Docker Pibox MCP Server

docker-pibox

pi-coding-agent inside an aicodebox container. One image, several ways in: interactive shell, one-shot prompt, HTTP API (with an OpenAI-compatible endpoint), MCP server, Telegram bot, and a cron scheduler that fires pi on whatever schedule you want.

You talk to pibox. pibox talks to pi. pi talks to whatever LLM you point it at. Nobody cares about the middle.

Table of Contents

• Quick start
• Using the pibox wrapper
• Image variants
• Modes
  • API mode
  • Telegram mode
  • Cron mode
  • MCP mode
• Configuration
• LLM providers
• Auth
• Agent integrations
• GitHub Action
• Development
• Tests
• License

Quick start

Install the host wrapper.

curl -fsSL https://raw.githubusercontent.com/psyb0t/docker-pibox/main/install.sh | bash

# Install the full image as the wrapper default.
curl -fsSL https://raw.githubusercontent.com/psyb0t/docker-pibox/main/install.sh | PIBOX_FULL=1 bash

The installer creates the Pi, pibox state, and SSH directories, pulls the selected image, and installs pibox on PATH. The minimal image is the default. PIBOX_FULL=1 on the bash side of the pipe selects the full image and bakes that choice into the installed wrapper.

Install pibox, codexbox, and claudebox in the same command directory, normally /usr/local/bin, when you want one box to launch another. Each wrapper finds the sibling wrapper files there and mounts them read-only into its container. A sibling then runs through the host Docker daemon and mounts its own host data directory.

Using the pibox wrapper

Run pibox from the directory you want Pi to work in. The wrapper mounts that directory at the same absolute path inside the container, persists ~/.pi, ~/.aicodebox, and ~/.ssh/pibox, forwards PIBOX_* configuration, and passes Pi arguments through unchanged.

# interactive Pi in the current directory
pibox

# one prompt, then exit
pibox -p "list the files in this workspace"

# use an Anthropic-compatible provider for this run
ANTHROPIC_AUTH_TOKEN=your-token \
ANTHROPIC_BASE_URL=https://api.z.ai/api/anthropic \
ANTHROPIC_MODEL=glm-4.6 \
pibox -p "explain this project"

# inspect Pi's native command surface
pibox --help

# temporarily use the full image instead of the installed default
PIBOX_FULL=1 pibox -p "run the test suite"

The wrapper is also the normal way to start a long-running mode. PIBOX_DETACH=1 makes the named container run in the background.

PIBOX_DETACH=1 \
PIBOX_API_MODE=1 \
PIBOX_API_MODE_TOKEN=your-secret \
PIBOX_AVAILABLE_MODELS=glm-4.6,glm-4.5-air \
ANTHROPIC_AUTH_TOKEN=your-token \
ANTHROPIC_BASE_URL=https://api.z.ai/api/anthropic \
ANTHROPIC_MODEL=glm-4.6 \
pibox

Use raw docker run only when you intentionally do not want the host wrapper. The wrapper is the normal interactive and service entry point.

Agent use and nested launches

The installed wrapper is the normal interface for people and agents. An agent should run pibox from the requested workspace instead of assembling a new docker run command. The wrapper preserves the workspace path, Pi state, aicodebox state, SSH state, image choice, and container lifecycle.

pibox -p "inspect this workspace and report the failing tests"
PIBOX_FULL=1 pibox -p "run the full test suite"
pibox -p "list the files" --thinking high

When one box needs another, install pibox, codexbox, and claudebox in the same command directory. A running box can call the sibling command directly. The parent wrapper passes the host launch context and mounts only the sibling wrapper file. Do not set AICODEBOX_HOST_*, copy a wrapper, or manually mount another box's state directory.

Image variants

• psyb0t/pibox:latest is the minimal image.
• psyb0t/pibox:latest-full starts from the shared aicodebox:latest-full base, then adds Pi and pibox. It carries the shared development toolchain without rebuilding it in this repository.

Modes

Foreground modes (API / Telegram / Cron) are mutually exclusive — except PIBOX_TELEGRAM_MODE=1 + PIBOX_CRON_MODE=1, which run together (cron in-thread inside telegram). API wins if set alongside anything else.

MCP mode (PIBOX_MCP_MODE=1) is independent — it coexists with whatever foreground mode is running. In API mode it's mounted at /mcp/ on the API port (slashless /mcp reaches the same handler); in other modes it runs as a sidecar uvicorn on its own port, serving at the port root.

Each mode has its own page with full setup, env vars, and examples.

API Mode →

Long-lived FastAPI server on :8080. Agent runs (sync, async with run-id polling, cancellable), workspace file upload/download/list/delete with traversal checking, and an OpenAI-compatible chat/completions endpoint with streaming and client-executed tool calling.

environment:
  - PIBOX_API_MODE=1
  - PIBOX_API_MODE_TOKEN=your-secret
  - PIBOX_AVAILABLE_MODELS=glm-4.6,glm-4.5-air

Telegram Mode →

Talk to pi from Telegram. Per-chat isolated workspaces, allowed-chats and per-chat allowed-users gating, file ingestion, [SEND_FILE: path] to get files back, and per-chat /model, /effort, /system_prompt, /append_system_prompt overrides that persist across restarts.

environment:
  - PIBOX_TELEGRAM_MODE=1
  - PIBOX_TELEGRAM_MODE_TOKEN=123456:ABC

Cron Mode →

YAML-defined scheduled jobs on 6-field croniter schedules. Per-run history dirs with meta.json, stdout.log, stderr.log, result.txt, and a "prior run" hint so a job can reference its own history.

environment:
  - PIBOX_CRON_MODE=1
  - PIBOX_CRON_MODE_FILE=/home/aicode/.aicodebox/cron.yaml

MCP Mode →

Exposes run_prompt plus workspace-confined file tools over streamable HTTP, so other agents can drive pi as a tool. Coexists with any foreground mode — mounted at /mcp/ on the API port in API mode, a sidecar on its own port everywhere else.

environment:
  - PIBOX_MCP_MODE=1
  - PIBOX_MCP_MODE_TOKEN=your-secret

Configuration

Set PIBOX_GIT_NAME and PIBOX_GIT_EMAIL on the host to configure the runtime user's global Git identity before startup hooks. Direct container deployments accept the same names. Nonempty AICODEBOX_GIT_NAME and AICODEBOX_GIT_EMAIL inside the container take precedence; through the wrapper, supply those shared values as AICODEBOX_ENV_AICODEBOX_GIT_NAME and AICODEBOX_ENV_AICODEBOX_GIT_EMAIL. Empty settings preserve existing Git config. Multiline values are rejected.

make version V=X.Y.Z synchronizes package metadata, lockfile, the Codex plugin manifest, and the installer's wrapper release ref without committing or tagging. Remote installs download the matching release wrapper unless PIBOX_INSTALL_REF overrides it. Updating an image does not update an installed wrapper.

Naming convention: PIBOX_<MODE>_MODE=1 is the on/off flag, PIBOX_<MODE>_MODE_<KNOB>=... is its config. Non-mode-scoped vars (workspace, container name, available models) are bare.

The image is built on top of aicodebox, so the equivalent AICODEBOX_* names also work — the entrypoint translates PIBOX_X to AICODEBOX_X when only the pibox-prefixed one is set. If you set both, AICODEBOX_* wins.

Set the upstream endpoint URL, protocol, API key or token, and model with LLM providers. PIBOX_PROVIDER_* supports Pi's documented OpenAI, Anthropic, and Google custom HTTP APIs. The ANTHROPIC_* variables below remain a compatibility path for existing Anthropic-compatible deployments.

Mode flags

Each mode's own knobs (ports, tokens, config paths, history dirs) live on that mode's page: api.md, telegram.md, cron.md, mcp.md.

Workspace & runtime

Automation can install the wrapper in another command directory with PIBOX_INSTALL_DIR and PIBOX_BIN_NAME. The installed wrapper accepts the versioned AICODEBOX_HOST_* nested-launch context. It uses those host paths as Docker bind sources, makes available sibling wrappers, and applies shared AICODEBOX_ENV_* and AICODEBOX_MOUNT_* values to the child container.

Under PIBOX_STATE_DIR (~/.aicodebox by default):

• Executables placed in bin/ are on PATH ahead of everything else, for pi in every mode, for init scripts, and for docker exec shells.
• Scripts placed in init.d/*.sh run once per container, after the image's own init scripts, as aicode with passwordless sudo. A failing script is logged and the rest still run. A new container runs them again, so make them safe to repeat.

Auth

For Anthropic-compatible endpoints, use the compatibility variables below. For LiteLLM or another OpenAI-compatible endpoint, use generic provider configuration.

Z.AI's GLM models are fast and cheap for most tasks — ANTHROPIC_BASE_URL=https://api.z.ai/api/anthropic + ANTHROPIC_MODEL=glm-4.6 is the recommended default.

pi's thinking levels (--thinking): off, minimal, low, medium, high, xhigh. Exposed as the /effort command in telegram mode and as thinking in API requests.

Agent integrations

The skill works in any agent that reads .agents/skills/ (such as peen). It tells agents to use the installed wrapper for local work and to use MCP only for an already-running remote server. It installs natively in the clients below.

Claude Code

claude plugin marketplace add psyb0t/agents
claude plugin install pibox@psyb0t

Claude Code prompts for the pibox URL and, if auth is enabled, the API and MCP tokens — sensitive values are stored in your OS keychain.

Codex

codex plugin marketplace add psyb0t/agents
codex plugin add pibox@psyb0t

Installed via the marketplace, the skill invokes as $pibox:pibox. Codex also picks the skill up automatically with no install in any repo containing .agents/skills/, where it invokes as plain $pibox.

OpenClaw

The skill is published to ClawHub on every release:

openclaw skills install @psyb0t/pibox

For MCP clients that speak local stdio, the @psyb0t/pibox plugin bridges to the service's /mcp/ endpoint:

openclaw plugins install clawhub:@psyb0t/pibox

Then set PIBOX_URL (and PIBOX_MCP_MODE_TOKEN if the server was started with MCP auth enabled).

Development

For one-shot GitHub jobs with read-only context, live tool logs, and collected output files, see the GitHub Action.

make help   # list targets
make build      # build the minimal image
make build-full # build the full image from aicodebox full
make build-all  # build both variants
make test   # run the full e2e suite (needs .env.test)
make test-action # test the GitHub Action contract without credentials
make clean  # remove built images

VERSION is read from pibox/pyproject.toml. make build pulls the published psyb0t/aicodebox base pinned in the Dockerfile; set SKIP_BASE_PULL=1 to use a locally-built base instead (e.g. from a sibling ../docker-aicodebox checkout), or override with make build BASE_IMAGE=....

Tests

End-to-end tests build the image and run it against a real LLM endpoint. Telegram tests use psyb0t/telethon-plus as a real MTProto userbot.

cp .env.test.example .env.test
$EDITOR .env.test   # fill in ANTHROPIC_* and optionally Coding Plan or Telegram creds
make test

Telegram tests auto-skip if AICODEBOX_TELEGRAM_MODE_TOKEN is empty. The generic-provider tests use both Z.AI Coding Plan endpoints and reuse ANTHROPIC_AUTH_TOKEN unless ZAI_CODING_AUTH_TOKEN is set.

License

WTFPL — see LICENSE. Do what the fuck you want.