Hybirdss/Hycli

Automate any website.

Download · Get started · What your AI can do · Use with your AI · 한국어 · 日本語

Give Hycli a website. Add a purpose if you have one. It learns the available interface, prepares typed CLI and MCP actions, and checks useful reads. Your AI can then use those actions with the same accounts, approvals and results you see in the local dashboard.

_{Example workspace with sample tools and accounts.}

Enter a domain and, optionally, a purpose beside it. The AI first understands the website and selects useful workflows, then checks their prerequisites, inputs and final results. Missing steps keep the website marked for review.

Hycli includes its website engine and local dashboard. The desktop launcher starts the engine for you and opens your default browser. Rust and Node.js are build tools; neither is needed to use a package.

The next desktop packages are built for Windows, macOS and Linux, on both x64 and ARM64:

Click the icon again to reopen the running dashboard. Closing a browser tab leaves Hycli running; Settings → Quit Hycli stops it. The next launch starts it again. No terminal, manually managed server, administrator service, or startup-at-login setup is required. CLI users can use hycli open, hycli status and hycli stop; hycli alone also opens the app.

Desktop installers are produced by native CI and are separate from the older v0.1.0 release below. Check the exact run before using an artifact. Unsigned Windows installers and macOS builds without Developer ID notarization are development artifacts; see distribution signing.

Download the Linux x64 package from v0.1.0 and its .sha256 file into the same directory. It requires glibc 2.39 or newer, such as Ubuntu 24.04.

sha256sum -c hycli-0.1.0-linux-x64.tar.gz.sha256
tar -xzf hycli-0.1.0-linux-x64.tar.gz
cd hycli-0.1.0-linux-x64
./hycli dashboard

The release also includes the reviewed source snapshot, per-file manifests and checksums. Linux x64 is the verified native download for this release. For other Linux systems, macOS or Windows, use the build instructions below; native CI results are recorded in Actions.

node scripts/build.mjs
./dist/hycli open

The current app prefers http://127.0.0.1:4318 and selects a free loopback port if needed. hycli open --no-open starts it without opening a browser and prints its address; --port 4320 selects a preferred port. hycli dashboard is still available for foreground development. The website engine and dashboard are included in the same executable.

1. Open AI connections and connect a provider.
2. Add a website address, choose the AI and optionally describe your task.
3. Review the available actions. Run one in the dashboard or open Coding agents to copy the MCP configuration once.

For a signed-in website, connect its account from Accounts. A website can have several saved accounts; you choose which one its tools use. When its tools declare an API key or bearer credential, save it under Explore actions → Website API keys. The key stays in the local vault and is never sent to AI.

Hycli turns supported website operations into named, typed tools. AI-written descriptions explain what an action accomplishes, what it needs, and what it returns. A task such as “find my saved references” guides preparation toward the required reads, searches and prerequisite resources.

Choose the AI that prepares your websites.	Review actions and keep the useful result.

Three independent AI workers handle reads and search, useful workflows, and account evidence. The dashboard shows completed stages, each worker’s status, elapsed time and plain-language work notes. CLI and MCP work appears in the same activity history.

_{Three workers. One very busy little bird.}

Preparation follows information actually available from the website: linked documentation, API schemas, published JavaScript, and request shapes observed by the browser companion. After the planned workflows, the workers keep going through every documented API operation that has no action yet, until each one is implemented or reported with its reason; the job's coverage lists what remains. It performs bounded reads before installing a replacement. If a request or extraction check fails, the workers receive that evidence and can revise the definition before checking again. An already working definition stays installed during preparation. It does not create test records, edit content, delete objects, guess large lists of endpoints, or fuzz a live server.

Every website starts read-only. Its change actions are hidden from MCP and refused by the CLI until you turn on Allow changes in that website's details; turning it off again cancels pending approvals. The switch and the approval button exist only in the dashboard, and the dashboard grants its session only to the address hycli dashboard opens, so an agent calling Hycli cannot turn changes on or approve its own request. An agent that can run any command as your user can also read your files; keep such agents on their own permission prompts.

Approval applies to one exact request, expires after five minutes, and can be consumed only once. Changing the inputs, account, saved sign-in or installed tool definition invalidates it. CLI, MCP and dashboard execution use the same boundary. Writes are never retried automatically. If a change is interrupted after authorization, its outcome is marked uncertain so you can check the website before trying again. An open dashboard reconnects automatically after the local server restarts.

Support depends on the website and the access available on your device. Preparation can adapt between documentation, HTTP and browser evidence; it still needs an implementable operation and a meaningful result. Arbitrary browser click sequences, multipart uploads and binary downloads are outside the current contract. The operation reference describes supported requests, extraction and limits.

Choose a model in the dashboard, including a model available specifically to your account. Connection checks verify the provider and selected model. API providers bill usage to your provider account.

The Codex connection uses its official app-server protocol. Hycli does not read or copy Codex OAuth tokens. Inference runs in an ephemeral thread with file, shell, browser, application and MCP execution disabled. Website preparation is performed by Hycli's controlled read tools.

Coding agents → View connection settings gives you the exact configuration for the current executable and data directory. Connect your AI app once. The general connection lets it prepare a missing website, follow the job and execute new actions without restarting MCP:

hycli mcp

Use --sites-only to expose installed actions only, or limit the connection to one website:

hycli mcp --sites-only --only-site research-library

A typical MCP configuration looks like this:

{
  "mcpServers": {
    "hycli": {
      "command": "hycli",
      "args": ["mcp"]
    }
  }
}

Use the executable path shown by the dashboard if hycli is not on your agent’s PATH. The general MCP server offers preparation, job status, website listings, account metadata and hycli_run for executing newly installed actions even before a client refreshes its tool list. It never offers a tool for reading credentials or approving a change on the user's behalf. The hycli_result, hycli_check and hycli_activity tools remain available in both modes, so your AI can follow work notes, progress and approved results, and tell an expired sign-in from a changed website.

hycli jobs ls
hycli jobs show JOB_ID --watch
hycli browsers --url https://example.com

The same workflow is available from the CLI:

hycli prepare https://your-website.example --intent "Find saved references"
hycli request SITE "Add draft editing and publishing with full post content"
hycli describe
hycli describe SITE ACTION
hycli SITE ACTION --help
hycli run SITE ACTION --arg query="design systems"

Before retrying a failed action, check the website without AI:

hycli check          # every installed website
hycli check SITE

Preparation records the reads that passed, in order, including reads that pass an earlier result's identifier to the next one. hycli check replays them, first confirming the saved account's identity. The verdict separates signed_out (reconnect the account) from site_changed (the account works but responses no longer match; request a repair), plus blocked and unreachable. It never runs a change, and the exit status follows the verdict. MCP clients get the same check as hycli_check.

Replace the sample URL and uppercase IDs with your website and the names returned by describe. Direct syntax such as hycli SITE ACTION --query "design systems" also works. Required inputs, typed values, defaults and account selection are shared with the dashboard. A failed HTTP response or unexpected login page produces a failed action and a nonzero CLI exit status.

The reusable Hycli skill and agent guide teach assistants to discover missing capabilities, resolve resource IDs through related searches, follow existing jobs and recover from observed failures. The AGENTS.md and CLAUDE.md versions of each guide are kept identical.

A change requested from CLI or MCP creates an approval for the user to review in the dashboard. Keep the returned receipt and follow its result; do not issue a duplicate action while approval is pending.

Website preparation starts by inspecting the current OS, running and registered browsers, and available profiles. The AI chooses from those capabilities to read documentation, render pages, import a site session, and verify its connection. Browser and profile paths stay on the local machine; a generated website definition does not depend on the developer's installation paths.

Chrome, Chromium, Edge, Brave and Firefox cookies and origin storage can be imported when accessible. Only the requested website's session enters Hycli’s local vault. Hycli selects a single verified identity automatically; profiles belonging to the same identity count as one account choice. An existing account selection is preserved; different verified identities require a choice.

In Accounts → Connect an account, Find my sign-in repeats that search. If it cannot find a usable session, Open website sign-in opens the website in your default browser. Hycli rechecks while the dialog is open and resumes preparation only after the selected account is verified. Opening a tab alone is never reported as a successful login.

OS-protected, browser-bound, private or container sessions may need the companion. Choose the companion tab, create a connection code, then open the companion in the signed-in profile, enter the code, and grant access to that website. Native import does not bypass Windows App-Bound protection or weaken a browser profile.

• Chrome and Edge: unzip the package and use Load unpacked on the browser's extensions page.
• Firefox: use the Firefox package and Load Temporary Add-on in about:debugging. Temporary extensions are removed when Firefox restarts. Signed store distribution is not included in this release.
• Cookie file: JSON and Netscape cookie-file imports are available as a fallback. Import the file directly in the dashboard; do not paste its contents into an AI conversation.

The browser transfers session data directly to the local credential vault. Models receive account labels, local key names and structure, and tool results with credential values removed. They can construct a connection recipe that references those local values without receiving them. Cookie scope, paths, expiry and supported partition information are respected, and authentication headers remain restricted to their original origin.

Account identity comes from an actual current-account response from the website. A browser profile name is not treated as a verified website identity. If the account has not been identified yet, Hycli says so. After connecting, normal browsing can provide an account response and the shapes of available requests without exposing request values, headers or response bodies to the preparation model.

A site may require a separate documented API credential or a browser capability that is unavailable locally. Preparation records the actual connection and read results. A homepage fetch or a login page returned from an API does not make an integration ready. The browser setup guide explains the companion flow and limitations.

The dashboard supports the 20 languages linked above, including right-to-left Arabic. English is the initial language. Your choice is saved on this device, and AI descriptions can be prepared in the selected language.

Website definitions, account metadata and activity stay in the local data directory. Set HYCLI_DATA_DIR to choose a different location. Use Settings to see the active location and credential protection.

The credential vault uses an OS keyring-backed encryption key when available. When a keyring is unavailable, it explicitly reports a file-permissions-only store; private directories and credential files are restricted to the current OS user. An existing encrypted vault is not silently replaced when it cannot be unlocked.

Requests are serialized and paced per website and account, with an additional website-wide budget. Hycli respects Retry-After, bounds response sizes and read retries, and pauses on authentication failures or site challenges. Website preparation does not rotate accounts, spoof fingerprints or bypass challenges to evade a restriction. These measures reduce avoidable pressure; they cannot guarantee that a website will never restrict an account.

Private and local website addresses are disabled by default. For a trusted self-hosted site, launch the dashboard or MCP server with --allow-local explicitly.

Start with CONTRIBUTING.md for the project map, local setup and pull request expectations. Read the changelog for the current release and use the issue forms for reproducible problems or feature requests.

npm --prefix dashboard ci
npm --prefix dashboard run check
npm --prefix dashboard run build
cargo test --all-targets --locked
cargo build --locked --bin hycli --example dashboard_fixture
node scripts/test-e2e.mjs --full

Tests use synthetic local websites and provider responses. They cover approval binding and replay prevention, secret redaction, redirects, rate limits, no write retries, browser-session protection and provider response contracts. Never use a real account to create, modify or delete content merely to test Hycli.

The screenshots show the running Rust dashboard with illustrative website tools and accounts. The preparation animation uses isolated local website and AI-provider fixtures. No personal sign-in data is shown. Public source and native archives use explicit file lists and ship no installed website definitions or account data. The bird is inspired by the shima-enaga, the white long-tailed tit of Hokkaido.

Hycli is licensed under Apache-2.0.

Hycli is intended for creating and using command-line tools that make websites easier to use. Use it with websites and accounts you are authorized to access.

The software is provided as is, without warranty. To the extent permitted by law, its authors and contributors are not liable for losses or other problems arising from its use. You are responsible for how you use it.

To the extent permitted by law, the authors and contributors are not liable for account bans, suspensions, or restrictions resulting from the use of Hycli. Do not use Hycli for hacking, unauthorized access, or attacks.