
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
pi-web-tools
Advanced tools
Web search via Exa, content extraction, and GitHub repo cloning for Pi coding agent
Web search, content extraction, and GitHub repo cloning for the Pi coding agent.
A lightweight extension providing three tools:
web_search — Search the web via Exa with snippet extractionfetch_content — Fetch any URL and extract clean markdown (HTML via Readability, Jina Reader fallback, GitHub via clone)get_search_content — Retrieve stored results from previous searches/fetchespi install npm:pi-web-tools
Or install from git:
pi install github:coctostan/pi-web-tools
Get a key at exa.ai and set it via environment variable:
export EXA_API_KEY="your-key-here"
Or add it to the config file ~/.pi/web-tools.json:
{
"exaApiKey": "your-key-here"
}
The environment variable takes precedence over the config file.
For GitHub repo cloning, install the GitHub CLI:
# Debian/Ubuntu
sudo apt install gh
# Or via conda, brew, etc.
gh auth login
Without gh, the extension falls back to git clone (works for public repos).
Config file: ~/.pi/web-tools.json (auto-reloaded every 30 seconds)
{
"exaApiKey": "your-exa-key",
"github": {
"maxRepoSizeMB": 350,
"cloneTimeoutSeconds": 30,
"clonePath": "/tmp/pi-github-repos"
}
}
| Option | Default | Description |
|---|---|---|
exaApiKey | null | Exa API key (env EXA_API_KEY overrides) |
github.maxRepoSizeMB | 350 | Skip cloning repos larger than this |
github.cloneTimeoutSeconds | 30 | Abort clone after this many seconds |
github.clonePath | /tmp/pi-github-repos | Where to store cloned repos |
web_searchSearch the web using Exa. Returns results with snippets and source URLs.
| Parameter | Type | Description |
|---|---|---|
query | string | Single search query |
queries | string[] | Multiple queries (batch) |
numResults | number | Results per query (default: 5, max: 20) |
Example:
Search for "TypeScript 5.8 new features"
fetch_contentFetch URL(s) and extract readable content as markdown.
| Parameter | Type | Description |
|---|---|---|
url | string | Single URL to fetch |
urls | string[] | Multiple URLs (parallel, max 3 concurrent) |
forceClone | boolean | Force cloning large GitHub repos |
Content extraction pipeline:
r.jina.ai)Content over 30,000 characters is truncated with a pointer to get_search_content.
get_search_contentRetrieve full content from a previous web_search or fetch_content result.
| Parameter | Type | Description |
|---|---|---|
responseId | string | ID from a previous tool result |
query | string | Filter by query text |
queryIndex | number | Filter by query index |
url | string | Filter by URL |
urlIndex | number | Filter by URL index |
When fetch_content receives a GitHub URL:
gh api. Skips if over threshold (default 350MB)--depth 1) to temp directory, cached for the sessionNon-code GitHub URLs (issues, PRs, discussions, etc.) are fetched as normal web pages.
index.ts — Extension entry point, 3 tools, session management
├── config.ts — Config with 30s TTL cache, env var overrides
├── storage.ts — LRU storage (max 50 entries, session restore)
├── exa-search.ts — Exa API client
├── extract.ts — Readability + Jina Reader content extraction
└── github-extract.ts — GitHub URL parsing, clone, tree/content generation
# Install dependencies
npm install
# Run tests
npx vitest run
# Run tests in watch mode
npx vitest
# Load in pi for testing
pi -e ./index.ts
MIT
FAQs
Web search via Exa, content extraction, and GitHub repo cloning for Pi coding agent
The npm package pi-web-tools receives a total of 4 weekly downloads. As such, pi-web-tools popularity was classified as not popular.
We found that pi-web-tools demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.