UnipiBLOCK
All-in-one, unified harness. Increasing productivity, and accuracy both at the same time. https://pi.dev/packages/@pi-unipi/unipi?name=unipi
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
23 workspace packages that turn Pi into a full development workstation. Structured workflows, persistent memory, parallel agents, web research, notifications, context management, command autocomplete, and a live status bar — all wired together through a shared event system.
One command installs everything:
pi install npm:@pi-unipi/unipi
[!TIP] UniPi 3 alpha is out. Glance footer, long-horizon goals, plan and permission modes, Fusion (lead + sidekick), kanboard v3 and more. Try it with: ``bash pi install npm:@pi-unipi/unipi@alpha`Update withpi update npm:@pi-unipi/unipi@alpha; go back to stable withpi install npm:@pi-unipi/unipi@latest`. Alpha docs: v3.0.0-alpha branch · changelog.
Requirements
- Pi (`@earendil-works/pi-coding-agent`) `^0.84.0` — Unipi 2.9.0 tracks the Pi 0.84 SDK (extension event map incl.
agent_settled,ModelRuntimesession options, kitty-protocol keyboard handling). Older Pi releases (0.80–0.83) still load most extensions, but npm will flag the peer dependency mismatch; pin@pi-unipi/*@<2.9.0if you must stay on an older Pi.
What You Get
Workflow — 20 commands that take ideas to shipped code. Brainstorm, plan, execute in worktrees, review, consolidate. The agent follows skill files step by step.
Ralph — Long-running loops that persist across sessions. Start a task, iterate through checklist items, resume after crashes. Progress tracked, state saved.
Memory — SQLite + vector search stores facts, preferences, and decisions. Project-scoped and global. The agent remembers what you told it last week.
Compactor — Zero-LLM context engine. 6-stage pipeline hits 95%+ token reduction at zero API
4962f71bd6bfOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add workflow --env FIRECRAWL_API_KEY=${FIRECRAWL_API_KEY} --env JINA_API_KEY=${JINA_API_KEY} --env OPENROUTER_API_KEY=${OPENROUTER_API_KEY} --env OPEN_ROUTER_API_KEY=${OPEN_ROUTER_API_KEY} -- npx -y @pi-unipi/[email protected]{
"mcpServers": {
"workflow": {
"command": "npx",
"args": [
"-y",
"@pi-unipi/[email protected]"
],
"env": {
"FIRECRAWL_API_KEY": "${FIRECRAWL_API_KEY}",
"JINA_API_KEY": "${JINA_API_KEY}",
"OPENROUTER_API_KEY": "${OPENROUTER_API_KEY}",
"OPEN_ROUTER_API_KEY": "${OPEN_ROUTER_API_KEY}"
}
}
}
}Exposed tools (16)
14 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
a | read | d |
brave-search | read | Web search via Brave |
compact | read | compact |
custom-runtime | read | runtime agent |
deploy | write | Deploy the service |
explore | read | Fast parallel codebase exploration |
find | read | Find things |
get_helper_result | read | Check status and retrieve results from a background agent. |
memory | read | Persistent memory management |
memory_store | read | store |
my-unipi-notes | read | User skill that merely mentions unipi |
spawn_helper | read | Launch a sub-agent for parallel work. |
stable_tool | read | A deterministic test tool. |
test-agent | read | Test agent |
work | read | Parallel file writes with transparent locking |
workflow-work | write | Execute plan |
Trust audit
BLOCKgrade F · trust 41/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
const frontmatter = yaml.load(frontmatterStr) as MemoryFrontmatter;
getDb(): { prepare(sql: string): { get(...args: unknown[]): unknown; all(...args: unknown[]): unknown[]; run(...args: unknown[]): { changes: number } }; exec(sql: string): void; close(): void } | null- **Smart-Fetch Engine:** Free (read only, no API key)
- **wigolo:** Free (search + read, local, no API key) — prefer this
auto-selection falls through to the next provider. Never tell the user wigolo
console.log(`bundled.js ${kb}KB ${Date.now() - started}ms (secret scan clean)`);apiKey: 'UNIPI_BG_DELEGATE_API_KEY',
apiKey: 'UNIPI_BG_HOOK_CONTRACT_API_KEY',
apiKey: 'UNIPI_BG_SCRIPTED_API_KEY',
const secret = "super-secret-prompt-value";
prefix-provider-payload.test.js
() => new Function('require', 'process', wrapperSource.replace(/^#!.*\n/, '')),const builtinTools: string[] = eval(builtinMatch[1]);
const tools: string[] = eval(builtinMatch![1]);
for (const path of ['../escape.txt', '../../etc/passwd', 'spill/../../outside']) {import { buildDelegateSeed, type BuiltDelegateSeed } from '../../delegate/seed.js';import type { DelegateLimits, DelegatePinnedRoute } from '../../delegate/types.js';import { prepareDelegateLaunch } from '../../delegate/runner.js';import { loadDelegateHookContractEvidence } from '../../delegate/launch.js';baseUrl: "http://127.0.0.1:1/v1",
const emoji = '👩👩👧👦';
const tricky = 'line\u2028sep\u2029para 👩👩👧👦 e\u0301 combining \u200D zwj';
const directive = 'exact directive with "quotes", \\backslash, \u2028 and emoji 👩👩👧👦';
@earendil-works/pi-agent-core, @earendil-works/pi-ai, @earendil-works/pi-coding-agent, @earendil-works/pi-tui, @types/better-sqlite3, @types/node, diff, esbuild
@types/node, vitest
Gates applied: instruction_override, no_behavioural_pass.
4962f71bd6bffull audit observations/trust-audit/mcp-server/neuron-mr-white__unipi.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 4962f71bd6bf | BLOCK | F | 41 | first audit |
Questions
What is the @pi-unipi/mcp MCP server?
All-in-one, unified harness. Increasing productivity, and accuracy both at the same time. https://pi.dev/packages/@pi-unipi/unipi?name=unipi
What tools does @pi-unipi/mcp expose?
16 in total: 14 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @pi-unipi/mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (41/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @pi-unipi/mcp need?
It reads FIRECRAWL_API_KEY, JINA_API_KEY, OPENROUTER_API_KEY, OPEN_ROUTER_API_KEY, PERPLEXITY_API_KEY, SERPAPI_KEY and TAVILY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (4962f71bd6bf), read on 2026-10-11. The repository is watched and re-audited when it changes.