Tools do literal work, never safety logic. The brain decides which tool to call; the deterministic control layer decides whether a value-moving call is allowed. Reads are free. Every write (sui.send, swap, cetus.add_liquidity, navi.supply / withdraw, scallop.*, volo.stake, walrus.store) goes through policy, simulation, and approval first.
| Area | Tools | Notes |
|---|---|---|
| Wallet / account | account.info, sui.balance | Identity plus coin snapshot plus activity; native SUI (MIST) position. |
| Balances / coins | sui.balance, tokens.info | Coin-type discovery across owned objects (no curated list). |
| Transfers | sui.send | Native SUI and any Sui coin type; recipients are Sui addresses (0x + 64 hex). |
| Trading | swap, cetus.quote, deepbook.markets | Best-route swaps via the 7k aggregator (Cetus / FlowX / Bluefin / DeepBook); quotes compare venues and route to the best. |
| Liquidity | cetus.add_liquidity | Full-range liquidity into a Cetus CLMM pool (SUI/USDC), zap-funded from vault SUI — keeps half as SUI, swaps half to the pair coin, then adds; the position is simulated before it signs. |
| Lending | navi.*, suilend.*, scallop.* | NAVI, Suilend, and Scallop: live supply / borrow rates, supply / withdraw collateral, borrow / repay; receipts report the health factor. |
| Staking | sui.stake / unstake, volo.stake / unstake, walrus.stake / unstake | Native SUI staking to a validator, Volo liquid staking (SUI ↔ vSUI), and Walrus (WAL) staking. |
| Discovery | defi.yields | DeFiLlama analytics: Sui pools ranked by APY / TVL with risk and RWA flags (read-only). |
| Risk | risk.token | Pre-trade vet: can you exit it (live Cetus / DeepBook quote), liquidity depth, restricted-RWA flag, real-package check, into a low / elevated / high verdict. |
| Controls | policy.show, policy.create, tx.simulate | Report or set the active fund-control policy; dry-run any PTB (would-succeed plus gas, or decoded failure) without broadcasting. |
| Receipts | walrus.store | Persist auditable memory and execution receipts to Walrus, addressed by root hash. |
| Analysis | sui.tx, sui.object, sui.activity | Decode tx, introspect objects and Move packages, recent transfers. |
| Blockchain | sui.checkpoint, sui.gas | Latest checkpoint, timestamp, reference gas price plus estimated SUI cost of common ops. |
| Generic | sui.read, move.call | Any Move function by package / module / function plus args. |
Source: packages/plugin-onchain.
defi.yields surfaces every Sui pool but flags restricted RWA and tokenized yield products (for example Ondo's offerings) so the agent only proposes entering them with explicit eligibility confirmation. DeFiLlama is used for discovery and analytics only, never execution.
The agent also has a general-purpose toolkit for the work around the chain: OS-sandboxed shell and code execution, file operations, web fetch, and a headless browser. These run on the operator's machine under the OS sandbox.
Source: packages/plugin-system.
A Telegram listener turns inbound DMs into agent events. Approval prompts arrive as inline-keyboard buttons, so the same boundary applies whether you drive the agent from the terminal or your phone.
Source: packages/plugin-telegram.
The session permission mode controls how much the agent does without prompting, but the approval floor sits beneath it. A material-risk action prompts for a human even when the session is in auto / YOLO, and is denied outright under strict and read-only. Configure it with LYRA_POLICY_AUTONOMY and the rest of the LYRA_POLICY_* variables. See Configuration.
Read CLI next.
Source: packages/plugin-onchain.
Source: packages/plugin-onchain