Pi Security

Read Pi Security findings, threat models and Code Gatekeeper reviews, and submit design reviews or reports back.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Pi Security connector does

The Pi Security MCP server connects a Pi application-security tenant to Claude and any MCP-compatible agent. Its 21 tools read security findings, threat models, Code Gatekeeper pull-request reviews and secure-development playbooks, and five of them write back — starting design reviews, uploading reports and requesting remediation plans. Sign-in is OAuth against your own Pi tenant.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Pi Security tools (21)

  • pi_design_review_get
  • pi_design_review_markdown_create
  • pi_design_review_url_create
  • pi_design_reviews_list
  • pi_finding_get
  • pi_findings_list
  • pi_gatekeeper_issue_get
  • pi_gatekeeper_issues_list
  • pi_gatekeeper_pr_get
  • pi_gatekeeper_prs_list
  • pi_knowledgebase_query
  • pi_package_remediation_plan_fetch
  • pi_package_remediation_plan_prepare
  • pi_playbook_comment_create
  • pi_playbook_task_query
  • pi_remediation_plan_fetch
  • pi_report_markdown_upload
  • pi_threat_model_app_get
  • pi_threat_model_app_section_get
  • pi_threat_model_apps_list
  • whoami

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • One coarse scope, no read-only option. mcp:access is the only application scope either the resource or the authorization server advertises. You cannot grant the 16 read tools while withholding the 5 write tools — the consent screen has nothing to narrow. We did not find a narrower scope defined at Pi's platform level, but absence of evidence is not evidence Pi could not define one.
  • No safety annotations are readable. The endpoint is OAuth-gated, so no tool on this server carries a readable readOnlyHint, destructiveHint, idempotentHint or openWorldHint. The read/write split above comes from Pi's documentation and from the tool names, not from the protocol. Treat it as well-sourced, not as machine-verified.
  • No parameter schemas were read. Input types, required fields and size limits beyond those Pi documents are unknown here.
  • Markdown and URLs only. Pi documents that hosted submission accepts a supported Confluence or Notion document URL, or inline Markdown or plain text up to 5 MiB. Attachments, local file paths, file:// URIs, PDFs, DOCX files and images are rejected.
  • Queued is not finished. Pi's documentation is explicit that a started or queued design review or report ingestion is in progress, and that ingestion being queued does not mean findings exist yet.
  • Tenant is fixed by the session. Your tenant comes only from the OAuth session. Nothing in the conversation can switch it, so a multi-tenant user must re-authenticate to change tenants.
  • Claude Chat is not a supported surface for the plugin. Pi documents plugin support for Claude Code and Cowork only; Claude Chat users take the remote connector instead.
  • The privacy policy covers the website, not the product. Pi's published privacy policy (last updated 9 June 2026) governs pi.security and its subdomains and describes visitor data. Tenant data handling is governed by the separate Data Processing Agreement, which names Nebari Inc. as the processor.
  • The directory description carries no capability information. Anthropic's listing describes "superpowers" and an "industry-leading context engine" without naming a single capability, so it could neither corroborate nor contradict the tool listing.

Frequently asked questions

Does the Pi Security connector read my source code?

No. Every tool reads records already held in your Pi tenant — findings, threat models, Gatekeeper reviews, playbooks — not your repository. Pi ingests code through its own platform integrations, which you configure outside the connector. Pi's plugin documentation states plainly that Pi never edits your local code, and no tool in the listing takes file contents as input.

Can the Pi Security connector change anything?

Yes, five of its twenty-one tools write to Pi. They start a design review from a URL or Markdown, upload a Markdown report, request generation of a package remediation plan, and record playbook feedback. All five create new records in your Pi tenant. None deletes anything, and none touches your repository, your code or any system outside Pi.

How do I check which Pi tenant I am connected to?

Call the whoami tool. Pi's setup documentation describes it as returning the authenticated subject, tenant and granted scopes without exposing credentials. Your tenant comes only from the OAuth session, so Claude cannot infer or switch it from your working directory, git remotes or anything you type. Re-authenticate if the tenant is wrong.

Can I send a PDF or an attachment to Pi through the connector?

No. Pi's documentation restricts hosted submission to two shapes: a supported Confluence or Notion document URL, or content pasted inline as Markdown or plain text. Chat attachments, local file paths, file:// URIs, PDFs, DOCX files and images are not accepted. Use the Pi web app or Pi's CLI for those formats instead.

Which OAuth scopes does the Pi Security connector request?

Exactly one, mcp:access. Pi's RFC 9728 descriptor and its authorization server both advertise that single scope and nothing else, verified on 2026-08-21. There is no read-only variant, so the consent screen offers no way to grant reads while withholding the five write tools. Granting access grants all twenty-one.

Is the pi-sloane GitHub organisation actually Pi Security?

Yes. Sloane is Pi's own product name, used across pi.security and in Pi's CLI. The organisation's repositories carry contact@pi.security, point their homepage at pi.security, and declare the same endpoint the Anthropic directory lists. The directory's own author field independently names Pi Security at pi.security, so three sources agree.

Sources

More Developer Tools connectors

  • Base44

    Build and edit Base44 apps from an AI assistant, and query data your app's users submit.

  • CircleCI

    Diagnose failed builds, read job logs, inspect test results and rerun or roll back deployments from your AI assistant.

  • Claude Managed Agents

    Create, run, monitor and debug Anthropic's Claude Managed Agents from inside Claude itself.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Pi Security to work.

Connect Pi Security once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio