Do Coding Agents Really Need Unrestricted Shell Access?

Coding agents require access to repositories for various tasks such as reading, searching, following definitions, changing source code, and inspecting diffs. A general-purpose shell can perform these tasks, but it also has the potential to execute a wide range of commands, which may pose security risks. The my-pi project aims to explore a bounded repository capability layer with Model Context Protocol (MCP), AST/LSP code intelligence, guarded writes, and Git context.

The my-pi approach proposes an explicit workspace authority, where an agent must specify the repository it needs access to. This contract can be refined further by using a MY_PI_WORKSPACE_ROOT variable or by opting into the current directory with --allow-cwd. This explicit authority helps define the boundaries of the repository context, making it easier to inspect and explain.

By default, the my-pi profile offers read-only access to certain repository features such as metadata inspection, file reading, searching, querying AST structure, requesting code-intelligence operations, and inspecting Git status or diffs. To perform mutations or start a language-server process, an explicit "trusted" profile must be specified using --security-profile trusted. This distinction allows for a more granular control over the agent's capabilities without resorting to arbitrary command execution.

The my-pi alpha surface currently supports 13 core tools, including workspace_info, file reading and writing operations, filesystem operations, searching, AST searching, language server status, symbols, navigation, diagnostics, and version control status and diff context. The server also communicates capability availability, allowing callers to reason about the categories, risk class, and failure modes of the exposed tools.

This transparency helps avoid the assumption that a shell provides a comprehensive and secure interface for coding agents.