Pi notably ships without MCP support (or it did, I can't remember if they're adding it to Pi main or just the durable one). From a vanilla Pi perspective, I'm pretty sure but not positive that it can't. It would have to install an MCP plugin, and you would have to re-launch Pi to load that plugin.
It does have native tools, but they're also in plugins that aren't hot-reloaded. The LLM would have to write the tool, you close Pi and re-open it before it was available.
> Would you consider that a gap in security posturing?
Honestly, I think trying to secure the harness is a lost cause for the same reasons SELinux never really took off. They solve a real problem in a way so painful people would rather just live dangerously.
I actually wrote a thing to implement my security posture https://github.com/SethCurry/abyss TLDR it pretends to be an ACP agent, but runs the agent inside Docker (with optional bind mounts) and proxies the ACP connection into the container.
I'm also tinkering with WASM-based plugins in the ACP proxy to add some additional security and compliance posturing at the protocol layer (ie agnostic to what the underlying agent is). E.g. I slapped together a plugin that will automatically cancel a prompt mid-turn if an OpenRouter API token shows up in a) the prompt, b) agent output/thinking, c) agent tool calls. ([1], [2], [3]). The grand vision is slapping centralized management on that so security and compliance teams get a "firewall" of sorts to prevent leaking secrets, filter bash commands, censor PII, yada, yada.
1. Screenshot of it blocking something in Zed https://abyss.scurry.io/docs/guides/what-is-abyss/#i-am-not-... (I need to add buffering so it doesn't output any of the key)
2. Implementation of ^ https://github.com/SethCurry/abyss/blob/main/plugins/secrets...
3. Plugin architecture docs https://abyss.scurry.io/docs/guides/04-plugins/02-developing...
It does have native tools, but they're also in plugins that aren't hot-reloaded. The LLM would have to write the tool, you close Pi and re-open it before it was available.
> Would you consider that a gap in security posturing?
Honestly, I think trying to secure the harness is a lost cause for the same reasons SELinux never really took off. They solve a real problem in a way so painful people would rather just live dangerously.
I actually wrote a thing to implement my security posture https://github.com/SethCurry/abyss TLDR it pretends to be an ACP agent, but runs the agent inside Docker (with optional bind mounts) and proxies the ACP connection into the container.
I'm also tinkering with WASM-based plugins in the ACP proxy to add some additional security and compliance posturing at the protocol layer (ie agnostic to what the underlying agent is). E.g. I slapped together a plugin that will automatically cancel a prompt mid-turn if an OpenRouter API token shows up in a) the prompt, b) agent output/thinking, c) agent tool calls. ([1], [2], [3]). The grand vision is slapping centralized management on that so security and compliance teams get a "firewall" of sorts to prevent leaking secrets, filter bash commands, censor PII, yada, yada.
1. Screenshot of it blocking something in Zed https://abyss.scurry.io/docs/guides/what-is-abyss/#i-am-not-... (I need to add buffering so it doesn't output any of the key)
2. Implementation of ^ https://github.com/SethCurry/abyss/blob/main/plugins/secrets...
3. Plugin architecture docs https://abyss.scurry.io/docs/guides/04-plugins/02-developing...