Pi Coding Agent

Work happens through tools on the developer's machine. Read, bash, edit and write are on by default, grep, find and ls can be added, and PowerShell runs on Windows. MCP is built in and connects to servers over stdio or streamable HTTP with OAuth sign in, from a user file or a project file that loads after trust is granted. Extensions written in TypeScript register custom tools, and Codemode lets the model call tools and models such as classifiers and image generators from one script.

Sourcepi.dev/docs/latest/cliread 2026-11-07

One agent works through a task turn by turn. Each turn sends the active branch, tools and skills to the model, runs every tool call it returns, and starts another turn while results or queued messages need one. Codemode can run several tool calls in parallel from one JavaScript script in a QuickJS sandbox, with at most two scripts running at a time in a process. Pi ships no subagents, workflow runtime or parallel agents by design, and community packages add them as extensions.

Sourcepi.dev/docs/latest/how-pi-worksread 2026-11-07

Context is assembled for each request from Pi's base instructions, discovered context files such as AGENTS.md and CLAUDE.md, the active branch of the session, tool definitions and skill descriptions, with full skill instructions loaded only when needed. Prompt templates expand typed input, @ references bring in files, images, pasted text and shell output, and grep and find search the working folder. Pi keeps no index or embedding store over a codebase or a document collection.

Sourcepi.dev/docs/latest/how-pi-worksread 2026-11-07

There is no approval step before a command runs, by design, and the agent works with the permissions of the user who started it. The developer limits what it can do instead. A tool allowlist, excluded tools or no tools at all can be set for each run or app, a project trust prompt decides whether a folder's own settings, extensions and skills load, and steering messages and abort redirect or stop a run. Approval gates and permission systems are available as community extensions.

Sourcepi.dev/docs/latest/securityread 2026-11-07

There are no accounts, organization roles, SSO or audit log, and no SOC 2, ISO 27001 or other attestation is named. The agent runs as a local program with the user's own permissions, does not sandbox tool calls, and leaves prompt injection from untrusted content outside its security boundary. The guidance is to give it only the files and services a task needs, keep credentials short lived and out of its environment, and run it in a container or VM for untrusted repositories. A security policy covers how to report issues.

Sourcepi.dev/docs/latest/securityread 2026-11-07

Every session file records the prompts, responses, tool arguments, command output, file contents and extension messages of each turn in a published format, and /session shows the message count, token usage and cost. Sessions export as HTML or JSONL and share through a private GitHub gist or a Radius link, and JSON mode streams the events of a run to another program. The monorepo includes a telemetry package with vendor neutral contracts and a reference adapter. There is no log across an organization.

Sourcepi.dev/docs/latest/sessionsread 2026-11-07

Every conversation is saved as a session file, grouped by working directory and stored as a tree. /tree moves between branches and lets a developer edit an earlier message and resubmit it, /fork and /clone copy history into a new session, and resume picks up where work stopped, with a summary attached when a branch is left. Compaction adds a summary and keeps recent messages without deleting the original entries. Nothing learned in one session carries into the next unless the developer forks or clones it.

Sourcepi.dev/docs/latest/sessionsread 2026-11-07

Everything runs on the developer's own machine, on macOS, Linux, Windows or Android through Termux, and the agent can run fully inside a container, VM or sandbox, which the security guide calls usually the strongest practical option. Local models through llama.cpp, with a guide for NVIDIA RTX cards, keep inference on the user's hardware, and custom providers point at any compatible endpoint. There is no hosted service, so code and prompts go only to the model provider the user picks.

Sourcepi.dev/docs/latest/securityread 2026-11-07

The package gallery at pi.dev/packages lists more than 5,000 community packages of extensions, skills, themes and prompt templates, sortable by downloads, with subagents, permission systems, browser tools, MCP adapters, plan review and to do lists among them. Each installs with one command from npm or git, for the user or for one project, or loads for a single run. The listed packages come from outside authors, and none of them are published by Earendil.

Sourcepi.dev/packagesread 2026-11-07

A person or a program starts every run. Pi runs interactively in the terminal, in print mode for one off and scripted tasks, in JSON mode that streams the events of one run, in RPC mode where another process sends commands over standard input, and inside a Node.js or Bun app through the SDK. A running task can be steered or given a follow up. Nothing in Pi wakes the agent on a schedule, a webhook or an outside event.

Sourcepi.dev/docs/latest/cliread 2026-11-07

The developer picks the model. The provider list covers 38 entries, including Anthropic, OpenAI, Google Gemini and Vertex AI, GitHub Copilot, Mistral, Groq, OpenRouter, Hugging Face, Azure OpenAI, Amazon Bedrock and Cloudflare, with OAuth or API key sign in through /login. /model and a keyboard shortcut switch models mid session, flags set a model, a provider, a thinking level or a set of models to cycle through, custom providers live in models.json, and virtual models route between them. Local models run through llama.cpp.

Sourcepi.dev/docs/latest/providersread 2026-11-07

The TypeScript SDK embeds Pi in a Node.js or Bun process, with calls to create a session, send prompts, steer or abort a run, subscribe to output and lifecycle events, and choose or add tools. RPC mode takes JSONL commands from another process and returns responses and events, and JSON mode streams the events of a single run. Extensions register tools, commands, providers, event handlers and terminal UI, and the pi-ai and pi-agent-core packages expose the model API and the agent loop on their own.

Sourcepi.dev/docs/latest/sdkread 2026-11-07

Testing a change is left to the developer. The session tree lets a developer return to an earlier message, edit it and run again on a new branch, or fork the session to try another approach beside the first, with a summary of the branch left behind carried across. Pi ships no evaluation harness, test cases, scoring or review step for checking a change to the agent, a skill or a prompt.

Sourcepi.dev/docs/latest/sessionsread 2026-11-07

Pi does not control a browser or a desktop. Its built in tools are read, bash, PowerShell on Windows, edit, write, grep, find and ls, and MCP and Codemode reach other tools through programmatic interfaces. Browser tools come from community packages in the gallery, such as one backed by a hosted browser service, which the user installs.

Sourcepi.dev/docs/latest/cliread 2026-11-07