I’m having a good time with pi, a lovely minimal agent harness made by thoughtful Austrians. It’s a super-solid, very extensible foundation to work with, and writing your own extensions is more than encouraged. I like that.
One of the new features in Claude Code that I ended up digging a lot more than I had anticipated is its Auto Mode. It is not sandboxing; it’s a set of guardrails. The basic idea of Auto Mode is that there’s a separate classifier model looking at everything the clanker is trying to do (reads, writes, edits, any tool calls, etc.) and judging it against a list of rules, rules like “Do not exfiltrate secrets." The classifier model is independent from the main model, they do not cross their streams, and it has the power to stop an agent’s action before it is executed. Again: this is “only” surprisingly effective guardrails.
I was sceptical at first, but it works exceptionally well for me. For some work, I still like to put the clanker in a VM, but most of the time, I’m quite happy with auto mode.
Pi doesn’t have an auto mode. There were a couple of extensions, but none did it for me; either I ran into issues or they weren’t working as expected.
My pi-automode guardrail extension brings Auto Mode to Pi (who would’ve guessed) and is modelled after Claude Code’s behavior. From the readme:
It intercepts agent tool calls before execution and blocks actions that match permission deny rules, deterministic hard-deny checks, or the auto-mode classifier’s block decision. […]
Extensions run in the Pi process, and a determined malicious extension can do anything your user account can do. It also does not guard user
!/!!shell commands; by design, it guards agent tool calls only. Use this to reduce unsafe autonomous tool use, not as an OS security boundary.
It’s customizable, comes with a sane set of default rules, supports extra rules, shows you whether it’s running or not in the footer, outputs clear deny messages, and tries to be a good pi plugin in general.
After installing it, pick a classifier model via /automode model. Personally, I’m quite fond of gemma-4-26b-a4b-it for that task, served by French inference provider Scaleway: capable AF, cheap as chips, and plenty fast (usually >500 tps). I access Scaleway through the EU-based inference router Cortecs which I’ve written about here a few weeks ago.
After picking a model, you’re good to go. Give it a spin! I use it a lot, I like it a lot, and maybe it’s something you’ll find useful, too.
