nicobailon/pi-mcp-adapter v3.0.0

on GitHub

pi-mcp-adapter 3.0.0 gets the adapter ready for Pi's upcoming built-in MCP support and closes two security gaps. The adapter now keeps its settings in its own mcp-adapter.json file and uses the /mcp-adapter command, so it can run next to Pi's built-in MCP without starting the same servers twice. Opening a repository no longer starts that repository's MCP servers on its own: you trust the project and approve each server first. mcpScript code now runs in a separate sandbox that scripts cannot escape. If you kept adapter settings in mcp.json, rename the file once; Pi shows you the exact command.

Highlights

• Its own config file. The adapter reads mcp-adapter.json and leaves mcp.json to Pi, so the two never start the same servers.
• Project servers wait for approval. Servers defined by a repository stay off until the project is trusted and you approve each one. Pi asks again if the server definition changes.
• A safer mcpScript. Scripts run in a memory-limited QuickJS sandbox with no way to reach your files or processes.
• Traceable tool calls. MCP servers can match each request to the Pi tool call that made it.

Need to know

Changelog

Highlights

• The adapter now has its own config file, mcp-adapter.json, so it can run alongside Pi's upcoming built-in MCP support without starting the same servers twice. If you used mcp.json with the adapter, rename it (see Breaking).
• Opening a repository no longer starts its MCP servers on its own. Project servers wait until you trust the project and approve each server.
• mcpScript code now runs in a QuickJS sandbox that scripts cannot escape to reach your files or processes.
• MCP servers can now match each request to the Pi tool call that made it.

Breaking

• The adapter no longer reads <Pi agent dir>/mcp.json or .pi/mcp.json. Those files now belong to Pi's built-in MCP support. Rename yours to mcp-adapter.json in the same folder. The format is the same, so mv is enough; if mcp-adapter.json already exists, merge the two. Until you do, Pi shows a warning with the exact command. .mcp.json, ~/.config/mcp/mcp.json, and --mcp-config work as before.
• The interactive command is now /mcp-adapter. /mcp still works as a shortcut when Pi's built-in MCP extension is not installed.

Security

• mcpScript now runs scripts in a memory-limited QuickJS/WASM sandbox instead of Node's vm module, which scripts could escape to reach process, the filesystem, or child processes (#676). Each script can emit up to 16 MiB of output, and error messages are capped at 64 KiB. Values pass between the script and Pi as JSON, so values that are not plain JSON still show up but may be formatted differently than before.
• MCP servers defined by a project no longer start until the project is trusted and you approve the server. This covers .mcp.json, .pi/mcp-adapter.json, and servers a project brings in through imports, plugins, repo-local host configs, or Pi packages in its settings. In an untrusted project they stay blocked. In a trusted interactive session, Pi shows the server's command or URL and asks once; the approval is saved, and Pi asks again if the server definition changes. Headless sessions skip unapproved servers unless your user-global config sets settings.projectServers to "allow". /mcp-adapter status shows why a server is blocked. Fixes #675.

Added

• MCP tool calls now include the id of the Pi tool call that made them, under _meta["pi-mcp-adapter/toolCallId"], so servers can match requests to Pi's tool calls in their logs and traces. Direct tools, the mcp tool, and mcp__<server> tools send it. mcpScript calls do not, because a script is not a single tool call. Thanks to @sebavalaris for PR #673.