Atlas / MCP servers / bim-ba / ycli

ycliBLOCK

Name: ycli
Author: bim-ba

mcp/bim-ba/ycli

MCP server by bim-ba · ai agents · claude code · cli · Audited 2026-10-11

⚑ Report / re-scan Source ↗

Yandex 360 toolkit — Tracker, Wiki & Forms via CLI, MCP server, Python SDK & Claude Code plugin ✨

Verdict

BLOCK

Grade

Trust score

35 /100

Exposed tools

200 62r · 95w · 43d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Yandex 360 for people and for agents.

Tracker, Wiki and Forms from a command line, an MCP server and Python: one tool, and one name for each operation everywhere.

English · Русский

[](https://github.com/bim-ba/ycli/actions/workflows/ci.yml) [](https://github.com/bim-ba/ycli) [](https://pypi.org/project/yandex-cli/) [](https://www.python.org/) [](LICENSE) [](https://ycli.savaznatnov.dev/) [](https://deepwiki.com/bim-ba/ycli)

A command line that scripts well. JSON when piped, ready for jq, --dry-run for every write, an exit code for each kind of failure.
An MCP server agents can trust. Every tool says whether it reads, writes or destroys; serve only reads, or a small everyday set.
A typed Python SDK. Pydantic models for every answer, and examples the test suite runs.
Careful with your data. A delete asks first, and your token goes only to Yandex's own hosts.

Documentation: ycli.savaznatnov.dev.

Install

uv tool install 'yandex-cli[mcp]'   # the ycli command, with the

Read from source at commit ff78c252a655OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (pypi)

claude mcp add yandex-cli --env YANDEX_ID_OAUTH_TOKEN=${YANDEX_ID_OAUTH_TOKEN} --env YANDEX_ID_OAUTH_TOKEN=${YANDEX_ID_OAUTH_TOKEN} -- uvx yandex-cli==0.142.0 mcp start

claude-code (oci)

claude mcp add ycli:0.142.0 --env YANDEX_ID_OAUTH_TOKEN=${YANDEX_ID_OAUTH_TOKEN} --env YANDEX_ID_OAUTH_TOKEN=${YANDEX_ID_OAUTH_TOKEN} -- docker run -i --rm ghcr.io/bim-ba/ycli:0.142.0:None

Exposed tools (200)

62 read · 95 write · 43 destructive. Blast radius: 43 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`access_clear`	destructive	Revoke every personal access on a wiki page except the owner
`access_delete`	destructive	Revoke one access entry on a wiki page — the holder loses that grant at once.
`access_list`	write	Who may edit (``change``) and who may fill (``submit``) a form, one entry per action.
`answers_export`	write	Start an async export of a form
`applications_list`	read	External applications that Tracker issues can be linked to via external links.
`autoactions_create`	write	Create an autoaction on a queue — actions applied on a schedule to matching issues.
`boards_create`	write	Create an agile board; returns the new board with its id.
`boards_delete`	destructive	Permanently delete an agile board (irreversible; its issues are not affected).
`boards_update`	write	Edit an agile board; only the fields set in ``body`` are changed.
`charts_editor_delete`	destructive	Delete a chart; the dashboards that show it lose it.
`charts_editor_get`	read	One chart written in the editor: its kind (``entry.type``) and its tabs of code.
`charts_ql_delete`	destructive	Delete a chart; the dashboards that show it lose it.
`charts_ql_get`	read	One QL chart. Unlike a chart of the wizard it comes flat, with no ``entry`` around it.
`charts_wizard_delete`	destructive	Delete a chart; the dashboards that show it lose it.
`charts_wizard_get`	read	One chart built in the wizard: the datasets it reads and what it shows.
`checklists_clear`	destructive	Permanently delete the ENTIRE checklist of a Tracker issue (all items, irreversible).
`checklists_create`	write	Add an item to a Tracker issue
`checklists_delete`	destructive	Permanently remove one item from a Tracker issue
`checklists_update`	write	Edit one checklist item on a Tracker issue (text, checked state, assignee, deadline).
`cloudenvironments_delete`	destructive	Delete a cloud environment and return the operation that deletes it.
`cloudenvironments_get`	read	One cloud environment: its cloud, its subnet, its status and its storage.
`cloudenvironmentstorage_bucket_download_url_create`	write	A signed link to read one object of the bucket.
`cloudenvironmentstorage_bucket_object_metadata_get`	read	The size of an object, in bytes as a string, and when it last changed.
`collections_breadcrumbs_list`	read	The collections from the root down to this one.
`collections_delete`	destructive	Delete a collection with everything it holds: nested collections, workbooks, entries.
`collections_get`	read	One collection by id: its title, description and parent.
`collections_permissions_get_root`	write	Whether the caller may create a collection and a workbook in the root.
`columns_create`	write	Add a column to an agile board; returns the new column.
`columns_delete`	destructive	Permanently remove a column from an agile board (irreversible).
`columns_update`	write	Edit a board column; only the fields set in ``body`` are changed.
`comments_create`	write	Add a comment to a Tracker issue; returns the created comment.
`comments_delete`	destructive	Permanently delete one comment from a Tracker issue (irreversible).
`comments_import`	write	Import a comment onto an issue preserving its original author and timestamp (admin-only).
`comments_update`	write	Replace the text of an existing comment on a Tracker issue.
`components_create`	write	Create a component in a queue (a sub-area for classifying its issues).
`components_list`	read	All components created by the organisation
`conditions_hook_create`	write	Add a condition group to an integration group; returns it with its ``id``.
`conditions_hook_delete`	destructive	Delete one condition group from an integration group; the others stay untouched.
`conditions_hook_get`	read	One condition group of an integration group by id — its ``operator`` and clauses.
`conditions_hook_list`	read	An integration group
`conditions_hook_update`	write	Replace an integration group
`conditions_hook_update_operator`	write	Set the boolean operator BETWEEN an integration group
`conditions_page_create`	write	Add a condition group to a page — the page shows only when its conditions match.
`conditions_page_delete`	destructive	Delete one condition group from a page; the other groups stay untouched.
`conditions_page_get`	read	One condition group of a page by id — its ``operator`` and clause ``items``.
`conditions_page_list`	read	A page
`conditions_page_update`	write	Replace a page
`conditions_page_update_operator`	write	Set the boolean operator BETWEEN a page
`conditions_question_create`	write	Add a condition group to a question — it shows only when its conditions match.
`conditions_question_delete`	destructive	Delete one condition group from a question; the other groups stay untouched.
`conditions_question_get`	read	One condition group of a question by id — its ``operator`` and clause ``items``.
`conditions_question_list`	read	A question
`conditions_question_update`	write	Replace a question
`conditions_question_update_operator`	write	Set the boolean operator BETWEEN a question
`conditions_submit_create`	write	Add a condition group gating the form
`conditions_submit_delete`	destructive	Delete one condition group from the submit button; the other groups stay untouched.
`conditions_submit_get`	write	One condition group of the submit button by id — its ``operator`` and clauses.
`conditions_submit_list`	write	The submit button
`conditions_submit_update`	write	Replace a submit-button condition group — a FULL replacement, not a partial update.
`conditions_submit_update_operator`	write	Set the boolean operator BETWEEN the submit button
`connections_delete`	destructive	Delete a connection; the datasets built on it lose their source.
`dashboards_create`	write	Create a personal Tracker dashboard; returns it with the id used to add widgets.
`dashboards_delete`	destructive	Delete a dashboard.
`datasets_delete`	destructive	Delete a dataset; the charts built on it lose their data.
`embeddingsecrets_delete`	destructive	Delete a key for embedding. Deleting again answers 404.
`embeddingsecrets_get`	read	One key for embedding: its name, its workbook, who made it. Never its private key.
`embeds_delete`	destructive	Delete an embed; its links stop working. Deleting again answers 404.
`embeds_update`	write	Save an embed as given and return it.
`entities_attachments_list`	read	Files attached to an entity — name, size, MIME type, uploader and download URL.
`entities_checklists_create`	write	Add checklist item(s) to a Tracker entity; returns the entity with its checklist.
`entities_checklists_delete`	destructive	Permanently delete the ENTIRE checklist of a Tracker entity (all items, irreversible).
`entities_checklists_update`	write	Replace/update a Tracker entity
`entities_comments_create`	write	Add a comment to a Tracker entity; returns the created comment.
`entities_comments_list`	read	All comments on an entity — author, text, timestamps and summoned users.
`entities_create`	write	Create a Tracker entity (project, portfolio or goal); returns it with its id.
`entities_links_create`	write	Link a Tracker entity to another entity (e.g. ``relates``, ``depends on``).
`entities_links_list`	read	An entity
`entities_permissions_get`	read	An entity
`entities_permissions_get_direct`	read	An entity
`entities_permissions_update`	write	Change an entity
`entities_permissions_update_direct`	destructive	Grant and revoke an entity
`entities_reports_create`	write	Request a report over Tracker entities (``POST /entities/report/``).
`entities_update`	write	Edit a Tracker entity; only the ``fields`` keys present in ``body`` are changed.
`entities_update_bulk`	write	Start an async bulk field update over many entities; returns the operation.
`entries_permissions_get`	read	What the caller may do with each entry, as a map by id.
`fields_categories_create`	write	Create a field category (a grouping bucket for issue fields in the UI).
`fields_create`	write	Create an org-global custom issue field.
`fields_list`	read	All global (organisation-wide) issue fields, both standard and custom.
`filters_create`	write	Create a saved issue filter owned by the calling user.
`gaps_create`	write	Create up to 100 employee absences; needs Tracker administrator rights.
`get`	read	Report whose token this is, its organization and which services accept it.
`grids_delete`	destructive	Delete a grid — irreversible (grids have NO recovery token, unlike pages).
`honest_write`	write	Probe.
`hooks_delete`	destructive	Delete an integration group together with its integrations and conditions.
`hooks_get`	read	One integration group by id, with its conditions and integrations.
`hooks_list`	read	A form
`htmlpages_delete`	destructive	Delete an HTML page.
`issues_count`	read	Count of issues matching a query-language string or a filter.
`issues_create`	write	Create a Tracker issue; returns the new issue with its key.
`issues_get`	read	A single Tracker issue by key.
`issues_import`	write	Import an issue preserving its original history (admin-only back-fill).
`issues_move_bulk`	write	Start an async bulk move of many Tracker issues to another queue; returns the operation.
`issues_transition_bulk`	write	Start an async bulk status transition over many Tracker issues; returns the operation.
`issues_update`	write	Update fields of a Tracker issue; only the keys present in ``body`` are changed.
`issues_update_bulk`	write	Start an async bulk field update over many Tracker issues; returns the operation.
`issuetypes_create`	write	Create an org-global issue type (e.g. a new kind of task).
`issuetypes_list`	read	All available issue types (e.g. task, bug, epic).
`licensing_limit_get`	destructive	How many licences the instance may hold: the limit in force and the one that takes over.
`links_create`	write	Link a Tracker issue to another issue; returns the created link.
`links_import`	write	Import an issue link preserving its original creation metadata (admin-only).
`links_list`	read	All links on a Tracker issue (linked issues, type, direction).
`linktypes_list`	read	All available link types (e.g. relates, depends on, blocks).
`localfields_create`	write	Create a custom field scoped to one queue (a local field).
`macros_create`	write	Create a macro on a queue (a canned comment plus field updates applied on demand).
`macros_delete`	destructive	Permanently delete a macro from a queue (irreversible).
`macros_update`	write	Edit a queue macro; only the fields set in ``body`` are changed.
`me_get`	read	The authenticated Yandex Forms user (a safe auth probe).
`notifications_cancel`	write	Stop an integration run that has not finished.
`notifications_get`	write	One integration run with what the integration was given, answered and failed with.
`notifications_restart`	write	Run the integration again for that answer.
`notifications_status_get`	write	The state of one integration run: pending, success, error or canceled.
`pages_create`	write	Create a wiki page at ``body.slug`` (``POST /pages``).
`pages_get`	read	The page
`pages_get_meta`	read	Page metadata for SLUG (attributes + owner).
`pages_search`	read	Full-text search over wiki pages and files; returns one page of hits.
`priorities_create`	write	Create an org-global issue priority.
`projects_create`	write	Create a project (legacy Projects API).
`projects_delete`	destructive	Delete a project (irreversible). Returns an acknowledgement.
`projects_get`	write	One project: name, lead, stage, dates and ``version`` (needed to edit it).
`projects_list`	read	Every project of the organization (the legacy Projects API).
`questions_list`	read	A form
`queues_create`	write	Create a Tracker queue (the container issues live in; its key prefixes issue keys).
`queues_delete`	destructive	Delete a Tracker queue WITH ALL ITS ISSUES (recoverable via ``queues_restore``).
`queues_permissions_update`	destructive	Replace access rules on a Tracker queue (grant/revoke read/write/create/grant rights).
`queues_restore`	read	Restore a previously deleted Tracker queue (and its issues) from the recycle bin.
`queues_tags_delete`	destructive	Remove a tag from EVERY issue of a queue (irreversible; the tag disappears queue-wide).
`queues_versions_create`	write	Create a version (release milestone) on a queue.
`read`	read	Read it.
`reads_only`	read	Says it writes, and under `dry_run` only reads, through the guarded client.
`rename`	write	Rename it.
`reports_delete`	destructive	Delete a report.
`resolutions_create`	write	Create an org-global issue resolution (a close-out reason such as fixed/duplicate).
`resolutions_list`	read	Every issue resolution configured in the organisation.
`retag`	read	Answers a list, which FastMCP puts under `result`.
`sparkapplications_cancel`	write	Stop a Spark application and return the operation that cancels it.
`sparkapplications_get`	read	One Spark application: its status, its times and what it runs.
`sparkclusters_delete`	destructive	Delete a Spark cluster and return the operation; ``lakehouseoperations_get`` reads it.
`sparkclusters_get`	read	One Spark cluster: its settings, health and status. Experimental API, not measured.
`sparkclusters_start`	write	Start a stopped Spark cluster and return the operation.
`sparkclusters_stop`	write	Stop a running Spark cluster and return the operation; ``lakehouseoperations_get`` reads it.
`sprints_archive`	read	Archive a finished sprint (hides it from the board
`sprints_create`	write	Create a sprint on an agile board; returns the new sprint.
`sprints_delete`	destructive	Permanently delete a sprint (irreversible; its issues are not affected).
`sprints_start`	write	Start a sprint (sets its status to ``inProgress`` and stamps the actual start time).
`sprints_update`	write	Edit a sprint; only the fields set in ``body`` (name, dates) are changed.
`sqlqueries_delete`	destructive	Delete a saved SQL query.
`statuses_create`	write	Create an org-global issue status for use in workflows.
`statuses_list`	read	Every issue status configured in the organisation
`subscriptions_delete`	destructive	Delete one integration from a hook; the hook
`subscriptions_get`	read	One integration of a hook by id, with its type-specific settings.
`subscriptions_list`	read	Every integration of an integration group (hook), each tagged by ``type``.
`surveys_create`	write	Create a new form from the given settings; returns the created ``Survey`` (note its ``id``).
`surveys_delete`	destructive	Delete a form permanently — IRREVERSIBLE: its questions and collected answers are lost.
`surveys_get`	read	One form
`surveys_publish`	write	Publish a form so respondents can fill it; fails if the form is blocked or at its cap.
`surveys_unpublish`	read	Take a published form offline (respondents can no longer fill it); reversible via publish.
`surveys_update`	write	Patch a form
`tagged_read`	read	Probe.
`tenant_details_get`	read	The DataLens instance the credentials reach (a safe auth probe).
`things_create`	write	Probe.
`things_update`	write	Probe.
`touch`	write	Answers nothing, and has no schema to put a plan beside.
`transitions_list`	read	Available workflow transitions for a Tracker issue.
`trinoclusters_delete`	destructive	Delete a Trino cluster and return the operation that deletes it.
`trinoclusters_get`	read	One Trino cluster: its configuration, its health, its status and its coordinator.
`trinoclusters_start`	write	Start a stopped Trino cluster and return the operation that starts it.
`trinoclusters_stop`	write	Stop a running Trino cluster and return the operation that stops it.
`unannotated`	read	Probe.
`unguarded`	read	A tool that writes with a client it built by itself: the guard is not in it.
`untagged_write`	write	Probe.
`uploadsessions_abort`	write	Cancel one in-progress upload session, discarding its uploaded parts.
`uploadsessions_abort_all`	write	Cancel EVERY active upload session of the caller, discarding all uploaded parts.
`uploadsessions_finish`	write	Close an upload session after its last part — step 3 of the upload pipeline.
`workbookexports_cancel`	write	Stop an export: its status becomes ``error``, with ``WORKBOOK_EXPORT_CANCELLED``.
`workbookexports_result_get`	read	The exported workbook: every entry it holds, as one document.
`workbookexports_status_get`	read	How far an export is: ``pending``, ``success`` or ``error``, and the progress in percent.
`workbooks_delete`	destructive	Delete a workbook with everything it holds: connections, datasets, charts, dashboards.
`workbooks_delete_bulk`	destructive	Delete several workbooks with everything they hold.
`workbooks_get`	read	One workbook by id: its title, description and collection.
`workbooks_move_bulk`	write	Move several workbooks into a collection, or into the root when none is given.
`workflows_create`	write	Create a workflow; returns it with its generated id and version.
`workflows_delete`	destructive	Delete a workflow (irreversible). Returns an acknowledgement.
`workflows_get`	read	One workflow with its steps, initial action, queue binding and ``version``.
`workflows_list`	read	Every workflow of the organization (deleted ones excluded) with its steps and actions.
`workflows_update`	write	Edit a workflow.
`worklog_create`	write	Log spent time on a Tracker issue; returns the created worklog record.
`worklog_delete`	destructive	Permanently delete a worklog record from a Tracker issue (irreversible).
`worklog_import`	write	Import a worklog record preserving its original author and timestamps (admin-only).
`worklog_search`	read	Org-wide worklog entries filtered by author and/or a creation-time range.
`worklog_update`	write	Edit a worklog record on a Tracker issue (duration and/or comment).

Trust audit

BLOCKgrade F · trust 35/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (4 observation(s))
Shell: declared (3 observation(s))
Dependencies: pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/api_drift.py:275

hints[name] = eval(annotation, namespace) if isinstance(annotation, str) else annotation

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

.agents/skills/yandex-360-tracker/SKILL.md:49

The CLI, MCP tools, and SDK all read credentials from the environment:

Why it matters. asks the agent to read credentials

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

.claude/skills/yandex-360-tracker/SKILL.md:51

The CLI, MCP tools, and SDK all read credentials from the environment:

Why it matters. asks the agent to read credentials

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

.opencode/skills/yandex-360-tracker/SKILL.md:51

The CLI, MCP tools, and SDK all read credentials from the environment:

Why it matters. asks the agent to read credentials

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.rulesync/skills/yandex-360

.rulesync/skills/yandex-360