@earendil-works/pi-mcp

MCP server · npm · graded 2026-10-28Source linked

Standalone Model Context Protocol client for pi and other applications

No outside reports on file

This tool is largely unknown in the community, handles sensitive system access through MCP, and lacks public auditing—use only if you fully trust the creator and carefully limit what data and systems it can reach.

Based on public adoption and transparency signals as of Oct 28, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for @earendil-works/pi-mcp helpful?

What it can access

  • Local filesNo local folder access notedLOW
  • Command executionNo shell command runner notedLOW
  • Network reachConnects to outside service APINOTED
  • CredentialsRequires API key or tokenREVIEW
  • Package sourcenpm (@earendil-works/pi-mcp)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

npx -y @earendil-works/pi-mcp

All setup options ↓

Everything known

We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.

0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30

Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-28.

Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.

Check a specific version →

About @earendil-works/pi-mcp

This is a Model Context Protocol (MCP) client that connects AI applications to the pi system. It lets Claude and other AI tools interact with pi's capabilities through a standardized protocol for communication.

Who it’s for

Developers building AI applications that need to integrate with pi or other systems through the MCP standard. Teams using Claude or similar AI models that support MCP connections.

Alternatives

  • Claude's built-in tools: Use Claude's native features for file and web access when possible instead of custom connectors.
  • Anthropic-maintained MCP servers: Use officially supported servers from Anthropic or well-known developers with transparent governance.
  • Direct API clients: Build direct integrations with pi using standard APIs and proper authentication rather than relying on third-party protocol adapters.

Setup

Check these steps against the project’s own instructions before running anything.

Install via npm:

npm install @earendil-works/pi-mcp

Or add to Claude Desktop's claude_desktop_config.json:

json
{
  "mcpServers": {
    "pi-mcp": {
      "command": "npx",
      "args": ["@earendil-works/pi-mcp"]
    }
  }
}

Follow the project's README for detailed configuration steps.

Why this grade

CC — Moderate risk signals

Signal-based grade (2/7 points): heavily downloaded, no public source code found. This reflects adoption and transparency, not a code review.

Popularity and upkeep

45/100
Weekly npm downloads
2.9M
Listing last refreshed
2026-10-28

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Risks to watch for

  • Unknown developer trust: Very few GitHub stars (0) and no community visibility make it hard to verify the creator's reputation or intentions.
  • Unvetted code access: The MCP protocol gives this tool deep access to whatever system it connects to—files, environment variables, system calls—based on how it's configured.
  • Data leakage through AI: Any data the connector retrieves could be included in AI model training, conversation history, or logs unless carefully isolated.
  • Supply chain risk: Dependencies pulled from npm could include malicious packages; high weekly download numbers alone don't guarantee safety or active maintenance.
  • Configuration mistakes: Incorrect permissions or network setup could expose sensitive systems or credentials to the AI without obvious warning signs.

How to lower the risk

Least-privilege permissions

  • Grant only the specific pi functions this connector actually needs.
  • Run under a restricted user account, not root or admin.

Network isolation

  • Keep the connector on an isolated network segment if possible.
  • Disable outbound internet access unless the tool explicitly requires it.

Monitoring

  • Log all system calls and file accesses the connector makes.
  • Review Claude's conversation history for unexpected data mentions.

Red flags to watch for

  • Unexpected new dependencies added in updates.
  • Requests to disable security tools or expand permissions.
  • Data appearing in logs that shouldn't have been accessed.

Questions

How do I install @earendil-works/pi-mcp?

Run npx -y @earendil-works/pi-mcp in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page.

Are there security reports about @earendil-works/pi-mcp?

No reports found for this package in our research (last checked 2026-10-30). @earendil-works/pi-mcp currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include unknown developer trust, unvetted code access, data leakage through ai.

Is @earendil-works/pi-mcp actively maintained?

@earendil-works/pi-mcp has 2.9M weekly npm downloads, with its latest repository commit pushed on 2026-10-23. Our directory data was last refreshed on 2026-10-28. Check recent commit activity, release tags, and open issues before pinning it in production.

What are alternatives to @earendil-works/pi-mcp?

Notable alternatives to @earendil-works/pi-mcp include Claude's built-in tools (Use Claude's native features for file and web access when possible instead of custom connectors), Anthropic-maintained MCP servers (Use officially supported servers from Anthropic or well-known developers with transparent governance), Direct API clients (Build direct integrations with pi using standard APIs and proper authentication rather than relying on third-party protocol adapters). You can also compare @earendil-works/pi-mcp side by side with other MCP servers in the Related tools section on this page.

README badge and team notes

Maintain or use @earendil-works/pi-mcp? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

AgentArmorHQ Risk Grade C for @earendil-works/pi-mcp

GitHub README Markdown:

markdown
[![AgentArmorHQ Risk Grade for @earendil-works/pi-mcp](https://agentarmorhq.com/api/badge/earendil-works-pi)](https://agentarmorhq.com/skills/earendil-works-pi)

HTML embed:

html
<a href="https://agentarmorhq.com/skills/earendil-works-pi"><img src="https://agentarmorhq.com/api/badge/earendil-works-pi" alt="AgentArmorHQ Risk Grade for @earendil-works/pi-mcp" height="20" /></a>

Terminal check:

terminal
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "earendil-works-pi"

Share with your security lead

Need sign-off to use @earendil-works/pi-mcp? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: @earendil-works/pi-mcp
- **Listing URL:** https://agentarmorhq.com/skills/earendil-works-pi
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** npm (@earendil-works/pi-mcp)

#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts @earendil-works/pi-mcp`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 28, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type
App connector
Install command
npm install @earendil-works/pi-mcp
Est. context load
~850 tokens / turn (~5 tool schemas, 0.43% of 200k context)
Popularity
2.9M weekly npm downloads
Last updated
2026-10-28
Last graded
2026-10-28

Community

Discussions for @earendil-works/pi-mcp

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for @earendil-works/pi-mcp helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude