Pi Coding Agent App Security Checklist

Pi Coding Agent from pi.dev is a minimal, extensible agent harness built around packages, extensions, skills, prompt templates, tools and built-in MCP. Pi supports stdio and Streamable HTTP servers, hosted OAuth, user-level configuration and trusted project configuration. This checklist uses Pi’s native MCP client for hosted LyraShield access, with the standalone CLI and GitHub Action as complementary paths.

Start with the vibe coding security guide for the shared baseline. Keep the acceptance claim precise: a successful LyraShield CLI scan proves that the CLI authenticated and assessed the selected target; it does not prove that Pi loaded or invoked an MCP tool.

Use the companion LyraShield workflow alongside Pi when you want the exact login, doctor, scan and CI sequence.

1. Inventory Pi packages, extensions, skills and tools

List the packages, extensions and MCP servers Pi loads, the skills available to the model, the prompt files added to the session and every tool with file, shell or network access. Review exact versions and source before enabling them. Some extensions can replace Pi’s built-in MCP support, so verify which configuration source Pi actually uses and record the extension version when one changes that behavior.

Treat skills and prompt templates as executable policy because they shape which instructions reach the model. Treat custom tools as privileged code because they can cross process, filesystem and network boundaries. Remove unused extensions, pin the ones you retain and test upgrades on a branch. Review any extension that reads configuration from other coding agents: implicit discovery can import broader permissions than the Pi project intended.

2. Connect Pi to LyraShield and keep CLI/CI available

Use Pi’s built-in hosted MCP client with the LyraShield endpoint:

pi mcp add lyrashield --url https://app.lyrashieldai.com/api/mcp
pi mcp list
pi mcp login lyrashield

Pi uses browser OAuth and stores its tokens in its own user credential store. Confirm connection and tool discovery with pi mcp list, then make a read-only call such as lyrashield_list_workspaces. A setup command or discovery check is not a retained scan receipt. Do not start a paid scan unless the user explicitly requests it and the selected workspace, target and scan profile are authorized.

For a user-level setup, Pi writes ~/.pi/agent/mcp.json. A project-level server can be added with pi mcp add --local, which writes .pi/mcp.json; Pi reads that file only after project trust is granted, and a project entry with the same name replaces the user entry. Keep personal credentials and servers in user scope.

Pi discovers Agent Skills from ~/.agents/skills/ and .agents/skills/. Install only reviewed skill directories containing SKILL.md; project skills can instruct the model to run scripts or modify files and should be reviewed before granting project trust.

The LyraShield CLI remains useful for a local or CI check. Authenticate that separate surface with npx -y lyrashield@0.2.14 login --oauth, verify with npx -y lyrashield@0.2.14 doctor and use npx -y lyrashield@0.2.14 scan only when explicitly requested. Its credential store is separate from Pi’s hosted OAuth credentials. The earlier CLI 0.2.13 release printed an obsolete Pi recipe. Use Pi’s native MCP commands for hosted OAuth, and install shared skills with the current documented CLI command.

Keep the working loop simple: Pi changes code; when explicitly requested, use its authenticated MCP connection or the CLI to assess the authorized target; a developer reviews findings with their recorded evidence states; CI repeats the selected diff gate. A retest-confirmed outcome still requires its own fresh applicable retest. A detected or inconclusive result does not become verified because Pi displayed it.

3. Scope Pi authority and credentials

Grant the agent only the file, shell and network operations needed for the current task. Keep production secrets, customer records, private keys and unrestricted database exports outside the prompt and working tree. Use synthetic fixtures when generated code needs realistic examples. Review command execution before allowing package installation, database mutation, deployment or credential access.

Keep Pi OAuth credentials in Pi’s protected user-level store. Do not paste an lsk_ token into Pi prompts, skills, extension source or repository files. The native hosted connection does not need a static API key in mcp.json. If a credential may have entered model context or terminal history, rotate it and inspect access logs. For stdio with @lyrashield/mcp@0.2.12, run the separate CLI login and review environment inheritance for the server process.

Retain the target, source revision, scan identity and result for any LyraShield scan, whether it was requested through MCP or CLI. For pull requests, use the runner-local GitHub Action. These paths provide different evidence: a local diff gate is advisory, while a completed recorded scan retains its own scope and outcome.

4. Treat packages, extensions and skills as code with version pinning

Pi’s packages, extensions, skills and MCP servers are separate supply-chain and authority boundaries. Review the server’s permissions, transport, authentication and tool descriptions before enabling it.

Checklist:

• Pin package and extension versions and review their source, permissions, configuration paths and upgrade notes.
• Keep personal MCP connections in user-level configuration; use project configuration only for trusted, intentionally shared servers.
• Review any extension that registers filesystem MCP at /. Standard Pi filesystem example npx -y @modelcontextprotocol/server-filesystem /workspace scoped to /workspace is appropriate; / is not.
• Version skills that drive context engineering. Skills shape what context enters the model window, a skill that injects untrusted URLs expands prompt-injection surface.

This aligns with OWASP LLM05 Insecure Output Handling and LLM06 Excessive Agency: a skill that can call MCP tools with unvalidated output gets broad authority.

5. Build diff-aware CI and review controls

Agent actions that can edit files, execute shell commands, install packages or reach the network benefit from explicit human approval. Do not let a routine review silently authorize a scan, write action or deployment.

Target CI:

• Human review: changes to src/auth/** require review regardless of which agent or workflow generated them.
• Diff-aware lockfile review: if Pi adds a dependency, require SCA and secrets scan on diff, not full scan.
• SARIF upload: Pi-generated PRs should emit SARIF from any scanner, not just pretty logs. The LyraShield GitHub Action, SCA + secrets + agentic pentest with SARIF, is intended for this slot, enabling retest after fix rather than trusting first-pass generation.
• Record the Pi package, extension, skill and tool inventory used for the change so reviewers can see what authority was available.

#	Control	File or command	If skipped
1	Pin and review packages and extensions	Pi package config and resolved versions	Extension behavior can drift without review
2	Review skills, prompts and custom tools	Project guidance and extension source	Untrusted instructions gain unnecessary agency
3	Keep credentials outside Pi context	Pi OAuth store or CLI credential store	Tokens can enter prompts, logs or git history
4	Run a scan only when requested and authorized	npx -y lyrashield@0.2.14 scan	Risky edits reach review without an early check
5	Keep write and shell actions approval gated	Pi permissions and human review	Generated instructions can mutate sensitive data
6	Require the diff-aware SARIF gate	.github/workflows/*	A skipped local check can reach the merge queue

Why pair Pi Coding Agent with LyraShield

Pi configuration should be reviewed whenever it can read source, invoke tools or resolve credentials. The OWASP Top 10 provides a baseline for authorization and injection checks, CWE-798 covers hardcoded credential exposure and the Model Context Protocol specification defines MCP transport and tool contracts. These sources do not prove a Pi setup is safe. They help a reviewer confirm enabled tools, secret references and the exact configuration revision retained with the release evidence. Repeat the review after changing an extension, skill, MCP server or approval boundary.

Pi gives you a minimal, composable harness with built-in MCP, skills, packages, extensions, prompt templates and tools. LyraShield connects through Pi’s hosted OAuth MCP path and also offers a standalone CLI and runner-local SARIF gate. LyraShield keeps detected candidates, retest outcomes and inconclusive results distinct; fix proposals remain approval-gated.

Use Pi’s LyraShield MCP connection for an explicitly requested workflow, or use npx -y lyrashield@0.2.14 scan as a CLI path when requested. Follow the Pi integration guide for MCP, OAuth, skills and CLI setup. Setup instructions do not constitute a client-runtime receipt; retain an authenticated runtime result before claiming Pi acceptance. The platform is live in open beta and scans, findings and evidence, approval-gated fix proposals, retests and reports are implemented. Automatic server-generated Fix PR execution is not enabled.

Before you merge, run the AI app security checklist to verify auth, secrets and dependencies one more time.

CTA

Create an account at lyrashieldai.com for Pi MCP setup, Agent Skills guidance and access to diff-aware verification.