Pi Config
@earendil-works/pi-coding-agent · by realchendahuang
My Pi coding agent setup: 17 plugins + 18 global skills + 2 MCP servers, with a one-line installer and tutorial README.
2 open CVEs
MIT license
Maintained
Last commit 49d ago
Works with most clients
Transport: stdio, http
0 tools
Grade F
MCPpedia last refreshed this data
Pi Config is an MCP server that my Pi coding agent setup: 17 plugins + 18 global skills + 2 MCP servers, with a one-line installer and tutorial README. Its tool list has not been published yet over stdio and http, requires no API key, and scores 52/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients - only the file and path differ.
CD
Supported in Claude Desktopstdio, http · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"pi-config": {
"args": [
"-y",
"@earendil-works/pi-coding-agent"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/pi-config)
Read me
What Pi Config does
██████╗ ██╗ ██████╗ ██████╗ ███╗ ██╗███████╗██╗ ██████╗ ██╔══██╗██║ ██╔════╝██╔═══██╗████╗ ██║██╔════╝██║██╔════╝ ██████╔╝██║ ██║ ██║ ██║██╔██╗ ██║█████╗ ██║██║ ███╗ ██╔═══╝ ██║ ██║ ██║ ██║██║╚██╗██║██╔══╝ ██║██║ ██║ ██║ ██║ ╚██████╗╚██████╔╝██║ ╚████║██║ ██║╚██████╔╝ ╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═══╝╚═╝ ╚═╝ ╚═════╝
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.
npx -y '@earendil-works/pi-coding-agent' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Loading README…
Scored, not listed
Why this score
Five weighted categories - click any category to see the underlying evidence.
Score breakdown
52/100across 5 weighted dimensions
0255075100
21
14
10
−48
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev2 open2 fixed
CVE-2026-54325medium · fixedCVSS 4.4
Pi Agent: Pi loads project-local extensions without approval
# Pi loads project-local extensions without approval Pi before 0.79.0 loaded project-local configuration and resources from a repository's `.pi` directory without first asking the user to trust that repository. This included project-local extensions, which are executable TypeScript or JavaScript modules loaded into the Pi process. An attacker who controls a repository could place Pi-specific project resources in that repository. If a user then started Pi from that working tree, the project-loc
CVE-2026-54328high · fixedCVSS 7.3
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts
# Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extension package source. Pi could then load attacker-controlled extens
CVE-2026-54327lowCVSS 2.2
Pi Agent: Race condition in Pi auth.json writes could expose stored credentials
# Pi auth.json writes could briefly expose stored credentials to local users Pi stored API keys and OAuth credentials in `auth.json`. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions. ## Info The affected credential storage code wrote `auth.json` and then corrected the file mode in a separate operation. During the interval between those operations, a local user
Affected:
>= 0.28.0source →CVE-2026-54326lowCVSS 2.5
Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass
# Potential XSS in HTML session exports via Markdown URL handling Pi HTML exports render session Markdown into a static HTML file. Affected versions did not consistently reject unsafe Markdown link and image URL schemes. In versions with scheme filtering, C0 control characters in the URL scheme could bypass the check because browsers normalize those characters before navigation. ## Impact The realistic attack path is indirect. An attacker would need to get suitable Markdown into a session, fo
Affected:
>= 0.27.5source →Community
Reviews
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is Pi Config safe to use?
- Pi Config has 2 known CVEs tracked by MCPpedia. You can verify these on OSV.dev by searching for "@earendil-works/pi-coding-agent". Review the Security section above for details before installing.
- How do I install Pi Config?
- Pi Config supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What AI clients work with Pi Config?
- Pi Config is compatible with claude-desktop, cursor, claude-code. It uses stdio and http transport.
- Is Pi Config actively maintained?
- Pi Config is recently maintained - last commit was 49 days ago.
Related
Similar servers
Others in education
Auto Claude Code Research In Sleep91ARIS ⚔️ (Auto-Research-In-Sleep) — Lightweight Markdown-only skills for autonomous ML research: cross-model review loops, idea discovery, and experiment automation. No framework, no lock-in — works with Claude Code, Codex, OpenClaw, or any LLM agent.
19.2k 5
I
io.github.mims-harvard/tooluniverse912,700+ scientific tools for AI scientists: life science, research, literature, and more.
1.8k 4
Daofy90Daofy for Delphi — MCP Server that compiles Delphi projects and queries knowledge base for AI assistants.
108 10
I
io.github.Fireiscoolsolo/canvas-lms-mcp-local89Student-focused Canvas LMS: 237 tools for grades, deadlines, planning, submissions and study plans.
2 1
MCP Security Weekly
Get CVE alerts and security updates for Pi Config and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.
