project
Pi is an AI coding agent from Earendil Works that runs MCP tool calls in a sandbox, keeping their output out of the model's context.
No evidence-backed relationships are recorded.
Pi shipped MCP in v0.99.0 using a sandbox that keeps tool schemas out of context, where three servers took 143,000 of Perplexity's 200,000 tokens. Other harnesses can copy the design if they are willing to host an interpreter that runs model-written code.
Reality
Bouras, Dai and Mechtaev found a static denylist let 46 of 75 prompt injections execute in a coding agent, against 3 under preflight-scoped capabilities. A same-day Google report of malware stealing OIDC tokens from GitHub Actions runners puts the outer limit on an agent in the CI job's permissions.
Reality
Earendil's Pi 1.0 coding agent ships native MCP support after more than a year of criticising the protocol, running tool calls inside a WASM sandbox. The team credits a more stateless July 2026 spec and a sandbox it already needed for non-LLM models, so MCP support was a small addition.
Reality
Pi made MCP a core feature in version 0.99.0 on September 29, 2026, after its creator Mario Zechner spent over a year arguing against the protocol. In Pi, models call MCP tools from JavaScript in a QuickJS sandbox, so tool schemas are not preloaded into context.
Reality
Jev answers propositions with calibrated probabilities, and the gate around it mirrors every threshold on 0.5, so a two-point tightening of the secret-egress cutoff deleted two thirds of the band that catches exfiltration.
Reality
Codex made the session Item a wire type and Pi gave every entry a nullable parentId, while Claude Code squeezes the transcript in five stages. The three designs diverge on what stays addressable after compaction.
Reality
A review of v0.84.2 is blunt: no built-in sandbox, no permission layer. Three of the four default tools change the machine, and whatever sits between them and your repo is code you own.
Reality
Oh-My-Pi makes a write conditional on the target lines still hashing the same, so the loser of a race gets an error instead of a wrecked file. The guarantee is paid for in retries.
Reality
A 2.5-year retrospective spanning more than 250 engineering teams credits a LiteLLM-based API proxy, stood up in January 2024, for metering adoption and forcing client upgrades.
Reality