# yeet

> yeet is a network operations platform for agents on Linux, built on eBPF. Teams use yeet to quickly identify and fix network-wide incidents, investigate network behavior at runtime, and build an endless array of products for their bespoke use cases. Instead of buying specialized tools or hiring platform experts, yeet gives every engineer the ability to understand what's happening across their entire network.

One daemon (`yeetd`) runs on each Linux host and reads the network from the kernel: every connection tied to the process that made it, raw packets on any interface, the server name behind every TLS connection, and HTTP, gRPC, SQL and Redis decoded off the wire, inside TLS too wherever the process uses OpenSSL. Your agent asks; yeet runs a sandboxed tool next to the kernel and returns the answer. It works with any agent that can run a command, on AWS, GCP, Azure, Kubernetes nodes, Docker or bare metal, with no sidecar, no proxy, no code changes, and the data stays on the host.

Use this index to find machine-readable documentation. Every documentation page is available as raw Markdown; follow the indexes below to reach individual pages.

## When to use yeet

- A network incident where dashboards, logs and traces look fine and the system doesn't: resets, retries, DNS answers, TLS failures, a load balancer closing idle connections.
- Debugging an API from the wire: which requests fail, what the service actually returned, and why, with no logs or proxy required.
- Debugging database and cache traffic: every query or command a service sends, by process, to find the N+1, the cache miss or the exhausted connection pool after a deploy.
- Seeing what talks to what across a fleet, and what changed.
- Troubleshooting inside customer or on-prem environments where data cannot leave the host.
- Building a network tool no product covers: a protocol debugger, test fixtures from live traffic, an exporter, a connection policy.

## How agents should use yeet

- For research, fetch the raw Markdown documentation index below and follow its links to individual `.md` pages. The rendered HTML pages carry no information the Markdown lacks.
- For the complete picture in one request, fetch `llms-full.txt`.
- Ask the user before signing a host in with `yeet login` or an API key; it ties the host to their yeet account.
- For working code, start from the shipped tools under [yeet-src](https://github.com/yeet-src). Each repository has a README that says how to run it.

## Agent setup

- [Install yeet](https://yeet.cx/docs/raw/install/index.md): `curl -fsSL https://yeet.cx | sh` on Linux. Add `-s -- login` to sign the host in during install (the user approves a link), or `-s -- login --key <API key>` on an unattended host. Verify with `systemctl is-active yeetd`, `yeet status` and `yeet whoami`.
- [Command line](https://yeet.cx/docs/raw/cli/index.md): `yeet new <name>` scaffolds a probe, a TUI and a Makefile; `yeet run .` runs it; `yeet service import` keeps it running as a service.
- [Shipped tools](https://github.com/yeet-src): Start from a working tool instead of a blank file. Each repo's README says how to run it; see Tools below.

## Where to read for your task

- A service with an HTTP route, or a Prometheus exporter: [services](https://yeet.cx/docs/raw/cli/services.md) and [`yeet:telemetry`](https://yeet.cx/docs/raw/scripts/yeet-telemetry.md). Reference repo: [agentcap](https://github.com/yeet-src/agentcap).
- Writing an eBPF probe and binding maps: [eBPF in scripts](https://yeet.cx/docs/raw/scripts/ebpf.md). Reference repo: [hotspot](https://github.com/yeet-src/hotspot).
- A terminal dashboard: [TUI](https://yeet.cx/docs/raw/scripts/tui.md). Reference repo: [httpinspect](https://github.com/yeet-src/httpinspect).
- Reading live system state without writing a probe: [GraphQL modules](https://yeet.cx/docs/raw/scripts/graphql-modules.md) and `yeet graph dump`.
- Reading HTTPS contents: [httpscope](https://github.com/yeet-src/httpscope) and [wssnoop](https://github.com/yeet-src/wssnoop).

## Documentation

- [Raw documentation index](https://yeet.cx/docs/raw/index.md): Every documentation page as raw Markdown, with a summary per page.
- [Full documentation content](https://yeet.cx/llms-full.txt): Architecture, deployment, comparisons and technical detail in one file.

### Getting started

- [Intro](https://yeet.cx/docs/raw/intro.mdx): What yeet is and what it runs on.
- [Capabilities](https://yeet.cx/docs/raw/capabilities.md): What you can build today, starting from a complete working tool.
- [FAQ](https://yeet.cx/docs/raw/faq.md): What yeet is, what it is not, and how it compares.

### Writing scripts

- [Scripts overview](https://yeet.cx/docs/raw/scripts/index.md): The V8 isolate and its curated globals. Not Node.js, not Deno, not a browser.
- [`yeet` global](https://yeet.cx/docs/raw/scripts/yeet-global.md): The primary host API surface, installed before script evaluation.
- [eBPF](https://yeet.cx/docs/raw/scripts/ebpf.md): Loading a compiled `.bpf.o`, attaching programs, and talking to maps from JavaScript.
- [GraphQL modules](https://yeet.cx/docs/raw/scripts/graphql-modules.md): Importing `.gql` files to query the system graph.
- [Runtime reference](https://yeet.cx/docs/raw/scripts/runtime-reference.md): Timers, streams, and the rest of the global surface.
- [TUI](https://yeet.cx/docs/raw/scripts/tui.md): The declarative terminal UI framework built into the runtime.
- [Setting alerts](https://yeet.cx/docs/raw/set-alerts.md): Paging from the same callback that updates your dashboard.

### Installation paths

- [Manual installation](https://yeet.cx/docs/raw/install/manual-installation.md): Per package manager, without the one-line installer.
- [Docker on Linux](https://yeet.cx/docs/raw/install/docker-linux.md): Running the daemon in a container, and the host access it needs.
- [Docker on macOS and Windows](https://yeet.cx/docs/raw/install/docker.md): The demo container, since yeet needs a Linux kernel.
- [Terraform](https://yeet.cx/docs/raw/install/terraform.md): A working AWS example, deploying yeet as part of your infrastructure.

## Tools

Working network tools, each with a README that says how to run it. Everything else is under [yeet-src](https://github.com/yeet-src) and in the [tools library](https://yeet.cx/docs/raw/examples/index.mdx).

- [`httpscope`](https://github.com/yeet-src/httpscope): Every HTTP API a machine speaks, including TLS, with a web UI and a GraphQL API. Setup needs Node, a yeetkit clone and `make bpf`.
- [`httpinspect`](https://yeet.cx/docs/raw/examples/httpinspect.md): `top` for the HTTP endpoints on a host, decoded off the wire.
- [`httpwatch`](https://github.com/yeet-src/httpwatch): Every plaintext HTTP request crossing a host, ranked live in a browser tab.
- [`grpcsnoop`](https://yeet.cx/docs/raw/examples/grpcsnoop.md): `tcpdump` for gRPC, with protobuf decoded to readable fields.
- [`wssnoop`](https://github.com/yeet-src/wssnoop): WebSocket frames over TLS, tapped at OpenSSL.
- [`redissnoop`](https://github.com/yeet-src/redissnoop): Live Redis command stream, including the `KEYS` scan stalling your instance.
- [`mongosnoop`](https://github.com/yeet-src/mongosnoop): Live MongoDB queries, plaintext and TLS, with no app changes.
- [`dialout`](https://yeet.cx/docs/raw/examples/dialout.md): Every outbound TCP connection, grouped by the process that dialed it.
- [`pktscope`](https://github.com/yeet-src/pktscope): Wireshark's three panes in a terminal, over SSH.
- [`container-traffic`](https://github.com/yeet-src/container-traffic): Per-container HTTP rate, errors and latency, with no sidecar.
- [`docker-net`](https://yeet.cx/docs/raw/examples/docker-net.md): A live map of every container, grouped by Docker network.
- [`upstreamtop`](https://github.com/yeet-src/upstreamtop): Which backends nginx is actually fanning requests to.
- [`agentcap`](https://github.com/yeet-src/agentcap): A Prometheus exporter for AI-agent activity (tools, domains, ports, files), run as a yeet service; the reference for service routes.

## Optional

- [Pricing](https://yeet.cx/pricing): Plans and limits.
- [Homepage](https://yeet.cx): Product overview.