pi-mcp-extensionCAUTION
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/pi-mcp-extension) [](https://github.com/irahardianto/pi-mcp-extension/blob/main/LICENSE)
Connect [Pi](https://pi.dev) to any MCP server. Supabase, DeepSource, Playwright, Context7, filesystem, databases — if it speaks MCP, Pi can use it.
pi-mcp-extension is a production-ready Model Context Protocol client extension for the Pi coding agent. It manages server connections, discovers tools, and bridges them into Pi so the LLM can call them directly.
Features
- Multi-transport —
stdiosubprocesses,streamable-http, and legacysseout of the box - Auto-discovery — Paginated
tools/listwith cursor following (MCP 2025-03-26 spec) - Live tool refresh —
notifications/tools/list_changedtriggers re-discovery without restart - Clean cancellation —
AbortSignalpropagation vianotifications/cancelled - Smart reconnection — Fixed delay retry schedule (1s → 3s → 5s → 10s → 30s), configurable max retries
- Health checks — Opt-in periodic pings to detect stale connections
- Safe process lifecycle — PID tracking with safety-net
SIGKILLfor orphaned subprocesses - Stable tool names — Sanitized, collision-avoiding names (max 64 chars) that stay constant across reconnects
- No tool churn — Activate/deactivate pattern ensures tools don't flicker during reconnection
- Global + project config — Layered config (project overrides global) with per-server tuning
- Tool annotations —
readOnlyHint,destructiveHint,idempotentHint,openWorldHintsurfaced in tool descriptions - Structured error handling — Distinct error codes for config, connection, protocol, and tool-level failures
- OAuth 2.1 — Browser authorization with PKCE, protected-resource
78f37413c90dOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add pi-mcp-extension -- npx -y [email protected]
{
"mcpServers": {
"pi-mcp-extension": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (6)
4 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add | write | Add two numbers |
count | read | Count items |
delete_record | destructive | Delete a record |
echo | read | Echo back the provided message [read-only] |
fail_tool | read | A tool that always returns isError: true |
get_status | read | Get server status |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (7)
return this._redirectUrl || `http://127.0.0.1:${callbackPort}/callback`;delete_record
1. **Local Callback Server** - Uses `http://127.0.0.1:19876/callback` by default
| `redirectUrl` | `string` | `http://127.0.0.1:19876/callback` | Local HTTP loopback callback used by `/mcp:auth` |
base = `http://127.0.0.1:${address.port}`;"team server": { lifecycle: "lazy", transport: "streamable-http", url: `${base}/mcp`, auth: { type: "oauth", clientId: "test-client", redirectUrl: `http://127.0.0.1:${callbackAddress.port}/callback` }@modelcontextprotocol/sdk, zod, @types/node, tsx, typescript
Gates applied: no_behavioural_pass.
78f37413c90dfull audit observations/trust-audit/mcp-server/irahardianto__pi-mcp-extension.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 78f37413c90d | CAUTION | B | 89 | first audit |
Questions
What tools does pi-mcp-extension expose?
6 in total: 4 read-only, 1 that write, and 1 that can delete or overwrite (delete_record). Every one is listed on this page with its risk.
Is pi-mcp-extension safe to connect to an agent?
With care. The audit graded it B (89/100) and found 7 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does pi-mcp-extension need?
No credential environment variables were found in its source, so it appears to need none.
How does pi-mcp-extension run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as pi-mcp-extension at 1.5.1.
How current is this page?
The grade is for one exact copy of the source (78f37413c90d), read on 2026-10-12. The repository is watched and re-audited when it changes.