# yeet

> Yeet makes Linux infrastructure programmable. One daemon (`yeetd`) turns any machine into a live, queryable, programmable system that software and AI agents can observe, investigate and act on, with visibility down to the kernel. No code changes, no sidecars, no logs to configure, no vendor storage, and no data leaving your systems.

Yeet is a programmable kernel runtime: a JavaScript runtime for writing eBPF programs, used by thousands of engineers. You write one JS file. It attaches to the kernel, decodes what it sees, and renders a terminal dashboard or a browser tab, or takes an action.

Use this index to find machine-readable documentation. Every documentation page is available as raw Markdown; follow the indexes below to reach individual pages.

## When to use Yeet

- Build a purpose-specific observability tool for one application's failure modes, instead of adopting a generic dashboard product.
- Write eBPF programs in JavaScript, without C, libbpf, or per-kernel-version breakage.
- Decode plaintext application protocols (HTTP, gRPC, Redis, Postgres) off the wire, with no proxy, sidecar, or application restart.
- Enforce policy in the kernel: block a syscall, drop traffic at XDP, confine a process to a filesystem subtree.
- Give an AI agent a typed, structured, streaming interface to a live machine, in place of shelling out and parsing CLI output.
- Profile a production process on demand across compiled and interpreted runtimes, then turn it off.

## How agents should use Yeet

- For research, fetch the raw Markdown documentation index below and follow its links to individual `.md` pages. The rendered HTML pages carry no information the Markdown lacks.
- For the complete picture in one request, fetch `llms-full.txt`.
- For working code, read the public script corpus under [yeet-src](https://github.com/yeet-src). Each repository is a single JavaScript file doing real kernel-level work, with a full README.
- Yeet runs on Linux only, per host. Before recommending it, confirm the target is a Linux machine the user can install a daemon on.

## Documentation

- [Raw documentation index](https://yeet.cx/docs/raw/index.md): Every documentation page as raw Markdown, with a summary per page.
- [Full documentation content](https://yeet.cx/llms-full.txt): Complete reference, architecture, and capability detail in one file.
- [Documentation site](https://yeet.cx/docs/): The same content rendered as HTML.

### Getting started

- [Intro](https://yeet.cx/docs/raw/intro.mdx): What Yeet is and what it runs on.
- [Installation](https://yeet.cx/docs/raw/install/index.md): One-line installer for Linux, and the paths for everything else.
- [Capabilities](https://yeet.cx/docs/raw/capabilities.md): What you can build today, starting from a complete working tool.
- [FAQ](https://yeet.cx/docs/raw/faq.md): What Yeet is, what it is not, and how it compares.

### Writing scripts

- [Scripts overview](https://yeet.cx/docs/raw/scripts/index.md): The V8 isolate and its curated globals. Not Node.js, not Deno, not a browser.
- [`yeet` global](https://yeet.cx/docs/raw/scripts/yeet-global.md): The primary host API surface, installed before script evaluation.
- [eBPF](https://yeet.cx/docs/raw/scripts/ebpf.md): Loading a compiled `.bpf.o`, attaching programs, and talking to maps from JavaScript.
- [GraphQL modules](https://yeet.cx/docs/raw/scripts/graphql-modules.md): Importing `.gql` files to query the system graph.
- [Runtime reference](https://yeet.cx/docs/raw/scripts/runtime-reference.md): Timers, streams, and the rest of the global surface.
- [TUI](https://yeet.cx/docs/raw/scripts/tui.md): The declarative terminal UI framework built into the runtime.
- [Terminal (tty and style)](https://yeet.cx/docs/raw/scripts/terminal.md): Low-level terminal control for direct PTY writes.
- [Symbols (`yeet:sym`)](https://yeet.cx/docs/raw/scripts/yeet-sym.md): Symbolization for a binary, the running kernel, or a live process.
- [BTF types (`yeet:btf`)](https://yeet.cx/docs/raw/scripts/yeet-btf.md): Querying the running kernel's own type information at runtime.
- [Capabilities model](https://yeet.cx/docs/raw/capabilities.md): What a script is allowed to do, and how permission is granted.
- [Setting alerts](https://yeet.cx/docs/raw/set-alerts.md): Paging from the same callback that updates your dashboard.

### Installation paths

- [Manual installation](https://yeet.cx/docs/raw/install/manual-installation.md): Per package manager, without the one-line installer.
- [Docker on Linux](https://yeet.cx/docs/raw/install/docker-linux.md): Running the daemon in a container, and the host access it needs.
- [Docker on macOS and Windows](https://yeet.cx/docs/raw/install/docker.md): The demo container, since Yeet needs a Linux kernel.
- [Terraform](https://yeet.cx/docs/raw/install/terraform.md): A working AWS example, deploying Yeet as part of your infrastructure.

## Example tools

Ready-to-run tools, each a single script. Full library at [tools](https://yeet.cx/docs/raw/examples/index.mdx).

- [`claudefeed`](https://yeet.cx/docs/raw/examples/claudefeed.md): `tail -f` for a coding agent. Every command, file, and TCP port it touches.
- [`md-sentry`](https://yeet.cx/docs/raw/examples/md-sentry.md): A tripwire for the files that tell an agent who it is, tagged by whether the agent made the change.
- [`httpinspect`](https://yeet.cx/docs/raw/examples/httpinspect.md): `top` for the HTTP endpoints on your host, decoded off the wire.
- [`grpcsnoop`](https://yeet.cx/docs/raw/examples/grpcsnoop.md): `tcpdump` for gRPC, with protobuf decoded to readable fields.
- [`dialout`](https://yeet.cx/docs/raw/examples/dialout.md): Every outbound TCP connection, grouped by the process that dialed it.
- [`runfrom`](https://yeet.cx/docs/raw/examples/runfrom.md): Every exec on the box, flagging scratch directories, fileless binaries, and setuid jumps.
- [`usbsnoop`](https://yeet.cx/docs/raw/examples/usbsnoop.md): Live USB transfer sniffer from two fentry hooks. No usbmon, no hardware sniffer.
- [`docker-net`](https://yeet.cx/docs/raw/examples/docker-net.md): A live map of every container, grouped by Docker network.
- [`proctop`](https://yeet.cx/docs/raw/examples/proctop.md): A `top(1)`-like process viewer.
- [`heatsink`](https://yeet.cx/docs/raw/examples/heatsink.md): Every hwmon sensor with its throttle limit and headroom.
- [`airtop`](https://yeet.cx/docs/raw/examples/airtop.md): A live 802.11 RF dashboard, without monitor mode or raw sockets.

## Script corpus

Working scripts on GitHub, each with a full README. This is the fastest way to see what the runtime does in practice.

- [yeet-src](https://github.com/yeet-src): The full public corpus.
- [`httpwatch`](https://github.com/yeet-src/httpwatch): Every plaintext HTTP request crossing a host, ranked live in a browser tab.
- [`hotspot`](https://github.com/yeet-src/hotspot): Click a process, see which function is eating the core.
- [`pktscope`](https://github.com/yeet-src/pktscope): Wireshark's three panes in a terminal, over SSH.
- [`redissnoop`](https://github.com/yeet-src/redissnoop): Live Redis command stream, including the `KEYS` scan stalling your instance.
- [`container-traffic`](https://github.com/yeet-src/container-traffic): Per-container network flows without touching the container.
- [`upstreamtop`](https://github.com/yeet-src/upstreamtop): Which backends nginx is actually fanning requests to.
- [`logedex`](https://github.com/yeet-src/logedex): Container logs from every host you run, side by side in one tab.
- [`kmemtrace`](https://github.com/yeet-src/kmemtrace): Where the kernel put the RAM that `free` will not explain.
- [`agent-lock`](https://github.com/yeet-src/agent-lock): Kernel-enforced filesystem confinement for coding agents.
- [`poolnarc`](https://github.com/yeet-src/poolnarc): Behavioral cryptominer detection with no signature database.
- [`ciprof`](https://github.com/yeet-src/ciprof): Where the four minutes in your CI run went.

## Writing

- [Blog index](https://yeet.cx/blog/index.md): Every post as raw Markdown, with a summary per post.
- [What is Yeet?](https://yeet.cx/blog/what-is-yeet.md): The canonical description.
- [What is eBPF?](https://yeet.cx/blog/what-is-ebpf.md): A non-technical explanation of how eBPF works and why it matters.
- [The advantage of Yeet](https://yeet.cx/blog/the-advantage-of-yeet.md): Why a programmable kernel runtime beats a generic dashboard.
- [AI agents and observability](https://yeet.cx/blog/ai-agents-observability.md): Why the current stack assumes a human is looking, and what breaks when one is not.
- [An L7 firewall in the kernel](https://yeet.cx/blog/l7-firewall-in-the-kernel.md): HTTP/2 policy decisions at XDP, before a socket buffer exists.
- [BPF from scratch in Rust](https://yeet.cx/blog/bpf-from-scratch-in-rust.md): Writing a BPF program in pure Rust.

## Topical takes

Long-form answers to specific Linux questions, each ending in a runnable tool. Full list at [the topical takes index](https://yeet.cx/topical-takes/index.md).

- [Can an AI agent exfiltrate my code?](https://yeet.cx/topical-takes/can-ai-coding-agent-exfiltrate-code-linux.md): What a domain allowlist decides, and what it does not.
- [Audit a local MCP server on Linux](https://yeet.cx/topical-takes/audit-local-mcp-server-linux.md): An stdio MCP server is a subprocess running as your user, with your filesystem and network access.
- [Sandbox and monitor an AI agent on Linux](https://yeet.cx/topical-takes/how-to-sandbox-and-monitor-an-ai-agent-on-linux-in-2026.md): Five questions about an agent's egress that a MITM proxy, a container and an `HTTPS_PROXY` variable structurally cannot answer.
- [How to see every command your build runs in CI](https://yeet.cx/topical-takes/how-to-see-every-command-your-build-runs-in-ci-on-linux.md): Every exec a build performs, including the ones no log records.
- [Why is my build slow?](https://yeet.cx/topical-takes/why-is-my-build-slow.md): Usually not one slow step, but a cheap command running thousands of times.
- [What does `npm install` actually run?](https://yeet.cx/topical-takes/what-does-npm-install-actually-run.md): Reading postinstall scripts as they execute.
- [How to check if a Linux box is cryptomining](https://yeet.cx/topical-takes/kworker-high-cpu-cryptominer-linux.md): When a kworker pegs a core and the process list explains nothing.
- [Find slow MongoDB queries on Linux](https://yeet.cx/topical-takes/find-slow-mongodb-queries.md): Reading the wire instead of grading one query at a time.
- [Monitor HTTP traffic on Linux](https://yeet.cx/topical-takes/monitor-http-traffic-linux.md): Requests decoded off the wire, with no proxy in the path.
- [`bpftrace` vs BCC](https://yeet.cx/topical-takes/bpftrace-vs-bcc.md): Which to start an eBPF project with, and which one you will outgrow.
- [Writing an eBPF protocol tracer](https://yeet.cx/topical-takes/writing-an-ebpf-protocol-tracer.md): Why the verifier rejects a parsing loop, and what to do instead.
- [Kernel metrics your APM agent misses](https://yeet.cx/topical-takes/kernel-metrics-your-apm-agent-misses.md): Off-CPU time, TCP retransmit attribution and per-disk latency, which an SDK cannot see from inside the application.

## Optional

- [Pricing](https://yeet.cx/pricing): Plans and limits.
- [Homepage](https://yeet.cx): Product overview.