Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Evidence record / pi-coding-agent

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the signals and issues that cite it, below.

2026-10-13-pi-coding-agent-tools-stopped-being-a-strict-allowlist-once-codemode-or-tool-search-is-in-the-list-1-0

--tools stopped being a strict allowlist once codemode or tool_search is in the list (1.0.4). Through 0.87.0 the docs described --tools as a strict allowlist; the profile treated defaultTools as the nearest permission boundary. From 1.0.4, pi --tools read,codemode retains registered MCP tools with codemode/deferred exposure for scripts; active direct tools are also callable, hidden and inactive direct tools are not. An entry starting with mcp__ or an empty allowlist applies MCP filtering. --exclude-tools ‘mcp__*’ matches namespaced server tools but misses list_mcp_resources, list_mcp_resource_templates, and read_mcp_resource, which can reach resource-enabled non-hidden servers. The release calls retained MCP tools a fix because 0.99.0 through 1.0.3 left pi --tools codemode with no MCP servers. Plain lists without a route to codemode/deferred tools retain the narrower behavior. +codemode,-write edits defaults, project modifiers apply on top of user settings, and * patterns work in selection/exclusion.

Channel: tagged-release. Half: both. Date: 2026-10-05.

Operator consequence: Inspect CI/wrapper selections containing codemode or tool_search against the exposure-qualified callable set, not just declarations. Use --no-mcp for complete built-in MCP shutdown. For tool exclusions, include all three resource-tool names alongside mcp__*; a namespaced allowlist can narrow access to selected servers. Neither tool visibility nor a name filter proves that stdio processes or command-valued configuration never run. Plain lists such as read,grep,find,ls retain their previous narrower behavior.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-pi-coding-agent-tools-stopped-being-a-strict-allowlist-once-codemode-or-tool-search-is-in-the-list-1-0

Accepted signals

Profile citations

Source links

Primary links, including exact changelog lines when available.

  1. Pi Coding Agent
    github release2026-10-13-pi-coding-agent-tools-stopped-being-a-strict-allowlist-once-codemode-or-tool-search-is-in-the-list-1-0earendil-works/pi / v1.0.4commit2026-10-13-pi-coding-agent-tools-stopped-being-a-strict-allowlist-once-codemode-or-tool-search-is-in-the-list-1-0github.com/earendil-works/pi/commit/04b97ef0007ad2d55615d0a545163387a701fc67tagged commit file2026-10-13-pi-coding-agent-tools-stopped-being-a-strict-allowlist-once-codemode-or-tool-search-is-in-the-list-1-0earendil-works/pi / packages/coding-agent/docs/cli.md#L111-L138tagged commit file2026-10-13-pi-coding-agent-tools-stopped-being-a-strict-allowlist-once-codemode-or-tool-search-is-in-the-list-1-0earendil-works/pi / packages/coding-agent/src/core/agent-session.ts#L1541-L1556tagged commit file2026-10-13-pi-coding-agent-tools-stopped-being-a-strict-allowlist-once-codemode-or-tool-search-is-in-the-list-1-0earendil-works/pi / packages/coding-agent/docs/settings.md#L303tagged commit file2026-10-13-pi-coding-agent-tools-stopped-being-a-strict-allowlist-once-codemode-or-tool-search-is-in-the-list-1-0earendil-works/pi / packages/coding-agent/src/core/mcp-servers.ts#L12-L40tagged commit file2026-10-13-pi-coding-agent-tools-stopped-being-a-strict-allowlist-once-codemode-or-tool-search-is-in-the-list-1-0earendil-works/pi / packages/coding-agent/src/extensions/mcp/index.ts#L466-L488

Versioned source: run artifact