Atlas / MCP servers / earendil-works / Pi

PiBLOCK

Name: Pi
Author: earendil-works

mcp/earendil-works/pi

MCP server by earendil-works · Audited 2026-10-11

⚑ Report / re-scan Source ↗

AI agent toolkit: unified LLM API, agent loop, TUI, coding agent CLI

Verdict

BLOCK

Grade

Trust score

39 /100

Exposed tools

133 114r · 16w · 3d

Transport

streamable-http

License

MIT

Stars

114,265

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

New issues and PRs from new contributors are auto-closed by default. Maintainers review auto-closed issues daily. See CONTRIBUTING.md.

Pi is a minimal, extensible agent harness that you can make your own.

Adapt Pi to your workflows, not the other way around. Customize Pi with extensions, skills, prompt templates, and themes. Bundle them as Pi packages and share via npm or git.

Pi ships with powerful defaults but skips features like sub-agents and plan mode. Ask Pi to build what you want, or install a package that does it your way.

Use Pi interactively, automate it in print or JSON mode, control it over RPC, or build apps with the Pi TypeScript SDK. See OpenClaw for a real-world integration.

Getting started

Install the command-line interface:

curl -fsSL https://pi.dev/install.sh | sh

On Windows:

powershell -c "irm https://pi.dev/install.ps1 | iex"

The installer pins all dependencies and updates Pi with pi update. Alternatively, install directly with npm, which does not pin transitive dependenci

Read from source at commit 4dcd6d34635cOBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add pi-tui --env ACME_STREAM_API_KEY=${ACME_STREAM_API_KEY} --env AI_GATEWAY_API_KEY=${AI_GATEWAY_API_KEY} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ANTHROPIC_AUTH_TOKEN=${ANTHROPIC_AUTH_TOKEN} -- npx -y @earendil-works/[email protected]

claude-desktop

{
  "mcpServers": {
    "pi-tui": {
      "command": "npx",
      "args": [
        "-y",
        "@earendil-works/[email protected]"
      ],
      "env": {
        "ACME_STREAM_API_KEY": "${ACME_STREAM_API_KEY}",
        "AI_GATEWAY_API_KEY": "${AI_GATEWAY_API_KEY}",
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "ANTHROPIC_AUTH_TOKEN": "${ANTHROPIC_AUTH_TOKEN}"
      }
    }
  }
}

Exposed tools (133)

114 read · 16 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`__pi_deferred_placeholder__`	read	Reserved placeholder. Never available. Never call this.
`arg-test`	read	test
`attach`	read	Attach it.
`bad`	read	bad
`base_tool`	read	base_tool tool
`bash`	write	Execute a bash command in the current working directory. Returns combined stdout and stderr. Output is truncated to last ${DEFAULT_MAX_LINES} lines or ${DEFAULT_MAX_BYTES / 1024}KB (whichever is hit first). If truncated, full output is saved to a temp file. Optionally provide a timeout in seconds.
`blob`	read	Stream a blob
`broken`	read	Starts owned work, then returns a result that is not strict JSON
`bug`	read	Report a bug to the Pi developers
`calculate`	read	Evaluate mathematical expressions
`calculator`	read	Perform basic arithmetic operations
`changelog`	read	Show changelog entries
`classify`	read	Classify images
`clear`	destructive	Clear all messages
`clone`	read	Duplicate the current session at the current position
`compact`	read	Manually compact the session context
`constrained`	read	A constrained tool
`copy`	read	Copy last agent message to clipboard
`count`	read	Adds to a counter kept in the session and returns the new value
`custom-skill`	read	A custom skill
`delegate`	read	Delegates
`delete`	destructive	Delete the last message
`demo`	read	Test
`deploy`	write	Deploy the application
`deterministic_probe`	read	Mandatory benchmark tool. Call exactly once with the turn and marker from the user prompt.
`double_number`	read	Doubles a number and returns the result
`drive`	read	Driven by the test
`dummy`	read	Dummy tool
`duplicate-tool`	read	First
`echo`	read	Echo input
`echo_value`	read	Echo a string value
`edit`	write	Edit a file.
`emit`	read
`example`	read	tool declaration
`export`	read	Export session (HTML default, or specify path: .html/.jsonl)
`fail`	read	Always fails.
`fan`	read	Call leaf in parallel
`find`	read	Find files by pattern
`foo`	read	bar
`fork`	write	Create a new fork from a previous user message
`get_circle`	read	Returns a circle image for visualization
`get_circle_with_description`	read	Returns a circle image with a text description
`get_current_time`	read	Get the current date and time
`grep`	read	Search a file
`hello`	read	Call the bundled Session worker facet
`help`	read	Show help
`hidden-skill`	read	A hidden skill.
`hold`	read	Waits
`hotkeys`	read	Show all keyboard shortcuts
`import`	write	Import and resume a session from a JSONL file
`injected`	read	Injected skill
`inspect_schema`	read	Inspect the schema
`late`	read	late
`late_tool`	read	late_tool tool
`later`	read	Finishes first
`leaf`	read	Return at once
`linkedin_skill`	read	Get LinkedIn comments
`list`	read	List a directory
`load-skills`	read	Load skills
`login`	read	Configure provider authentication
`logout`	destructive	Remove provider authentication
`lookup`	read	Look up a value
`math_operation`	read	Perform basic arithmetic operations
`mcp__docs`	read	Search the product docs
`mcp__docs__search`	read
`mcp__github`	read	GitHub server
`mcp__x`	read	Kubernetes cluster tools
`model`	read	Select model (opens selector UI)
`models.list`	read	List models.
`my-skill`	read	Custom project instructions
`my-tool`	read	Dashes
`my_custom_tool`	read	A custom tool
`my_tool`	read	Shadowed
`name`	write	Set session display name
`new`	write	Start a new session
`noop`	read	noop
`optional`	read	Optional constrained sampling
`ordinary`	read	An ordinary tool
`pair`	read	pair
`ping`	read	Ping
`preferred`	read	Preferred constrained tool
`print`	read	Prints
`probe`	read	probe
`probe_first`	read	Unused probe tool.
`probe_second`	read	Unused probe tool added on the second turn.
`project-agent`	read	Project test agent
`quit`	read	Quit ${APP_NAME}
`read`	read	Read a file
`read-file`	read	dashed
`read_file`	read	underscored
`read_image`	read	Read an image
`read_issue`	read	Read one issue in full: status, labels, and body.
`reload`	read	Reload keybindings, extensions, skills, prompts, themes, and context files
`research`	write	Start a research subagent in the background. It searches while you keep talking with the user; its report arrives later as a message starting with [research report].
`resume`	read	Resume a different session
`review`	read	Review template
`sample_tool`	read	Sample tool
`scoped-models`	write	Enable/disable models for Ctrl+P cycling
`script`	read	Read and classify images
`search`	read	Search travel information about a city. Topics: weather, museums, trains. Slow; call several in parallel.
`search_issues`	read	Keyword search over the repository
`second`	read	second tool
`session`	read	Show session info and stats
`settings`	read	Open settings menu
`share`	read	Share session as a secret GitHub gist
`share_tool`	read	Render a value for sharing
`shot`	read	Returns an image.
`skill-one`	read	First skill.
`skill-two`	read	Second skill.
`slow`	read	slow
`spawn`	read	Starts owned work, then throws or hangs
`steps`	read	Streams three steps
`strict`	read	Strict constrained sampling
`subagent`	read	Delegate a self-contained task to a subagent with the same tools and get its answer back. Give it everything it needs to know; it does not see this conversation.
`submit_plan`	write	Submit the plan as a list of steps.
`submit_triage`	write	Record the triage result. Call exactly once, as the last step.
`t1`	read	strict tool
`t2`	read	non-strict tool
`tail`	read	Prints lines
`test`	read	test tool
`test-skill`	read	A test skill.
`test_tool`	read	A test tool
`thinking`	write	Set thinking level
`todo`	write	Add an item to your todo list
`todowrite`	write	Write a todo item
`tree`	read	Navigate session tree (switch branches)
`trust`	write	Save project trust decision for future sessions
`unrelated`	read	unrelated
`version`	read	Report the tool
`visible-skill`	read	A visible skill.
`wait`	read	wait
`write`	write	Write a file
`x`	read	a */ b

Trust audit

BLOCKgrade F · trust 39/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (6 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/coding-agent/src/core/export-html/vendor/highlight.min.js:133

}),!0),this.lastIndex=0}exec(e){this.matcherRe.lastIndex=this.lastIndex

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

packages/ai/src/providers/google-vertex.ts:6

const VERTEX_ADC_PATH = "~/.config/gcloud/application_default_credentials.json";

Why it matters. touches a credential store

MEDIUMInventory / provenance · inv.binary · CWE-1104

packages/tui/native/darwin/prebuilds/darwin-arm64/darwin-platform.node

darwin-platform.node

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

packages/tui/native/darwin/prebuilds/darwin-x64/darwin-platform.node

darwin-platform.node

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

packages/tui/native/linux/prebuilds/linux-arm64/linux-platform-x11.node

linux-platform-x11.node

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

packages/tui/native/linux/prebuilds/linux-x64/linux-platform-x11.node

linux-platform-x11.node

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInsecure crypto · crypto.weak_random · CWE-327, CWE-338

packages/ai/src/providers/faux.ts:291

const tokenSize = minTokenSize + Math.floor(Math.random() * (maxTokenSize - minTokenSize + 1));

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

packages/ai/src/auth/oauth/openrouter.ts:129

callback_url: callback.redirectUri,

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/ai/src/auth/oauth/openai-chatgpt.ts:25

const REDIRECT_URI = `http://127.0.0.1:${CALLBACK_PORT}${CALLBACK_PATH}`;

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

packages/ai/test/github-copilot-anthropic.test.ts:87

const s = streamAnthropic(model, context, { apiKey: "tid_copilot_session_test_token" });

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

packages/ai/test/github-copilot-anthropic.test.ts:120

apiKey: "tid_copilot_session_test_token",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

packages/ai/test/google-vertex-api-key-resolution.test.ts:96

apiKey: "gcp-vertex-credentials",

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

clear, delete, logout

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.binary · CWE-1104

packages/coding-agent/examples/extensions/doom-overlay/doom/build/doom.wasm

doom.wasm

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.suspicious_name · CWE-1104

packages/ai/test/bedrock-thinking-payload.test.ts

bedrock-thinking-payload.test.ts

Why it matters. member named after an attack tool

Fix. remove or justify

LOWInventory / provenance · inv.suspicious_name · CWE-1104

packages/coding-agent/examples/extensions/provider-payload.ts

provider-payload.ts

Why it matters. member named after an attack tool

Fix. remove or justify

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/agent/test/utils/calculate.ts:12

const result = new Function(`return ${expression}`)();

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/ai/test/validation.test.ts:188

const generatedCheck = new Function(Compile(tool.parameters).Code())() as (value: unknown) => boolean;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/codemode/test/sandbox.test.ts:716

new Function("return typeof process")(),

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/coding-agent/examples/extensions/doom-overlay/doom-engine.ts:65

const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/ai/test/total-tokens.test.ts:519

console.log(`\nXiaomi MiMo Token Plan CN / ${llm.id}:`);

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/ai/test/total-tokens.test.ts:544

console.log(`\nXiaomi MiMo Token Plan AMS / ${llm.id}:`);

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/ai/test/total-tokens.test.ts:569

console.log(`\nXiaomi MiMo Token Plan SGP / ${llm.id}:`);

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/ai/test/total-tokens.test.ts:594

console.log(`\nQwen Token Plan / ${llm.id}:`);

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/ai/test/total-tokens.test.ts:619

console.log(`\nQwen Token Plan Individual / ${llm.id}:`);

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 4dcd6d34635cfull audit observations/trust-audit/mcp-server/earendil-works__pi.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-11	`4dcd6d34635c`	BLOCK	F	39	first audit

Questions

What is the @earendil-works/pi-mcp MCP server?

AI agent toolkit: unified LLM API, agent loop, TUI, coding agent CLI

What tools does @earendil-works/pi-mcp expose?

133 in total: 114 read-only, 16 that write, and 3 that can delete or overwrite (clear, delete, logout). Every one is listed on this page with its risk.

Is @earendil-works/pi-mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (39/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does @earendil-works/pi-mcp need?

It reads ACME_STREAM_API_KEY, AI_GATEWAY_API_KEY, ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, ANTHROPIC_OAUTH_TOKEN, ANT_LING_API_KEY, AWS_ACCESS_KEY_ID, AWS_BEARER_TOKEN_BEDROCK, AWS_SECRET_ACCESS_KEY, AZURE_OPENAI_API_KEY, BASETEN_API_KEY and CEREBRAS_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does @earendil-works/pi-mcp run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @earendil-works/pi-tui at 1.1.0.

How current is this page?

The grade is for one exact copy of the source (4dcd6d34635c), read on 2026-10-11. The repository is watched and re-audited when it changes.

Source	earendil-works/pi
npm	`@earendil-works/pi-tui@1.1.0`
Transports	streamable-http
Credentials it reads	`ACME_STREAM_API_KEYAI_GATEWAY_API_KEYANTHROPIC_API_KEYANTHROPIC_AUTH_TOKENANTHROPIC_OAUTH_TOKENANT_LING_API_KEYAWS_ACCESS_KEY_IDAWS_BEARER_TOKEN_BEDROCKAWS_SECRET_ACCESS_KEYAZURE_OPENAI_API_KEYBASETEN_API_KEYCEREBRAS_API_KEY`
License	MIT
Activity	pushed 0d ago