Pi Agent Desktop

by abcwyc• 875•• Scanned•Claim this listing•Request removal
Coding Agentsaiai agentdesktop apppi

Pi — A cross-platform AI coding agent, bringing the Claude Code experience to your desktop. No environment setup, no terminal commands. Download and start coding right away.

Pi Agent Desktop is an open-source ai agent by abcwyc, written mainly in TypeScript, with 875 GitHub stars and the MIT license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit eaf955f. Seen able to run dynamic code, read environment and secrets, connect to the internet. Scan policy

aboutREADMEsecurityreviews
Scanned
Full scan at eaf955f · Nov 5, 2026
Scanned Builds
Static code scanwarn
Secrets scanpass
Dependency audit60 known vulnerabilitiesfail
Manifestnonewarn
Buildpass
Boot & handshaken/a
Network egresswarn
Reproducible (×3)n/a

Findings (73)

  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    sharp@0.35.4: 1 known vulnerability
    GHSA-wq5f-xc86-pv6w
    demo/package-lock.json
  • medium
    source-map-js@1.2.1: 1 known vulnerability
    GHSA-68fv-2mgg-jv7q
    demo/package-lock.json
  • medium
    zod@4.6.5: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    demo/package-lock.json
  • medium
    undici@8.11.0: 9 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +4 more
    package-lock.json
  • medium
    zod@4.3.6: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    package-lock.json
  • medium
    Install contacted hosts other than package registries
    cdn.npmmirror.com, fonts.googleapis.com, fonts.gstatic.com, registry.npmmirror.com, telemetry.nextjs.org
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    app/api/files/credential-route.test.mjs:41
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    app/api/files/credential-route.test.mjs:86
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    app/api/files/credential-route.test.mjs:86
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    app/api/files/credential-route.test.mjs:86
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    app/api/files/credential-route.test.mjs:86
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    app/api/files/credential-route.test.mjs:86
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    components/FileViewer.test.mjs:52
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    components/McpAddServer.test.mjs:104
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    components/McpAddServer.test.mjs:135
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    components/ProjectTrustDialog.test.mjs:168
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    components/ProjectTrustDialog.test.mjs:179
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    e2e/chat-prompt-anchor.mjs:40
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    hooks/mcp-slash-command.test.mjs:45
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    hooks/useAgentSession.edit-admission.test.mjs:17
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    hooks/useAgentSession.notice-dedup.test.mjs:11
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    lib/chat-file-access.test.mjs:52
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    lib/chat-file-access.test.mjs:62
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    lib/gfm-autolink-email-loader.test.mjs:14
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    lib/html-preview.test.mjs:228
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    lib/mcp-import.integration.test.mjs:256
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    lib/mcp-server-display.test.mjs:38
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    lib/mcp-server-display.test.mjs:40
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    lib/session-file-references.test.mjs:76
  • low
    Possible example credential in docs/tests: generic-api-key
    app/api/auth/api-key/[provider]/route.test.mjs:31
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    components/McpAddServer.test.mjs:104
  • low
    Possible example credential in docs/tests: generic-api-key
    5 matches in this file
    components/mcp-add-helpers.test.mjs:342
  • low
    Possible example credential in docs/tests: gitlab-pat
    lib/mcp-secrets.test.mjs:66
  • low
    Possible example credential in docs/tests: jwt
    lib/mcp-secrets.test.mjs:67
  • low
    Possible example credential in docs/tests: generic-api-key
    lib/mcp-add.test.mjs:89
  • low
    Possible example credential in docs/tests: generic-api-key
    5 matches in this file
    lib/mcp-test.test.mjs:293
  • low
    Possible example credential in docs/tests: generic-api-key
    lib/mcp-host.test.mjs:1223
  • low
    Possible example credential in docs/tests: generic-api-key
    lib/mcp-config-read.test.mjs:525
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    lib/mcp-import.test.mjs:1058
  • low
    katex@0.16.47: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    demo/package-lock.json
  • low
    minimatch@10.2.6: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    demo/package-lock.json
  • low
    glob@10.5.0: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    package-lock.json
  • low
    minimatch@10.2.4: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    package-lock.json
  • low
    minimatch@9.0.9: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    package-lock.json
  • low
    ansi_term@0.12.1: 1 known vulnerability
    RUSTSEC-2021-0139
    src-tauri/Cargo.lock
  • low
    atty@0.2.14: 2 known vulnerabilities
    RUSTSEC-2021-0145, RUSTSEC-2024-0375
    src-tauri/Cargo.lock
  • low
    glib@0.18.5: 1 known vulnerability
    RUSTSEC-2024-0429
    src-tauri/Cargo.lock
  • low
    proc-macro-error@1.0.4: 1 known vulnerability
    RUSTSEC-2024-0370
    src-tauri/Cargo.lock
  • low
    rustls@0.23.42: 4 known vulnerabilities
    RUSTSEC-2026-0285, RUSTSEC-2026-0346, RUSTSEC-2026-0348, RUSTSEC-2026-0349
    src-tauri/Cargo.lock
  • low
    rustls-webpki@0.103.13: 1 known vulnerability
    RUSTSEC-2026-0382
    src-tauri/Cargo.lock
  • low
    tokio@1.53.1: 1 known vulnerability
    RUSTSEC-2026-0386
    src-tauri/Cargo.lock
  • low
    webpki-root-certs@1.0.9: 1 known vulnerability
    RUSTSEC-2026-0383
    src-tauri/Cargo.lock
  • low
    zbus_names@4.3.4: 1 known vulnerability
    RUSTSEC-2026-0371
    src-tauri/Cargo.lock
  • low
    zvariant@5.13.1: 1 known vulnerability
    RUSTSEC-2026-0370
    src-tauri/Cargo.lock
  • low
    zvariant_derive@5.13.1: 1 known vulnerability
    RUSTSEC-2026-0372
    src-tauri/Cargo.lock
  • low
    package.json has a postinstall script
    node bin/prepare-terminal.js
    package.json
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
cdn.npmmirror.comfonts.googleapis.comfonts.gstatic.comregistry.npmjs.orgregistry.npmmirror.comtelemetry.nextjs.org
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Pi Agent Desktop alternatives

View more →

Similar ai agents in Coding Agents, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Pi Agent Desktop (this page)
abcwyc
875MITNov 1, 2026Scanned, no flagged issues
AutoGPT
Significant-Gravitas
188kNone foundNov 1, 2026Not scanned yet
Langchain
langchain-ai
149kMITNov 1, 2026Scanned, no flagged issues
Gemini CLI
google-gemini
109kApache-2.0Nov 1, 2026Scanned, no flagged issues
MetaGPT
FoundationAgents
71kMITJan 21, 2026Scanned, no flagged issues
Oh My Openagent
code-yeongyu
71kNone foundNov 1, 2026Not scanned yet