
Security News
Free Certified Patch for Critical Rails Active Storage Vulnerability
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.
pi-executor
Advanced tools
Use any MCP / OpenAPI or GRAPHQL api with Pi securely and without burning your context window. (code-mode)
https://github.com/user-attachments/assets/b6287e44-be8f-450a-bca0-a7728f1ed7b7
Mario wrote about why you might not need MCP. The problem: tool definitions are verbose. A single MCP server can burn 10k+ tokens, and you're paying that cost whether you use those tools or not. Connect a few servers and you've burned half your context window before the conversation starts.
His take: skip MCP entirely, write simple CLI tools instead.
Rhys wrote about the execution layer. The problem: MCP and CLI tools are usually just APIs with extra ceremony on top. Bash helped because it gave models an execution surface, but it doesn't solve the real problems: auth, approvals, permissions, state, and discoverability.
His take: use a real execution layer.
This adapter gives you access to that execution layer without the bloat.
pi install npm:pi-executor
Restart or /Reload Pi after installation.
Pi extension that runs a cwd-scoped local Executor sidecar and exposes two agent facing tools and one skill to guide you agent into using executor.
executeresume only in headless / no-UI sessionsExecutor discovery helpers stay inside Executor's runtime and are meant to be used from code executed via execute:
tools.search(...)tools.describe.tool(...)tools.executor.sources.list()| Command | What it does |
|---|---|
/executor-web | Open the Web UI (manage sources) |
/executor-start | Start the executor sidecar |
/executor-stop | Stop the executor sidecar |
/executor-settings | Executor local & global settings |
piExecutor.remoteUrl and never spawns a local sidecarexecute mirrors MCP guidance and namespace discovery as closely as Pi allowsexecute handles Executor interaction inlineexecute returns a paused interaction and resume is availablebun install
Configure the extension in ~/.pi/agent/settings.json or .pi/settings.json:
{
"piExecutor": {
"mode": "local",
"autoStart": true,
"remoteUrl": "",
"showFooterStatus": true,
"stopLocalOnShutdown": true
}
}
mode: "local" or "remote"autoStart: connect on session startremoteUrl: required for remote modeshowFooterStatus: show the footer readiness dotstopLocalOnShutdown: stop Pi-owned local sidecars on session shutdownYou can also manage these interactively with /executor-settings.
Isolated project mode (loads only pi-executor, with no skills and no other extensions):
Project-local settings in .pi/settings.json also disable project-local skills/prompts/themes and point Pi at src/index.ts, but global Pi resources can still load unless you use the isolated command above.
FAQs
Pi extension to run executor
The npm package pi-executor receives a total of 8 weekly downloads. As such, pi-executor popularity was classified as not popular.
We found that pi-executor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.

Security News
/Threat Research
A malicious Ruby gem runs a credential-stealing worm during installation, poisons AI coding tools, and can wipe files when a stolen GitHub token is revoked.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.