pi-mcp-adapter · Pi Extensions Directory

Safety notes

Verified with notes
Token-efficient bridge to MCP servers; good when a Pi setup needs many external tools.

Static scan findings

This is a first-pass static screen, not a formal audit. It flags patterns worth reading before install.

MEDIUM · token_access

types.ts

token: string;
/** Client secret for confidential clients */
clientSecret?: string;

MEDIUM · token_access

ui-server.ts

sessionToken?: string;
sessionToken: string;
const sessionToken = options.sessionToken ?? randomUUID();

MEDIUM · token_access

ui-stream-types.ts

export const UI_STREAM_REQUEST_META_KEY = "pi-mcp-adapter/stream-token";
streamToken: z.string().min(1),

MEDIUM · token_access

mcp-auth.test.ts

updateTokens,
isTokenExpired,
hasStoredTokens,

MEDIUM · token_access

sampling-handler.ts

const { model, apiKey, headers } = await resolveSamplingModel(options);
apiKey,
maxTokens: params.maxTokens,

MEDIUM · token_access

mcp-oauth-provider.ts

* Handles OAuth client registration, token storage, and authorization redirection.
OAuthTokens,
updateTokens,

MEDIUM · token_access

metadata-cache.ts

bearerToken: definition.bearerToken,
bearerTokenEnv: definition.bearerTokenEnv,

MEDIUM · token_access

package-lock.json

"@aws-sdk/token-providers": "3.1036.0",
"@aws-sdk/token-providers": "3.1036.0",

MEDIUM · token_access

commands.ts

import { hasStoredTokens } from "./mcp-auth.js";
`Run /mcp reconnect ${serverName} to connect with the new token.`,
&& !hasStoredTokens(serverName)

MEDIUM · token_access

mcp-panel.ts

function estimateTokens(tool: CachedTool): number {
estimatedTokens: number;
estimatedTokens: estimateTokens(tool),

Package scripts captured

package.json

{
  "test": "vitest run",
  "test:watch": "vitest",
  "test:coverage": "vitest run --coverage",
  "test:oauth-provider": "node --import tsx --test mcp-oauth-provider.test.ts"
}

examples/interactive-visualizer/package.json

{
  "build": "node ./scripts/build.mjs",
  "install-local": "npm run build && node ./scripts/install-local.mjs",
  "uninstall-local": "node ./scripts/uninstall-local.mjs"
}