What is pi-codemcp AGENTS.md?

A development guide for pi-codemcp, a Pi package that gives typed and sandboxed access to configured MCP servers. It also documents the project's TypeScript, Python, testing, release, and contribution workflow.

Setting up dependencies, running checks and tests, formatting code, validating release packages, and following the project's pull-request and versioning process.

It gives contributors one place to follow the project's setup, code-quality, branch, commit, and release rules. This reduces uncertainty when changing or publishing the package.

pi-codemcp AGENTS.md — Instructions file by yolonir

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/yolonir/pi-codemcp/agents-md

Clone the repo

git clone --depth 1 https://github.com/yolonir/pi-codemcp

Made for: Codex, OpenCode.

Per session 383 This file is loaded in full into every session.

When invoked 383 The same file — it is already loaded in full.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00383	$0.00383
Opus 5	$0.00192	$0.00192
Sonnet 5	$0.00077	$0.00077
Haiku 4.5	$0.00038	$0.00038

Measured 2d ago against content hash b6d04eb4e17b, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

pi-codemcp AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 25 lines

What it actually says

pi-codemcp

Pi package providing typed, sandboxed Code Mode access to configured MCP servers.

TypeScript dependencies, scripts, and tests use Bun.
The Python sidecar and tests use uv with the committed sidecar/uv.lock.
Pi loads extensions/index.ts directly; there is no build step.
Keep MCP transports and OAuth in FastMCP and sandbox execution in Pydantic Monty.

Repository workflow:

Run just init once to sync locked dependencies and install the prek hook.
Work on a focused branch; direct commits to main are rejected.
Run just check for the same lock, lint, type, and test gates used by CI.
Run just release-check before release to validate the packed clean-install path.
Use just format for safe automatic formatting and lint fixes.

Commits and releases:

Use Conventional Commit titles for PRs and squash commits: fix: for a patch, feat: for a minor, and feat!: or BREAKING CHANGE: for a major. Use chore:, docs:, or test: for changes that should not normally release the package.
Merge ordinary branches into main only through a green PR. This updates or creates the Release Please PR but does not publish a release.
Treat the Release Please PR (chore(main): release X.Y.Z) as the explicit release boundary. Merge it only when the user explicitly says to release that version now.
Never infer permission to tag, create a GitHub Release, or publish to npm from permission to configure release automation, merge a feature PR, or prepare a version.
A release is complete only after the release PR is merged, exact-main Quality succeeds, and the Release workflow creates the tag/GitHub Release and publishes the npm package.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 25 lines · 383 tokens per session scan A b6d04eb4e17b

Subscribe to this mod's changes

pi-codemcp AGENTS.md is an instructions file published in the GitHub repository yolonir/pi-codemcp (5 stars, last pushed 5d ago), licensed MIT. It adds 383 tokens to every session, about $0.0019 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

pi-codemcp AGENTS.md

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Nothing flagged

What it actually says

pi-codemcp

What this file has done since we first saw it

Other instructions, from other repositories

vscode buildNext.instructions.md

spec-kit AGENTS.md

codex AGENTS.md

langchain AGENTS.md

vscode oss-third-party-notices.instructions.md

next.js AGENTS.md