph and gets clean, typed data back.

Combined with a shared-memory IPC ring buffer delivering millions of kernel events per second, this gives AI agents continuous, structured perception of live infrastructure. Not polling every few seconds — a real-time sensory stream of kernel-level events.

The progression: bespoke observability tools (today) → AI agents that read and reason about infrastructure at the kernel level (what the architecture enables) → self-driving infrastructure that detects, investigates, and resolves issues autonomously (where this is going).

## Yeet Scripts

A Yeet Script is a small JavaScript program that runs on a machine inside the daemon's sandboxed V8 runtime. It can observe everything (CPU, memory, disk, network, processes) and react in real time — monitor, detect, alert, ask a human, act. One file.

Scripts are sandboxed (V8 + OS-enforced process isolation), read-only by default (capabilities granted explicitly), have no shell access (typed actions only), support human-in-the-loop workflows (pause and wait for approval via Slack/dashboard), and hold no credentials on the machine.

## Deployment

Install: `yeet install` — the host becomes a programmable, queryable node. Runs as a systemd service. Remove with `apt remove`. No agent constellation, no backend to provision, no YAML labyrinth. Near-zero overhead when idle. Data never leaves the machine.

## Key Differentiators

- **Bespoke, not generic:** Every other tool gives you their dashboards. Yeet builds your view — specific to your application, your services, your business logic.
- **Kernel-depth without kernel expertise:** JavaScript over eBPF. AI can generate the instrumentation.
- **Built for machines, not just humans:** The data layer is typed, structured, and streaming — designed for AI agents to reason about.
- **Zero lock-in:** No vendor storage, no code changes, no logs to configure. Runs on your infrastructure.
- **BPF polyfilling:** Write BPF once, deploy across any kernel version. The runtime handles compatibility.

## How Yeet Compares

- **vs. Datadog/New Relic:** Yeet fills the gap existing tools can't reach — programmable transforms, kernel-level real-time data, autonomous remediation. Complements, doesn't wholesale replace.
- **vs. bpftrace/BCC:** Same kernel capabilities, but accessible through JavaScript with managed lifecycle, fleet deployment, and an AI-friendly data layer.
- **vs. Sentry/Dynatrace (APM):** APM approaches from the application down (SDKs). Yeet approaches from the kernel up (no code changes). Complementary.
- **vs. Falco/CrowdStrike:** Security platforms detect against known signatures. Yeet enforces policies you define, in JavaScript, at the kernel, specific to your infrastructure.
- **vs. Grafana:** Yeet doesn't have mature dashboarding. But provides programmable, real-time, kernel-depth capabilities Grafana cannot.

## Technical Details

- Daemon written in Rust
- Shared-memory IPC ring buffer with double-mapped virtual memory (same class as io_uring and LMAX Disruptor)
- Dual-socket privilege separation (0600 root, 0666 user)
- Priority MPSC message bus with graceful shutdown choreography
- BTF-aware eBPF lifecycle management
- BPF polyfilling via V8 abstraction layer
- GraphQL subscriptions for real-time streaming

## Links

- [Yeet Homepage](https://yeet.cx)
- [The Advantage of Yeet](https://yeet.cx/blog/the-advantage-of-yeet)
- [Chat With a Model About Yeet](https://yeet.cx/blog/learn-about-yeet)
- [AI Agents and Observability](https://yeet.cx/blog/ai-agents-observability)