Pico Overview

Pico is a local-first, offline security observability tool for AI-assisted development. It records the security-relevant state of agent environments — agents, tools, permissions, and connections — into a local SQLite database.

Design principle: Pico does not block, sandbox, or remediate. It observes and maps attack paths.

What it does

• Record agent environments into a local security graph
• Map attack paths from untrusted input to consequential authority
• Surface findings with evidence, enforced boundaries, and cut points
• Track credential reachability with fingerprints only — never persist secrets

Example attack path

Public GitHub Issue → GitHub MCP → OpenCode → Bash → Cloudflare Token → Production Worker

Key concepts

Concept	Description
Security graph	Agents, capabilities, actors, authority, sinks — connected with evidence
Attack paths	Chains from untrusted input to consequential authority
Findings	Critical paths with evidence, enforced boundaries, cut points
Fingerprints	Credential reachability without persisting secrets

Current state

Pico is in early development. The foundation release provides:

• pico init — creates .pico/pico.db, applies schema migrations
• pico scan — records a scan lifecycle

Agent and provider discovery are on the roadmap. The product vision on boringinfra.company/pico describes the full security graph capabilities.

Tech stack

• Language: Rust
• Storage: SQLite (.pico/pico.db)
• Output: JSON schema v1 for history, diff, and MCP
• Platforms: macOS and Linux
• License: Apache-2.0

Resources

• Quick Start
• Use Cases
• Product page
• GitHub