---
title: "Pico Overview"
description: "Discover the dangerous paths your AI agents create — local-first security observability."
---
[Pico](https://github.com/BoringInfraCo/Pico) is a local-first, offline security observability tool for AI-assisted development. It records the security-relevant state of agent environments — agents, tools, permissions, and connections — into a local SQLite database.

**Design principle:** Pico does not block, sandbox, or remediate. It observes and maps attack paths.

## What it does

- Record agent environments into a local security graph
- Map attack paths from untrusted input to consequential authority
- Surface findings with evidence, enforced boundaries, and cut points
- Track credential reachability with fingerprints only — never persist secrets

## Example attack path

```
Public GitHub Issue → GitHub MCP → OpenCode → Bash → Cloudflare Token → Production Worker
```

## Key concepts

| Concept | Description |
|---------|-------------|
| Security graph | Agents, capabilities, actors, authority, sinks — connected with evidence |
| Attack paths | Chains from untrusted input to consequential authority |
| Findings | Critical paths with evidence, enforced boundaries, cut points |
| Fingerprints | Credential reachability without persisting secrets |

## Current state

Pico is in early development. The foundation release provides:

- `pico init` — creates `.pico/pico.db`, applies schema migrations
- `pico scan` — records a scan lifecycle

Agent and provider discovery are on the roadmap. The product vision on [boringinfra.company/pico](https://boringinfra.company/pico) describes the full security graph capabilities.

## Tech stack

- **Language:** Rust
- **Storage:** SQLite (`.pico/pico.db`)
- **Output:** JSON schema v1 for history, diff, and MCP
- **Platforms:** macOS and Linux
- **License:** Apache-2.0

## Resources

- [Quick Start](/docs/products/pico/quick-start)
- [Use Cases](/docs/products/pico/use-cases)
- [Product page](https://boringinfra.company/pico)
- [GitHub](https://github.com/BoringInfraCo/Pico)