Atlas / MCP servers / neuron-mr-white / Unipi

UnipiBLOCK

mcp/neuron-mr-white/unipi

All-in-one, unified harness. Increasing productivity, and accuracy both at the same time. https://pi.dev/packages/@pi-unipi/unipi?name=unipi

Verdict
BLOCK
Grade
F
Trust score
41 /100
Exposed tools
16 14r · 2w · 0d
Transport
—
License
MIT
Stars
71
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

23 workspace packages that turn Pi into a full development workstation. Structured workflows, persistent memory, parallel agents, web research, notifications, context management, command autocomplete, and a live status bar — all wired together through a shared event system.

One command installs everything:

pi install npm:@pi-unipi/unipi
[!TIP] UniPi 3 alpha is out. Glance footer, long-horizon goals, plan and permission modes, Fusion (lead + sidekick), kanboard v3 and more. Try it with: ``bash pi install npm:@pi-unipi/unipi@alpha ` Update with pi update npm:@pi-unipi/unipi@alpha; go back to stable with pi install npm:@pi-unipi/unipi@latest`. Alpha docs: v3.0.0-alpha branch · changelog.

Requirements

  • Pi (`@earendil-works/pi-coding-agent`) `^0.84.0` — Unipi 2.9.0 tracks the Pi 0.84 SDK (extension event map incl. agent_settled, ModelRuntime session options, kitty-protocol keyboard handling). Older Pi releases (0.80–0.83) still load most extensions, but npm will flag the peer dependency mismatch; pin @pi-unipi/*@<2.9.0 if you must stay on an older Pi.

What You Get

Workflow — 20 commands that take ideas to shipped code. Brainstorm, plan, execute in worktrees, review, consolidate. The agent follows skill files step by step.

Ralph — Long-running loops that persist across sessions. Start a task, iterate through checklist items, resume after crashes. Progress tracked, state saved.

Memory — SQLite + vector search stores facts, preferences, and decisions. Project-scoped and global. The agent remembers what you told it last week.

Compactor — Zero-LLM context engine. 6-stage pipeline hits 95%+ token reduction at zero API

Read from source at commit 4962f71bd6bfOBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add workflow --env FIRECRAWL_API_KEY=${FIRECRAWL_API_KEY} --env JINA_API_KEY=${JINA_API_KEY} --env OPENROUTER_API_KEY=${OPENROUTER_API_KEY} --env OPEN_ROUTER_API_KEY=${OPEN_ROUTER_API_KEY} -- npx -y @pi-unipi/[email protected]
claude-desktop
{
  "mcpServers": {
    "workflow": {
      "command": "npx",
      "args": [
        "-y",
        "@pi-unipi/[email protected]"
      ],
      "env": {
        "FIRECRAWL_API_KEY": "${FIRECRAWL_API_KEY}",
        "JINA_API_KEY": "${JINA_API_KEY}",
        "OPENROUTER_API_KEY": "${OPENROUTER_API_KEY}",
        "OPEN_ROUTER_API_KEY": "${OPEN_ROUTER_API_KEY}"
      }
    }
  }
}
03

Exposed tools (16)

14 read · 2 write · 0 destructive.

ToolRiskDescription
areadd
brave-searchreadWeb search via Brave
compactreadcompact
custom-runtimereadruntime agent
deploywriteDeploy the service
explorereadFast parallel codebase exploration
findreadFind things
get_helper_resultreadCheck status and retrieve results from a background agent.
memoryreadPersistent memory management
memory_storereadstore
my-unipi-notesreadUser skill that merely mentions unipi
spawn_helperreadLaunch a sub-agent for parallel work.
stable_toolreadA deterministic test tool.
test-agentreadTest agent
workreadParallel file writes with transparent locking
workflow-workwriteExecute plan
04

Trust audit

BLOCKgrade F · trust 41/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (5 observation(s))
Shell
declared (6 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
packages/memory/storage.ts:157
const frontmatter = yaml.load(frontmatterStr) as MemoryFrontmatter;
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
packages/compactor/src/session/db.ts:320
getDb(): { prepare(sql: string): { get(...args: unknown[]): unknown; all(...args: unknown[]): unknown[]; run(...args: unknown[]): { changes: number } }; exec(sql: string): void; close(): void } | null
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427
packages/web-api/skills/web/SKILL.md:155
- **Smart-Fetch Engine:** Free (read only, no API key)
Why it matters. asks the agent to read credentials
HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427
packages/web-api/skills/web/SKILL.md:156
- **wigolo:** Free (search + read, local, no API key) — prefer this
Why it matters. asks the agent to read credentials
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
packages/web-api/skills/web/SKILL.md:131
auto-selection falls through to the next provider. Never tell the user wigolo
Why it matters. asks the agent to act without the user's knowledge
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/build-bundle.mjs:91
console.log(`bundled.js  ${kb}KB  ${Date.now() - started}ms  (secret scan clean)`);
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/background-tasks/src/__tests__/scripted-provider/delegate-guard-provider.ts:170
apiKey: 'UNIPI_BG_DELEGATE_API_KEY',
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/background-tasks/src/__tests__/scripted-provider/hook-contract-provider.ts:135
apiKey: 'UNIPI_BG_HOOK_CONTRACT_API_KEY',
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/background-tasks/src/__tests__/scripted-provider/scripted-provider-extension.ts:339
apiKey: 'UNIPI_BG_SCRIPTED_API_KEY',
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/utility/tests/prefix-cache.test.ts:117
const secret = "super-secret-prompt-value";
LOWInventory / provenance · inv.suspicious_name · CWE-1104
tests/prefix-provider-payload.test.js
prefix-provider-payload.test.js
Why it matters. member named after an attack tool
Fix. remove or justify
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
packages/background-tasks/src/__tests__/registry.test.ts:408
() => new Function('require', 'process', wrapperSource.replace(/^#!.*\n/, '')),
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
packages/subagents/src/__tests__/badge-generation.test.ts:44
const builtinTools: string[] = eval(builtinMatch[1]);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
packages/subagents/src/__tests__/badge-generation.test.ts:55
const tools: string[] = eval(builtinMatch![1]);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/background-tasks/src/__tests__/delegate-artifacts.test.ts:258
for (const path of ['../escape.txt', '../../etc/passwd', 'spill/../../outside']) {
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/background-tasks/src/__tests__/helpers/delegate-deterministic-seed.ts:3
import { buildDelegateSeed, type BuiltDelegateSeed } from '../../delegate/seed.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/background-tasks/src/__tests__/helpers/delegate-deterministic-seed.ts:4
import type { DelegateLimits, DelegatePinnedRoute } from '../../delegate/types.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/background-tasks/src/__tests__/scripted-provider/delegate-ambient-provider.test.ts:8
import { prepareDelegateLaunch } from '../../delegate/runner.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/background-tasks/src/__tests__/scripted-provider/delegate-ambient-provider.test.ts:9
import { loadDelegateHookContractEvidence } from '../../delegate/launch.js';
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
tests/prefix-provider-payload.test.js:15
baseUrl: "http://127.0.0.1:1/v1",
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
packages/background-tasks/src/__tests__/delegate-budget.test.ts:196
const emoji = '👩👩👧👦';
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
packages/background-tasks/src/__tests__/delegate-result-package.test.ts:80
const tricky = 'line\u2028sep\u2029para 👩👩👧👦 e\u0301 combining \u200D zwj';
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
packages/background-tasks/src/__tests__/delegate-seed.test.ts:202
const directive = 'exact directive with "quotes", \\backslash, \u2028 and emoji 👩👩👧👦';
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@earendil-works/pi-agent-core, @earendil-works/pi-ai, @earendil-works/pi-coding-agent, @earendil-works/pi-tui, @types/better-sqlite3, @types/node, diff, esbuild
Why it matters. 10 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/autocomplete/package.json
@types/node, vitest
Why it matters. 2 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 4962f71bd6bffull audit observations/trust-audit/mcp-server/neuron-mr-white__unipi.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-114962f71bd6bfBLOCKF41first audit
06

Questions

What is the @pi-unipi/mcp MCP server?

All-in-one, unified harness. Increasing productivity, and accuracy both at the same time. https://pi.dev/packages/@pi-unipi/unipi?name=unipi

What tools does @pi-unipi/mcp expose?

16 in total: 14 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is @pi-unipi/mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (41/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does @pi-unipi/mcp need?

It reads FIRECRAWL_API_KEY, JINA_API_KEY, OPENROUTER_API_KEY, OPEN_ROUTER_API_KEY, PERPLEXITY_API_KEY, SERPAPI_KEY and TAVILY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (4962f71bd6bf), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement