
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
mcp-to-pi-tools
Advanced tools
Convert MCP servers into standalone CLI tools for AI agents. Powered by mcporter.
One command turns any MCP server into persistent, agent-ready CLI tools—built for Pi's tool conventions.
npx mcp-to-pi-tools chrome-devtools-mcp
mcporter converts MCP servers to CLI tools, but using them creates friction for coding agents:
--helpResult: Agents struggle to use mcporter-converted MCP tools reliably. Even useful MCP tools go underutilized because the CLI interface creates too much friction.
Generate simple, self-documenting CLI tools with short symlinks agents can reliably invoke:
# Before: 100+ char mcporter commands agents struggle to construct
npx mcporter call --stdio "npx -y chrome-devtools-mcp" chrome-devtools.take_snapshot format:"png"
# After: Short symlinks agents execute reliably
chrome-snapshot --format png
| Approach | Command Length | Agent Reliability |
|---|---|---|
| Raw mcporter | 100+ chars | Agents fumble syntax, retry loops |
| Full path | ~55 chars | Reliable but verbose |
| Symlink | ~25 chars | Minimal, reliable |
Pi doesn't support MCP directly. Instead, it relies on simple CLI tools that agents invoke via Bash. The pattern is:
AGENTS.md (global or project-specific)This tool automates that pattern for MCP servers:
AGENTS.md formatResult: MCP tools become first-class Pi-native tools that agents invoke directly.
For the rationale behind this approach, see What if you don't need MCP? by Mario Zechner.
# Generate tools (Node 18+ required)
npx mcp-to-pi-tools chrome-devtools-mcp
# Use immediately via symlink
chrome-snapshot --help
# Or via full path
~/agent-tools/chrome-devtools/chrome-snapshot.js --help
Note: Ensure
~/agent-tools/binis in your PATH for symlinks to work.
Note: If globally installed (
npm install -g mcp-to-pi-tools), you can omitnpx.
# List all installed tools
npx mcp-to-pi-tools list
# List and fix missing symlinks/registrations
npx mcp-to-pi-tools list --fix
# Refresh symlinks and registrations for all tools
npx mcp-to-pi-tools refresh
# Refresh a specific tool
npx mcp-to-pi-tools refresh chrome-devtools
# Preview what refresh would do
npx mcp-to-pi-tools refresh --dry-run
# Remove a tool (prompts for confirmation)
npx mcp-to-pi-tools remove chrome-devtools
# Remove without confirmation
npx mcp-to-pi-tools remove chrome-devtools -y
# Preview what would be removed
npx mcp-to-pi-tools remove chrome-devtools --dry-run
Refresh: Updates existing tools with missing symlinks (for tools installed before symlink support) and updates registrations to use short command names instead of full paths.
# NPM packages (default)
npx mcp-to-pi-tools chrome-devtools-mcp
# Scoped packages
npx mcp-to-pi-tools @org/mcp@1.2.3
# Custom name/location
npx mcp-to-pi-tools chrome-devtools-mcp --name browser-tools --output ./tools
# Auto-detects uvx (no install needed)
npx mcp-to-pi-tools mcp-server-fetch
# Or be explicit
npx mcp-to-pi-tools mcp-server-fetch --uvx # via uvx
npx mcp-to-pi-tools mcp-server-fetch --pip # via pip
npx mcp-to-pi-tools --command "docker run -i mcp/fetch" fetch
--dry-run Preview without writing
--force, -f Update existing tools (preserves user files)
--quiet, -q Minimal output
--yes, -y Skip confirmation prompts (for remove)
--no-register Skip auto-registration
--all-presets Register to all existing preset files
--no-symlink Skip symlink creation
--symlink-dir <p> Custom symlink directory (default: ~/agent-tools/bin)
--force-symlink Overwrite existing files with symlinks
--agent <name> Force AI agent (pi, claude, codex). Auto-detects by default.
Note: --preset codex implies --agent codex
Re-run the same command with --force to update existing tools:
npx mcp-to-pi-tools chrome-devtools-mcp --force
Smart updates:
# Default: first existing preset (pi -> claude -> codex -> gemini)
npx mcp-to-pi-tools chrome-devtools-mcp
# Register to ALL existing preset files
npx mcp-to-pi-tools chrome-devtools-mcp --all-presets
# Specific preset(s)
npx mcp-to-pi-tools chrome-devtools-mcp --preset claude --preset gemini
# Custom paths
npx mcp-to-pi-tools chrome-devtools-mcp --register-path ~/.config/AGENTS.md
Presets: pi, claude, gemini, codex (maps to default paths)
~/agent-tools/<name>/
├── README.md # Human docs
├── <prefix>-tool1.js # Executable wrapper
└── <prefix>-tool2.js
~/agent-tools/bin/ # Symlinks for PATH access
├── <prefix>-tool1 → ../<name>/<prefix>-tool1.js
└── <prefix>-tool2 → ../<name>/<prefix>-tool2.js
Each wrapper:
#!/usr/bin/env node shebang--help with examples.js extension for cleaner invocationCreate ~/agent-tools/mcp2cli.settings.json for defaults:
{
"register": true,
"registerPaths": ["~/.pi/agent/AGENTS.md", "~/.claude/CLAUDE.md"],
"symlink": true,
"symlinkDir": "~/agent-tools/bin"
}
| Issue | Fix |
|---|---|
mcporter not found | npm install -g mcporter |
| Discovery timeout | MCPORTER_CALL_TIMEOUT=120000 npx mcp-to-pi-tools <pkg> |
| No AI agent | Works without Pi/Claude (1:1 tool mapping) |
PRs and issues welcome on GitHub.
MIT
FAQs
Convert MCP servers into standalone CLI tools for AI agents. Powered by mcporter.
We found that mcp-to-pi-tools demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.