ModelsAtlas
Explore
Atlas / MCP servers / tgyd-helige / Pi

PiBLOCK

mcp/tgyd-helige/pi
MCP server by tgyd-helige · agent extension · agent runtime · ai agent · Audited 2026-10-11
⚑ Report / re-scanSource ↗

Pluggable extension packages for the Pi AI-agent runtime. Each package exposes LLM-callable tools via MCP — covering IM workspace integrations (Lark, DingTalk, WeCom), browser & computer automation, persistent memory, telemetry, task scheduling, image generation, web access, security policies, and m

Verdict
BLOCK
Grade
F
Trust score
56 /100
Exposed tools
14 12r · 2w · 0d
Transport
stdio
License
Apache-2.0
Stars
79
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Shared TypeScript packages for Pi runtime applications.

This repository contains the open-source runtime contracts, adapters, and orchestration helpers that are consumed by Pi Agent and related applications. The packages are intentionally small and composable: host applications provide HTTP routing, authentication, model runtime setup, deployment configuration, and product-specific UI.

Packages

Read from source at commit 6df722977e2bOBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add pi-eval --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ARK_API_KEY=${ARK_API_KEY} --env CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN} --env DASHSCOPE_API_KEY=${DASHSCOPE_API_KEY} -- npx -y @amaster.ai/[email protected]
claude-desktop
{
  "mcpServers": {
    "pi-eval": {
      "command": "npx",
      "args": [
        "-y",
        "@amaster.ai/[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "ARK_API_KEY": "${ARK_API_KEY}",
        "CLOUDFLARE_API_TOKEN": "${CLOUDFLARE_API_TOKEN}",
        "DASHSCOPE_API_KEY": "${DASHSCOPE_API_KEY}"
      }
    }
  }
}
03

Exposed tools (14)

12 read · 2 write · 0 destructive.

ToolRiskDescription
Alphareaddesc
bashwriteRun command
clickreadClick
evaluatereadEvaluate.
fillreadFill
lighthouse_auditwriteRun audit.
navigatereadNavigate.
navigate_pagereadNavigate.
pingerreadPings the server every 5 minutes
platform_specific_toolreadLive platform contract
take_screenshotreadTake screenshot.
take_snapshotreadTake snapshot.
type_textreadType
web_searchreadSearch the web for information
04

Trust audit

BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (3 observation(s))
Shell
declared (1 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
packages/pi-lark/src/cli.ts:16
exec(command, (error, stdout, stderr) => {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHObfuscation / stealth · obf.rtl_override · CWE-506, CWE-94
packages/shared/src/threat-patterns.ts:140
'', // left-to-right embedding
HIGHObfuscation / stealth · obf.rtl_override · CWE-506, CWE-94
packages/shared/src/threat-patterns.ts:141
'', // right-to-left embedding
HIGHObfuscation / stealth · obf.rtl_override · CWE-506, CWE-94
packages/shared/src/threat-patterns.ts:142
'', // pop directional formatting
HIGHObfuscation / stealth · obf.rtl_override · CWE-506, CWE-94
packages/shared/src/threat-patterns.ts:143
'', // left-to-right override
HIGHObfuscation / stealth · obf.rtl_override · CWE-506, CWE-94
packages/shared/src/threat-patterns.ts:144
'', // right-to-left override
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
packages/shared/src/threat-patterns.ts:58
[String.raw`(heartbeat|beacon|check[\s\-]?in)\s+(to|with)\s+`, 'c2_heartbeat', 'context'],
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
packages/shared/src/threat-patterns.ts:62
String.raw`you\s+must\s+(?:\w+\s+){0,3}(register|connect|report|beacon)\b`,
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
packages/shared/src/threat-patterns.ts:84
[String.raw`\bc2\s+(?:server|channel|infrastructure|beacon)\b`, 'c2_explicit', 'context'],
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
packages/shared/src/threat-patterns.ts:132
'', // zero-width space
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
packages/shared/src/threat-patterns.ts:133
'', // zero-width non-joiner
LOWInventory / provenance · inv.symlink · CWE-1104
CLAUDE.md
CLAUDE.md
Why it matters. link not followed
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
.github/workflows/agentic-eval.yml:52
name: Browser eval (task completion)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
.github/workflows/agentic-eval.yml:163
name: Computer eval (task completion, macOS)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
.github/workflows/agentic-eval.yml:226
name: Video eval (ViMax-Bench render quality)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
.github/workflows/memory-eval.yml:40
name: Memory eval (LoCoMo)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
packages/pi-memory/src/__tests__/threat-patterns.test.ts:18
expect(scanForThreats('write to authorized_keys', 'strict')).toContain('ssh_backdoor');
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
packages/pi-memory/src/__tests__/threat-patterns.test.ts:19
expect(scanForThreats('write to authorized_keys', 'all')).not.toContain('ssh_backdoor');
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
packages/pi-memory/src/__tests__/threat-patterns.test.ts:66
expect(scanForThreats('write to authorized_keys', 'context')).not.toContain('ssh_backdoor');
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
packages/pi-memory/src/__tests__/threat-patterns.test.ts:67
expect(scanForThreats('write to authorized_keys', 'strict')).toContain('ssh_backdoor');
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
packages/pi-memory/src/__tests__/threat-patterns.test.ts:85
const findings = scanForThreats('cat ~/.netrc', 'all');
Why it matters. touches a credential store
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/scripts/skill-eval.test.mjs:420
'../../packages/pi-image-gen/skills/image-gen/evals.json',
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/scripts/skill-eval.test.mjs:421
'../../packages/pi-video-gen/skills/video-gen/evals.json',
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/scripts/skill-eval.test.mjs:430
const data = JSON.parse(readFileSync(new URL(`../../packages/pi-${name}-gen/skills/${name}-gen/evals.json`, import.meta.url), 'utf8'));
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/pi-channels/src/adapters/wecom/adapter.ts:13
} from '../../types.js';

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 6df722977e2bfull audit observations/trust-audit/mcp-server/tgyd-helige__pi.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-116df722977e2bBLOCKF56first audit
06

Questions

What is the @amaster.ai/pi-computer-use MCP server?

Pluggable extension packages for the Pi AI-agent runtime. Each package exposes LLM-callable tools via MCP — covering IM workspace integrations (Lark, DingTalk, WeCom), browser & computer automation, persistent memory, telemetry, task scheduling, image generation, web access, security policies, and m

What tools does @amaster.ai/pi-computer-use expose?

14 in total: 12 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is @amaster.ai/pi-computer-use safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (56/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does @amaster.ai/pi-computer-use need?

It reads ANTHROPIC_API_KEY, ARK_API_KEY, CLOUDFLARE_API_TOKEN, DASHSCOPE_API_KEY, DEEPSEEK_API_KEY, DINGTALK_CLIENT_SECRET, FEISHU_APP_SECRET, FIRECRAWL_API_KEY, GEMINI_API_KEY, GH_TOKEN, LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does @amaster.ai/pi-computer-use run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @amaster.ai/pi-eval at 0.0.0.

How current is this page?

The grade is for one exact copy of the source (6df722977e2b), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement