Atlas / MCP servers / mnott / PAI Knowledge OS

PAI Knowledge OSBLOCK

mcp/mnott/pai

Personal AI Infrastructure

Verdict
BLOCK
Grade
F
Trust score
36 /100
Exposed tools
38 36r · 2w · 0d
Transport
stdio
License
MIT
Stars
52
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Claude Code has a memory problem. Every new session starts cold — no idea what you built yesterday, what decisions you made, or where you left off. PAI fixes this.

Install PAI and Claude remembers. Ask it what you were working on, find that conversation about the database schema, or pick up exactly where the last session ended.

  • Automatic session notes, split by topic, written by a background daemon
  • Federated keyword and semantic search across sessions, notes and vaults
  • Workers on any provider, orchestrated from one Claude Code session
  • Everything runs locally

Install

The easy way, on macOS and Linux: open Claude Code and say "Clone https://github.com/mnott/PAI and set it up for me" Claude installs PAI, runs the setup wizard and checks the daemon.

Prerequisites: Claude Code, Node.js 20 or newer, and Docker if you choose PostgreSQL.

By hand, the same on macOS and Linux:

npm i -g @tekmidian/pai
pai setup --yes --storage postgres   # keyword + semantic search (pgvector in Docker); or: --storage sqlite
pai daemon status                    # should show "running"

pai setup without --yes asks every question interactively. It installs the daemon as a LaunchAgent on macOS and a systemd user service on Linux. From a source checkout: git clone https://github.com/mnott/PAI && cd PAI && bun install && bun run build.

→ docs/install.md · docs/install-linux.md (both storage paths, Docker, systemd)

Command Reference

Every pai command area has a man page generated from the live CLI: pai help, pai help memory, pai memory --help.

→ docs/command-reference.md · docs/commands/

Worker Providers

Only the orchestrator session runs on Anthropic; every worker runs on a provider you choose, routed by class. Providers and classes live in one workers.yaml.

→ [docs/w

Read from source at commit 27a6963b9bccOBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add obsidian-pai-knowledge --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ANTHROPIC_AUTH_TOKEN=${ANTHROPIC_AUTH_TOKEN} --env PAI_PASS_BACKGROUND=${PAI_PASS_BACKGROUND} --env TODOIST_API_KEY=${TODOIST_API_KEY} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "obsidian-pai-knowledge": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "ANTHROPIC_AUTH_TOKEN": "${ANTHROPIC_AUTH_TOKEN}",
        "PAI_PASS_BACKGROUND": "${PAI_PASS_BACKGROUND}",
        "TODOIST_API_KEY": "${TODOIST_API_KEY}"
      }
    }
  }
}
03

Exposed tools (38)

36 read · 2 write · 0 destructive.

ToolRiskDescription
Barreada disabled plugin skill
Bazreadunregistered plugin skill
Fooreada skill
Sessionsreadnavigate sessions
Sharedreadsame skill twice
config_getread
config_listread
config_setwrite
config_unsetread
get_weatherreadWeather of a city
memory_feedbackread
memory_getread
memory_kg_searchread
memory_outlineread
memory_searchread
memory_taxonomyread
memory_tunnelsread
memory_wakeupread
project_detectread
project_healthread
project_inforead
project_listread
project_todoread
registry_searchread
session_listread
worker_capabilityread
worker_classesread
worker_fallbackread
worker_handoffread
worker_modelread
worker_providersread
worker_psread
worker_replayread
worker_resumeread
worker_runwrite
worker_sayread
worker_statusread
worker_toggleread
04

Trust audit

BLOCKgrade F · trust 36/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (8 observation(s))
Network
declared (9 observation(s))
Shell
declared (10 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/cli/commands/session/goto.ts:129
"\n" + chalk.bold("Dry run — would probe then exec (RESUME path):") + "\n"
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/cli/commands/session/goto.ts:147
"\n" + chalk.bold("Dry run — would exec (FRESH path, no resumable UUID):") + "\n"
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/cli/lib/launch.ts:652
console.log("\n" + chalk.bold("Dry run — would exec (WORKER path):") + "\n");
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/cli/lib/launch.ts:662
console.log("\n" + chalk.bold("Dry run — would probe then exec (RESUME path):") + "\n");
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/cli/lib/launch.ts:674
console.log("\n" + chalk.bold("Dry run — would exec (FRESH path):") + "\n");
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321
docker/migrate-sqlite.ts:15
*   bun docker/migrate-sqlite.ts --connection-string "postgresql://pai:pai@localhost:5432/pai"
HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321
docker/migrate-sqlite.ts:18
* or "postgresql://pai:pai@localhost:5432/pai" if not configured.
HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321
docker/migrate-sqlite.ts:34
let connectionString = "postgresql://pai:pai@localhost:5432/pai";
HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321
src/cli/commands/setup/steps/02-storage.ts:117
const connStr = "postgresql://pai:pai@localhost:5432/pai";
HIGHPrompt injection · prompt.hidden_comment · CWE-94, CWE-1427
templates/claude-md.template.md:3
<!-- Personal preferences and project mappings are read from ~/.claude/pai/agent-prefs.md -->
Why it matters. directive hidden in a comment the user does not see rendered
Fix. remove the comment
HIGHPrompt injection · prompt.persistence · CWE-94, CWE-1427
docs/commands/README.md:36
| [`pai shell-init`](shell-init.md) | Emit shell integration code. Add to ~/.zshrc: eval "$(pai shell-init)" |
Why it matters. instructs the agent to persist itself in the user's environment
HIGHPrompt injection · prompt.persistence · CWE-94, CWE-1427
docs/commands/README.md:215
| `pai shell-init` | Emit shell integration code. Add to ~/.zshrc: eval "$(pai shell-init)" |
Why it matters. instructs the agent to persist itself in the user's environment
HIGHPrompt injection · prompt.persistence · CWE-94, CWE-1427
docs/commands/shell-init.md:5
> Emit shell integration code. Add to ~/.zshrc: eval "$(pai shell-init)"
Why it matters. instructs the agent to persist itself in the user's environment
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
src/cli/commands/audit.ts:683
console.log(dim(`token encoding: ${data.encoding}`));
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
src/cli/commands/task.ts:517
console.log(`  ${bold("Token")}         ${redact(todoist.apiKey)}${
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
src/daemon/config.ts:280
embedding: { backend: "transformers-cpu-q8", ollama: { baseUrl: "http://127.0.0.1:11434" } },
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
src/daemon/daemon/dashboard-live.ts:68
ollamaBaseUrl: config.embedding?.ollama?.baseUrl ?? "http://127.0.0.1:11434",
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src/storage/sqlite.ts:241
WHEN path LIKE '👨💻 People/%' THEN 1
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
src/config/main-config-ops.test.ts:149
setConfigValueOp("postgres.connectionString", "postgresql://pai:hunter2@localhost:5432/pai", { force: true });
MEDIUMPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427
.claude/skills/setup/SKILL.md:342
If the user says **yes** (or this is a fresh setup): run the scan.
MEDIUMPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427
plugins/productivity/skills/Tasks/SKILL.md:3
description: "Run the task bus — read cross-session work from the tracker, dispatch it to the sessions that own it, and file new findings. USE WHEN user says 'morning routine', 'what needs doing', 'ru
MEDIUMPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427
plugins/productivity/skills/Tasks/SKILL.md:8
USE WHEN user says 'morning routine', 'what needs doing', 'run the routine', 'check my tasks', 'dispatch tasks', 'file a finding', 'add this to todoist', 'what did we find', OR /tasks.
MEDIUMSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
.claude/skills/setup/SKILL.md:49
curl -fsSL https://bun.sh/install | bash
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/cli/commands/audit.test.ts:13
import type { Finding } from "../../audit/severity.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/cli/commands/audit.ts:45
import { TOKEN_ENCODING } from "../../audit/tokens.js";

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 27a6963b9bccfull audit observations/trust-audit/mcp-server/mnott__pai.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1127a6963b9bccBLOCKF36first audit
06

Questions

What is the @tekmidian/pai MCP server?

Personal AI Infrastructure

What tools does @tekmidian/pai expose?

38 in total: 36 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is @tekmidian/pai safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (36/100) and found 13 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does @tekmidian/pai need?

It reads ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, PAI_PASS_BACKGROUND and TODOIST_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does @tekmidian/pai run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as obsidian-pai-knowledge at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (27a6963b9bcc), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement