Pico, Security for coding agents

Coding agents have access to more than we realize. Pico shows you what that access can become.

Pico is a security tool for understanding how untrusted influence can reach consequential authority through coding agents.

It discovers the agents, MCP servers, tools, permissions, credential references, and provider connections already present in your environment. Then it connects them into a security graph and looks for paths where something untrusted can influence an agent that has the authority to do something consequential.

The goal isn't another list of configuration warnings. Pico shows you the path.

A finding explains what can influence the agent, what the agent can reach, the evidence supporting that relationship, which boundaries are actually enforced, and where the path can be cut.

Pico does this in three steps:

Discover → Connect → Explain

Discover what exists. Connect what can reach what. Explain the dangerous paths with evidence.

Everything happens locally and read-only. Pico doesn't modify the environment it's inspecting, doesn't require an account or hosted control plane, and doesn't persist secrets. Observations and the resulting security graph live in a local SQLite database.

Unknown relationships stay UNKNOWN rather than being guessed into existence.

Getting started is intentionally small: install Pico, run pico init, then pico scan.

Pico is built by Boring Infra Co. around a simple idea:

Don't just ask what your agent can access. Understand what that access makes possible.