pi-as-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PI_AS_MCP_DENY | No | Paths refused even inside the root. Default .ssh,.aws,.gnupg,.git-credentials,.netrc,.config/gcloud. | |
| PI_AS_MCP_HOST | No | HTTP listener host. Default 127.0.0.1. | |
| PI_AS_MCP_HTTP | No | Serve Streamable HTTP instead of stdio. Set to 1 to enable. Default off. | |
| PI_AS_MCP_PORT | No | HTTP listener port. Default 8777. A port already in use is a hard error. | |
| PI_AS_MCP_ROOT | No | Sandbox root. Every path argument is confined here. Defaults to the current working directory. | |
| PI_AS_MCP_HUMAN | No | Expose the human channel: human_say/human_ask/human_wait and the approval gate. The web UI comes with it, but is not exclusive to it — --oauth starts the UI too. Set to 1 to enable. Default off. | |
| PI_AS_MCP_OAUTH | No | Serve an OAuth 2.1 authorization server in front of /mcp, and run the UI that approves it. Needs --http. Set to 1 to enable. Default off (on in pimcp). | |
| PI_AS_MCP_TOKEN | No | Bearer token. Set this if you expose the port, unless you use --oauth. Default none. | |
| PI_AS_MCP_TOOLS | No | Comma-separated subset of tools to expose. powershell is Windows-only. Default 7 on Linux, 8 on Windows. | |
| PI_AS_MCP_ISSUER | No | The URL clients reach, and the identity the authorization server advertises. Only with --oauth. Must be https, or a loopback http address. Default the tunnel hostname, else http://127.0.0.1:<port>. | |
| PI_AS_MCP_APPROVE | No | Tools that require human approval, e.g. bash. Needs --human. With no human there is nobody to ask, so the bridge refuses to start instead of auto-approving. Default none. | |
| PI_AS_MCP_UI_HOST | No | The web UI host. Runs with --human or --oauth; ignored without either. Default 127.0.0.1. | |
| PI_AS_MCP_UI_PORT | No | The web UI port. Runs with --human or --oauth; ignored without either. Default 8790. | |
| PI_AS_MCP_BLOCK_MS | No | Max time human_ask/human_wait block before returning no_message. Default 90000. | |
| PI_AS_MCP_UI_TOKEN | No | Token for the UI. Set it if you bind the UI to anything but loopback — with --oauth, the UI is what can grant access here. Default none. | |
| PI_AS_MCP_OAUTH_REDIRECT | No | The addresses a hand-configured client may return to (comma-separated), named before it ever asks. Without this the address is not known in advance: the first one the client sends is shown on the approval card, and your click is what allows it. Only with --oauth. Default none. | |
| PI_AS_MCP_OAUTH_CLIENT_ID | No | Use this credential pair instead of minting one, so a restart does not invalidate a pair a client already holds. Both together, and only with --oauth. Default minted per run. | |
| PI_AS_MCP_OAUTH_CLIENT_SECRET | No | Use this credential pair instead of minting one, so a restart does not invalidate a pair a client already holds. Both together, and only with --oauth. Default minted per run. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| prompts | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| readA | Read the contents of a file. Supports text files and images (jpg, png, gif, webp, bmp). Images are sent as attachments. For text files, output is truncated to 2000 lines or 50KB (whichever is hit first). Use offset/limit for large files. When you need the full file, continue with offset until complete. |
| writeA | Write content to a file. Creates the file if it doesn't exist, overwrites if it does. Automatically creates parent directories. |
| editB | Edit a single file using exact text replacement. Every edits[].oldText must match a unique, non-overlapping region of the original file. If two changes affect the same block or nearby lines, merge them into one edit instead of emitting overlapping edits. Do not include large unchanged regions just to connect distant changes. |
| lsA | List directory contents. Returns entries sorted alphabetically, with '/' suffix for directories. Includes dotfiles. Output is truncated to 500 entries or 50KB (whichever is hit first). |
| grepA | Search file contents for a pattern. Returns matching lines with file paths and line numbers. Respects .gitignore. Output is truncated to 100 matches or 50KB (whichever is hit first). Long lines are truncated to 500 chars. |
| findA | Search for files by glob pattern. Returns matching file paths relative to the search directory. Respects .gitignore. Output is truncated to 1000 results or 50KB (whichever is hit first). |
| bashA | Execute a bash command in the current working directory. Returns stdout and stderr. Output is truncated to last 2000 lines or 50KB (whichever is hit first). If truncated, full output is saved to a temp file. Optionally provide a timeout in seconds. |
| get_instructionsA | Return the operating instructions for this bridge verbatim, plus the live status of attached upstream MCP servers. Call once at the start of a session, and again when a tool you expect is missing or an upstream is reported unavailable. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| pi_as_mcp_instructions | The full operating instructions for this bridge (Pi's prompt plus the human channel rules). |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool targets a distinct operation: read/ls/grep/find cover inspection, write/edit cover mutation, bash executes, and get_instructions is meta. The only mild overlap is that bash can replicate grep/find/read behavior, and write vs edit both modify files, but descriptions clearly delineate overwrite versus exact-text replacement.
Seven of eight tools use terse, all-lowercase Unix-style names (read, ls, grep, find, bash, write, edit), which is internally consistent. The single deviation is get_instructions, which switches to a snake_case verb_noun form, breaking the otherwise uniform pattern.
Eight tools is a well-scoped size for a filesystem/shell bridge, with each tool earning its place across read, search, write, and execute operations. No redundant or filler tools are present.
The surface covers the full read/write/edit/list/search/execute lifecycle, which is strong for this domain. Explicit delete/move/copy tools are absent, but bash provides a workaround, so this is a minor gap rather than a blocking one.