pi — hands-on review full setup and audit, July 2026

Test context

pi 0.82.1, package @earendil-works/pi-coding-agent, full setup and audit done in July 2026 on my primary machine (Mac, Neovim + herdr, config versioned via chezmoi). Certainty level up front: this is not my primary daily agent — that’s still Claude Code. I built a complete pi setup (14 extensions, one-model-per-preset layering, shared skills), audited it line by line, but haven’t yet run it under weeks of production load. This review covers what the setup does, verified against real code — not a daily-driver gut feeling.

What it actually does

pi connects the terminal to 30+ providers with a deliberately bare core. Its author’s line sums it up: “pi is aggressively extensible so it doesn’t have to dictate your workflow.” Concretely, it hands you seven tools (read, bash, edit, write, grep, find, ls), a TUI, JSONL sessions that branch — and nothing else. No MCP servers, no sub-agents, no plan mode, no permission popups. Everything missing is a choice, not an oversight: it’s on you to build it as a TypeScript extension.

What makes it interesting for a serious agentic workflow is native multi-provider combined with extensibility. That’s what makes one-model-per-preset layering not just possible, but clean.

What works

Multi-provider as a foundation, not an option. Ctrl+P cycles between Claude, GPT, Gemini, opencode Go models and local, without leaving the session. On that base, assigning a model to each role — the fastest for mechanical volume, the most capable for plan — becomes one line of config. That’s the model routing that Claude Code, single-provider, structurally cannot offer.

A nuance learned in use: calling Claude from pi goes through claude -p, which breaks interactive prompts (no AskUserQuestion) and blinds any supervision. So in my layering, open models hold every preset, and the frontier — when a task deserves the best model with all the gates — goes to Claude Code directly, outside pi. pi’s multi-provider is real, but it stops where a provider’s interactivity matters.

Extensibility that absorbs what you already have. My fifteen Claude Code bash hooks — rm -rf blocking, secret-guard, pre-push-gate, review-gate — collapse into a single typed extension. Instead of fifteen scripts maintained separately, one file with isToolCallEventType("bash", event) handing you a typed event.input.command, access to ctx.ui.confirm() and the session manager. Testable, importable, versionable. The code for these guardrails is public, with their test benches.

Zero duplication with the rest of the setup. pi reads standard skills straight from ~/.claude/skills — 37 skills exposed, only their descriptions in context (progressive disclosure, ~1,600 tokens). Knowledge doesn’t fork across tools: it lives in one place.

What doesn’t work

No sandbox, and it’s structural. pi runs with your user permissions. The only guardrails are the extensions you write. If you don’t code destructive-command blocking, there is none — and auditing my own setup proved it: my rm -rf block regex let the most common forms through (rm -rf ~, rm -rf $HOME) because it required a character after the path. The net you think you have is only real once you test it.

Layering isn’t a native feature. The presets carrying my whole workflow are an in-house extension (preset.ts) — zero occurrences of “presets” in pi’s own code. It works, but with no net upstream: it’s my code, with my bugs.

Non-interactive mode lies by omission. In pi -p or --mode json, defaultProjectTrust is “ask” — so no trust prompt shows, and project resources are silently ignored. You think pi reads your AGENTS.md; it doesn’t, and it won’t tell you. You need --approve. A trap only an audit reveals.

A pre-scheduled alias debt. Extensions still import the old @mariozechner/* scope; CHANGELOG 0.80.0 announces the future removal of the alias to @earendil-works/*. Today it passes thanks to loader aliasing — the day it drops, everything breaks at once.

Who is it for?

pi is the right pick if you already live in the terminal and anti-lock-in is a requirement, not a preference: BYOK, MIT, multi-provider, everything portable. It’s also the best ground I know for clean model layering — a topic I cover in a dedicated piece on opencode Go.

But be clear-eyed about the contract: pi’s minimalism hands the work back to you. No MCP, no sub-agents, no default guardrails — you build, or you go without. If you want plug-and-play, Claude Code ships the ecosystem turnkey; if you want multi-provider without reimplementing everything yourself, OpenCode is a notch less bare. pi rewards those who want to control everything, and punishes those who hoped to maintain nothing.