Pi ships four tools and no sandbox, so the guardrails are on your build list

Count the default tool set by what it does rather than how many entries it has. `read` observes. `write`, `edit` and `bash` change the machine, which puts three of the four defaults on the mutating side of the line ^[14]. The review's security position sits directly on top of that arithmetic: no built-in security sandbox, and no permission system of the kind a developer arriving from Claude Code would expect to find ^[3].

The one security measure the quickstart names is `--ignore-scripts` on the npm install, which suppresses dependency lifecycle scripts that Pi does not need and closes a familiar supply-chain hole ^[10]. That control fires once, at install time. Runtime tool execution, which is where a shell tool actually earns its risk, has nothing equivalent shipped with it ^[15].

So price the adoption properly. A team standardising on Pi is signing up to write four things other harnesses hand over: a sandbox, an approval path, subagents and a plan mode, the last two being extension or package territory by design ^[16][9]. None of that is hidden. The review is explicit that more control comes with correspondingly more responsibility, and that Pi is a harness rather than a finished environment: it exposes what context the model sees, which tools it can call, how results come back, how sessions persist and what happens between turns ^[11].

The awkward part is where your guardrail has to live. It lives in an extension, and the review advises checking configuration and extension APIs against a version before standardising them across a team, because Pi has been moving quickly ^[6]. That is the same project whose package scope changed from `@mariozechner` to `@earendil-works` when it moved to Earendil Works in May 2026, three months before the v0.84.2 release this review is pinned to ^[5][17]. An internal approval layer is therefore coupled to a surface that has recently been renaming itself.

Before writing any of it, use the lever the review mentions almost in passing: recent releases let the initial built-in tool selection be configured, and read-only tools such as `grep`, `find` and `ls` are available alongside the defaults ^[7]. Narrowing what the model can reach is cheaper than sandboxing what it can do, and it matches the stated rationale for the small default set, where every extra tool adds a decision for the model, more system prompt and another behaviour to debug ^[8].

Who this actually serves is where the review is most useful. It points at senior developers, platform engineers and AI tooling teams whose ceiling is the harness rather than the model, and says plainly that Pi is less convincing for anyone who wants to install an agent, approve some safe defaults and stop thinking about it ^[12]. If the harness is not your bottleneck, you are buying a bill without the benefit.

Two housekeeping items worth putting in your own install notes: older tutorials still show the stale `@mariozechner` packages ^[5], and the name collides with `oh-my-pi`, a community fork of Oh My Opencode that is a different project entirely ^[13].