Pi Durabletask MCP
NPM · PI-DURABLETASK-MCP
Multi-provider Pi agent teams: parallel delegates, coordination, steering, optional recovery.
Available components
Last scanned (14 hours ago)
Scores higher than 43% of npm servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security93
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Declares code that runs automatically (postinstall) and that we could not recognise. It may be perfectly ordinary, but we have not established what it does. View diagnostics → Partial
- 55 of 235 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 3 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability56
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 4267 tokens (~304/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management63
- Stability observed for 19 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage97
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 90% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 23 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes. Other categories moved too: Supply Chain Security rose 1.
- 22 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Oct 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.47 → unverified ▼ security
- Schema quality: 250 → 304 ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 0.7.8 → 0.7.12 functional
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Oct 26 +33
- Injection markers: unverified → pass ▲ security
- Schema quality: 201 → 250 ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- Stability: unverified → 0.33 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Schema quality: excellent → good functional
- 13 Oct 26 0
- Package version: 0.4.3 → 0.7.8 functional
- 12 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 23 Oct 2026 · Analysed npm/pi-durabletask-mcp@0.7.12
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| postinstall | unreviewed | node scripts/link-pi-sdk.mjs |
Background: Why install scripts are a supply-chain risk →
Dependencies 235 packages
| Packages resolved | 235 |
|---|---|
| Deprecated | 1 |
| Stale | 54 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
abort ~29
Stop a running pi session. Partial output stays readable via `status`.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | – |
No output schema declared.
No examples provided.
answer ~77
Answer a pending Pi extension UI question. Get requestId from questions[].id in status or wait. The delegate is blocked until you answer; answer only actual pending questions.
| Name | Type | Req | Description |
|---|---|---|---|
| requestId | string | yes | – |
| sessionId | string | yes | – |
| value | string|boolean | yes | Chosen option, text, or boolean for a confirm |
No output schema declared.
No examples provided.
follow_up ~198
Send another prompt to a delegate that has already finished, keeping everything it read and said. Omit budget fields to use remaining quotas; pass maxTurns/maxToolCalls for fresh quotas for this run. Counts and usage remain cumulative. The wall-clock limit applies to each run. Memory sessions can continue while retained here; durable sessions can continue after reconnecting while retained on disk. For a live session, use `steer`.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | array | – | Absolute paths of text files appended to this prompt, as on spawn |
| maxToolCalls | integer | – | Fresh own-tool-call quota for this run; omitted keeps the remaining budget |
| maxTurns | integer | – | Fresh turn quota for this run; omitted keeps the remaining budget |
| prompt | string | yes | The next turn for this delegate |
| saveTo | string | – | Absolute file path for this run's final text, as on spawn |
| sessionId | string | yes | – |
No output schema declared.
No examples provided.
forget ~30
Drop a finished session from the review history, freeing its id for reuse.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | – |
No output schema declared.
No examples provided.
handoff ~257
Hand a Pi session over between Claude/Codex windows. save (when the user asks to hand over): record the repository cwd, the sessionId, and a short goal, completed and next. read (when the user asks to pick up a project): returns the latest note for cwd (or the one named), plus resumeHint and howToResume, computed from the session's live state. Follow resumeHint, then use status/wait/follow_up as usual. A note is a summary, not the session's state; it never claims, recovers or deletes a session. remainingTurns/canFollowUp describe state and turn-budget readiness only.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| completed | string | – | save: what is done, including results a new window needs |
| cwd | string | yes | Absolute path of the repository. save: the session's own cwd, exactly as it was spawned with |
| goal | string | – | save: what the work is for |
| name | string | – | Optional label to keep several handoffs per repository; read defaults to the newest |
| next | string | – | save: the next step |
| sessionId | string | – | save: the Pi session to hand over |
No output schema declared.
No examples provided.
init ~84
Optional setup diagnostics: reports model availability, provider authentication, permissions and budgets. Use when diagnosing configuration; no init call is needed before delegating. OAuth credentials may refresh.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | Repository you intend to delegate in; picks up its project-local pi model scope |
| models | string | – | Substring to filter the model list, e.g. "deepseek" |
No output schema declared.
No examples provided.
models ~120
List models this delegate may use from pi's available providers after model filters. Use `filter` to find a provider or model, and `offset`/`limit` to page through long lists. thinkingLevels lists the levels each returned reasoning model accepts; a model absent from it accepts only off.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | Picks up a project-local pi model scope |
| filter | string | – | – |
| limit | integer | – | Page size, default 60, at most 200 |
| offset | integer | – | First matching model index to return |
No output schema declared.
No examples provided.
run ~883
Delegate a task to a pi agent and wait for the final answer. Blocks until done. Client request cancellation aborts the delegate. Prefer spawn plus wait for long work; this is for quick questions. Returns a compact result; use verbose: true for the full snapshot.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | array | – | Absolute paths of text files appended to the prompt, read by this server, e.g. a diff you wrote to your scratchpad; they may lie outside cwd. At most 20, 256 KiB each, 1 MiB in total; secret paths ar… |
| coordinator | – | – | A coordinator plan, exactly as spawn's `coordinator` (see spawn for its fields); checked the same way. |
| cwd | string | – | Absolute working directory. Required unless forkFrom supplies the parent cwd. |
| durable | boolean | – | Default false: memory only, nothing written, gone when this MCP process exits; right for short, cheap, re-runnable work such as reviews, searches and model comparisons. Pass true when the work is lon… |
| extensions | boolean | – | Load pi extensions for this delegate. Off by default; they add startup cost and can misbehave. |
| fallbackModels | array | – | Models to continue on, in this session, when a provider error outlasts Pi's own retries: patterns such as "xai/*" or exact refs, tried in order; models of the failed provider are skipped. Omit for th… |
| forkFrom | string | – | Start a new task from a settled session's history; budgets are fresh. Omitted cwd/model/tools inherit and are revalidated, except coordinator defaults its omitted tools to codemode. |
| id | string | – | Your own session id for traceability, e.g. "search-audit-01". 1-64 chars of [A-Za-z0-9._:-], must start alphanumeric, must not already be in use. Defaults to a UUID. |
| label | string | – | Free-text note shown in `sessions`, e.g. what this delegate is for; never sent to the delegate |
| maxDurationMs | integer | – | Wall-clock deadline in milliseconds; server ceiling 900000. |
| maxToolCalls | integer | – | Own-tool-call quota shared with follow_up unless explicitly renewed there; the delegate is told its count near the cap, then must answer. Omit for no cap. |
| maxTurns | integer | – | Turn quota shared with follow_up unless explicitly renewed there; server ceiling 50. |
| mcpServers | array | – | Names from Pi mcp.json to connect. Required with nativeMcp; other servers are not loaded. |
| model | string | – | Omit for the configured default. Use "provider/modelId" from the models tool to choose another. |
| nativeMcp | boolean | – | Enable Pi native MCP independently of third-party extensions. Requires explicit mcpServers and authorized exact tool names, including codemode/tool_search if used. |
| prompt | string | – | The task for the pi agent. Required for ordinary delegates; omit with coordinator for the default dispatch/wait/synthesis workflow. A supplied prompt replaces that default. |
| resources | object | – | Explicit instruction/skill files; omitted loads none. Forks inherit the selection; {} clears it. Does not grant tools. |
| retentionDays | integer | – | Durable only: days to keep it on disk after it finishes (default 7, max 365). Set it longer when the user wants to come back to this session later. |
| saveTo | string | – | Absolute file path: when the run finishes, its final text is written there and results show savedTo instead |
| thinking | string | – | Explicit pi thinking level. Omit to use pi's configured/default level. |
| tools | array | – | Tool allowlist for this delegate. Omit for read, grep, find, ls; [] disables all tools. With coordinator, omit for codemode instead. Permitted on this server: read, grep, find, ls. |
| verbose | boolean | – | Include configuration and the full tool trace with ids and results |
No output schema declared.
No examples provided.
sessions ~132
List pi sessions held by this server, running and finished, plus finished durable sessions stored on disk (`stored`). Up to 50 finished sessions stay loaded; status/wait read stored results without loading, and follow_up loads the conversation. Stored sessions expire by retention. Pass cwd to find this project's history; entries include remainingTurns and state/budget canFollowUp.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | – | Absolute project directory; includes loaded and stored sessions for this cwd |
| state | string | – | Filter by state: starting, running, done, aborted, error |
| verbose | boolean | – | Include full text and tool calls |
No output schema declared.
No examples provided.
spawn ~911
Delegate a task to a pi agent running in the background. Returns a sessionId immediately, so nothing blocks. Use `wait` for progress/results, `status` for a snapshot, `steer` to redirect, and `answer` for questions. Use this for anything that might take more than a minute.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | array | – | Absolute paths of text files appended to the prompt, read by this server, e.g. a diff you wrote to your scratchpad; they may lie outside cwd. At most 20, 256 KiB each, 1 MiB in total; secret paths ar… |
| coordinator | object | – | Opt-in memory-only orchestration of caller-planned read-only children. Omitted prompt gives a concise synthesis with disagreements, failed coverage and original report references; omitted tools selec… |
| cwd | string | – | Absolute working directory. Required unless forkFrom supplies the parent cwd. |
| durable | boolean | – | Default false: memory only, nothing written, gone when this MCP process exits; right for short, cheap, re-runnable work such as reviews, searches and model comparisons. Pass true when the work is lon… |
| extensions | boolean | – | Load pi extensions for this delegate. Off by default; they add startup cost and can misbehave. |
| fallbackModels | array | – | Models to continue on, in this session, when a provider error outlasts Pi's own retries: patterns such as "xai/*" or exact refs, tried in order; models of the failed provider are skipped. Omit for th… |
| forkFrom | string | – | Start a new task from a settled session's history; budgets are fresh. Omitted cwd/model/tools inherit and are revalidated, except coordinator defaults its omitted tools to codemode. |
| id | string | – | Your own session id for traceability, e.g. "search-audit-01". 1-64 chars of [A-Za-z0-9._:-], must start alphanumeric, must not already be in use. Defaults to a UUID. |
| label | string | – | Free-text note shown in `sessions`, e.g. what this delegate is for; never sent to the delegate |
| maxDurationMs | integer | – | Wall-clock deadline in milliseconds; server ceiling 900000. |
| maxToolCalls | integer | – | Own-tool-call quota shared with follow_up unless explicitly renewed there; the delegate is told its count near the cap, then must answer. Omit for no cap. |
| maxTurns | integer | – | Turn quota shared with follow_up unless explicitly renewed there; server ceiling 50. |
| mcpServers | array | – | Names from Pi mcp.json to connect. Required with nativeMcp; other servers are not loaded. |
| model | string | – | Omit for the configured default. Use "provider/modelId" from the models tool to choose another. |
| nativeMcp | boolean | – | Enable Pi native MCP independently of third-party extensions. Requires explicit mcpServers and authorized exact tool names, including codemode/tool_search if used. |
| prompt | string | – | The task for the pi agent. Required for ordinary delegates; omit with coordinator for the default dispatch/wait/synthesis workflow. A supplied prompt replaces that default. |
| resources | object | – | Explicit instruction/skill files; omitted loads none. Forks inherit the selection; {} clears it. Does not grant tools. |
| retentionDays | integer | – | Durable only: days to keep it on disk after it finishes (default 7, max 365). Set it longer when the user wants to come back to this session later. |
| saveTo | string | – | Absolute file path: when the run finishes, its final text is written there and results show savedTo instead |
| thinking | string | – | Explicit pi thinking level. Omit to use pi's configured/default level. |
| tools | array | – | Tool allowlist for this delegate. Omit for read, grep, find, ls; [] disables all tools. With coordinator, omit for codemode instead. Permitted on this server: read, grep, find, ls. |
No output schema declared.
No examples provided.
spawn_batch ~732
Fan out several delegates in one call. Each task inherits the batch-level model, cwd, tools and extensions unless it overrides them. The whole batch is validated before any delegate starts, so a bad model name or a duplicate id fails everything instead of leaving half a fan-out running. Wait for the batch with `wait` and the returned sessionIds, rather than polling `sessions` or one `status` per delegate.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | array | – | Default for every task in this batch. Absolute paths of text files appended to the prompt, read by this server, e.g. a diff you wrote to your scratchpad; they may lie outside cwd. At most 20, 256 KiB… |
| coordinator | – | – | A coordinator plan, exactly as spawn's `coordinator` (see spawn for its fields); checked the same way. |
| cwd | string | – | Default working directory for every task in this batch |
| durable | boolean | – | Default for every task in this batch. Default false: memory only, nothing written, gone when this MCP process exits; right for short, cheap, re-runnable work such as reviews, searches and model compa… |
| extensions | boolean | – | Default extensions setting for every task in this batch |
| fallbackModels | array | – | Default for every task in this batch. Models to continue on, in this session, when a provider error outlasts Pi's own retries: patterns such as "xai/*" or exact refs, tried in order; models of the fa… |
| forkFrom | string | – | Default settled parent session for this batch |
| idPrefix | string | – | Names the tasks `<prefix>-01`, `<prefix>-02`, ... e.g. "audit" gives "audit-01" |
| maxDurationMs | integer | – | Default wall-clock deadline; server ceiling 900000 ms |
| maxToolCalls | integer | – | Default cap on each delegate's own tool calls |
| maxTurns | integer | – | Default turn budget; server ceiling 50 |
| mcpServers | array | – | Default native MCP server selection for this batch |
| model | string | – | Default model for every task in this batch |
| nativeMcp | boolean | – | Default native MCP setting for this batch |
| prompt | string | – | Shared instructions for every task, e.g. one review sent to several models; a task's own `prompt` is added after it. Coordinator tasks keep their default synthesis. |
| resources | object | – | Default resource selection for batch tasks; each task can replace it, including {} to clear. |
| retentionDays | integer | – | Default for every task in this batch. Durable only: days to keep it on disk after it finishes (default 7, max 365). Set it longer when the user wants to come back to this session later. |
| saveDir | string | – | Absolute directory: each finished task's final text is written to <sessionId>.md there |
| tasks | array | yes | 1 to 4 delegates to start |
| thinking | string | – | Default thinking level for every task in this batch; omit to use pi settings |
| tools | array | – | Default tool allowlist for every task in this batch |
No output schema declared.
No examples provided.
status ~157
Check a background pi session. Returns state, turn count, tools used, latest text, and any pending questions the agent is waiting on. A non-empty `questions` array means it is blocked until you call `answer`. `toolCalls` holds the last 5 calls with shortened arguments and `toolCallCount` the total; pass `verbose: true` for every call with ids and results. Notices cover this run; verbose preserves their full history. Teams with saveDir expose reportIndex and publication errors. remainingTurns/canFollowUp report state and turn-budget readiness; ownership, capacity and auth are checked by follow_up.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | – |
| verbose | boolean | – | Include the full tool trace and notice history |
No output schema declared.
No examples provided.
steer ~61
Redirect a running pi agent mid-task. The message lands after its current tool call finishes, before the next model call. Use this instead of aborting when the agent is going the wrong way.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | – |
| sessionId | string | yes | – |
No output schema declared.
No examples provided.
wait ~394
Wait for delegates without polling in a loop. until: "progress" (default) returns after a new turn/tool call, a pending question, the end, or timeout; pass prior turns/toolCallCount as afterTurns/afterToolCalls. until: "settled" returns only when it finishes or asks a question, so loop on it to get the result. With sessionIds (e.g. a spawn_batch), returns when any one settles ("settled") or all do ("all_settled"): settled/pending ids, continueIds (everything not finished, including sessions waiting for an answer) and a summary per session, with the final text of finished ones and any pending questions. Answer questions, then wait again on continueIds. Polls of running work show only what changed: no partial text, and only warnings/errors raised during this wait (status lists all); questions always. A long text saved with saveTo comes back as savedTo plus a short preview. Use status or verbose: true for detail. Teams with saveDir expose reportIndex; reportIndexError means its latest publication failed. nextAction is wait, answer or finish; finish means this run ended, so check state/error/termination. Cancelling this wait leaves delegates running; use `abort` to stop one.
| Name | Type | Req | Description |
|---|---|---|---|
| afterToolCalls | integer | – | Prior snapshot's `toolCallCount` |
| afterTurns | integer | – | Prior snapshot's turn count |
| sessionId | string | – | One session; returns its status snapshot |
| sessionIds | array | – | Several sessions; returns a summary of each |
| timeoutMs | integer | – | Default 55000 for settled/all_settled, 30000 for progress; max 55000 |
| until | string | – | Default progress for sessionId, settled for sessionIds |
| verbose | boolean | – | Single session: include the full snapshot, tool results and call ids |
No output schema declared.
No examples provided.
How do I install the Pi Durabletask MCP server?
Pi Durabletask MCP runs locally as an npm package, launched with npx -y pi-durabletask-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · pi-durabletask-mcp
claude mcp add nyarlathoteppppp-pi-durabletask-mcp -- npx -y pi-durabletask-mcp
What is the Pi Durabletask MCP server?
Pi Durabletask MCP is listed in the public MCP registry as io.github.Nyarlathoteppppp/pi-durabletask-mcp. Multi-provider Pi agent teams: parallel delegates, coordination, steering, optional recovery. This page covers its npm package (pi-durabletask-mcp).
Is the Pi Durabletask MCP server safe to use?
Pi Durabletask MCP scores 74 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 23 October 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Pi Durabletask MCP server expose?
Pi Durabletask MCP exposes 14 tools: init, spawn, spawn_batch, run, status, and 9 more. Their descriptions and schemas cost roughly 4,065 tokens of context every time the server is loaded.
Is the Pi Durabletask MCP server still maintained?
Pi Durabletask MCP is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Pi Durabletask MCP server under?
Pi Durabletask MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.