🛒 pi-marketplace

Pi extension for searching, auditing, and installing pi packages from npm — with built-in security review and optional pi.dev enrichment.

Features

| Tool | What it does | |------|-------------| | marketplace_search | Search pi packages by keyword, filter by type (extension/skill/prompt/theme) | | marketplace_detail | Full package info: version, author, license, pi manifest, dependencies, size | | marketplace_audit | Security audit: metadata check + source code keyword scanning | | marketplace_install | Audit → user confirmation → install (never auto-installs) |

Install

pi install npm:pi-marketplace

Reload if pi is already running:

/reload

Usage

Search packages

Ask pi to find packages:

Find me a Pi package for MCP

What theme packages are available?

Search for subagent-related extensions

View details

Show me details of pi-mcp-adapter

Security audit

Audit the package @some-user/some-pkg before installing

Install with review

Install pi-mcp-adapter (will run audit first)

How It Works

1. Search: Queries npm registry with keywords:pi-package, filters by your query
2. Type filtering: Fetches each result's pi manifest to determine resource type locally
3. pi.dev enrichment (optional): Fetches pi.dev package cards to add author, human-readable downloads, relative publish time, and richer type display when available
4. Security audit:
   • Layer 1 — Metadata (zero cost): Resource types, dependency count, file count, package size, insecure flag
   • Layer 2 — Source scan (downloads tarball): Scans published .ts/.js/.mjs/.cjs files for dangerous patterns:
     • 🔴 Critical: rm -rf, rimraf, fs.unlink, fs.rmdir
     • 🟠 High: eval(), Function(), execSync(), spawn()
     • 🟡 Medium: process.env, child_process, HTTP requests
     • 🟢 Low: chmod, chown
5. Install: Shows audit report → requires explicit user confirmation → runs pi install

Design Principles

• Registry-first: Search, detail, type filtering, and audit rely on npm registry metadata for correctness.
• Optional pi.dev enrichment: Search results can be enriched with pi.dev gallery metadata for better browsing and display.
• Never auto-installs: Always requires user confirmation after audit.
• Static scan disclaimer: Clearly states that keyword scanning cannot detect obfuscated code.
• Zero dependencies: Pure TypeScript, no runtime npm dependencies.

Development

git clone https://github.com/507/pi-marketplace.git
cd pi-marketplace
npm install          # peer deps
pi --no-extensions -e .   # load only this extension for testing

Test

npm test

Type Check

npm run typecheck

Configuration

No configuration needed. All tools accept parameters at call time:

| Parameter | Tool | Description | |-----------|------|-------------| | query | search | Search keyword | | type | search | Filter: extension / skill / prompt / theme | | limit | search | Max results (default 20) | | name | detail / audit / install | Package name | | deepScan | audit / install | Download and scan source (default true) |

License

MIT