Pi-AI

Beta

Pi-AI is in BETA. This means the component is under development and may not yet be suitable for your use-case, it is being actively developed and receiving feature enhancements and bug fixes. If you encounter any issues please raise them in the usual way with Panintelligence Support. We expect Pi-AI to leave BETA in around 3 months once we are happy with the stability and quality.

Purpose

Pi-AI is an MCP server application that allows AI applications such as Claude Code to interface directly with the Panintelligence application, for example in future it could allow managing users, creating reports and building data connections. It is aimed at dashboard developers and integrators familiar with AI tools. It is also used by the Panintelligence suite directly to support some of the built in AI features. Pi-AI facilitates agentic AI use and allows ai agents to trigger changes in the Panintelligence software but only within the user access level of the user account in use. PI-AI should not be deployed in high risk environments without additional verification.

Classification

Pi-AI is classified as (awaiting confirmation) under the EU AI Act.

Warnings

By enabling Pi-AI you become a deployer of an AI system under EU AI Act Art. 26 and you take on the following deployer obligations:

Human oversight (Art. 26)
Usage logging (Art. 19)
Conformity assessment support (if deployed in a high-risk context) (Art. 27)

Human oversight should be used to check outputs for example created items and monitoring activity logs.

Customers should include Pi-AI in their own AI system register.

Introduction

Pi-AI is our component which hosts our MCP server. You can use our MCP server and tools to integrate AI Agents with your Dashboard following the conventional patterns. The MCP server typically would be hosted alongside your Dashboard, but it is also possible to run a local version. Below is an outline of the currently available tools; we’d really like to build out this tool list, so please feed back any use-cases you have for consideration.

Windows

On Windows, the service is available in the installer and will be pre-configured.

Containers

On other platforms, we highly recommend deploying via the Docker image ghcr.io/pi-cr/pi-ai:VERSION. The service will listen on the port specified by PI_AI_PORT and will only allow requests to be sent to URLs specified in PI_AI_ALLOWED_URLS.

The service is stateless and can interact with one or many Pi dashboard applications. Outbound requests are sent to the URL provided by the Pi-Url header (or the additional services dashboard URL config option in the Pi application). Outbound requests will be blocked unless the dashboard is specified in the allow list via PI_AI_ALLOWED_URLS

It’s crucial that the settings in Pi and Pi-AI are set up properly.

See our example docker-compose for a working setup example: https://github.com/Panintelligence/docker-deployments/blob/main/docker-compose/base.compose.yml

Discovery

Pi Instances will use the environment variable PI_VARIABLE_PI_AI_URL (or in the admin interface PI_AI_URL) to find Pi-AI
Pi-AI instances will call back to the environment variable PI_ADDITIONAL_SERVICES_PI_CALLBACK_URL supplied to pi.

Configuration

The following options can be configured via environment variables:

Port - the service port (configure with PI_AI_PORT)
Allow-list - the list of remote hosts that the service can interact with (configure with PI_AI_ALLOWED_URLS and provide a comma-separated list of hosts
- e.g., https://dashboard.panintelligence.cloud,https://dashboard2.panintelligence.cloud
Structured logging - structured logging can be enabled by specifying the json format to the environment variable PI_AI_JSON_LOGGING, allowed values are ecs, gelf or logstash
Pi-AI can serve multiple pi dashboard instances in total isolation, it does not use state. If you wish to do this you should observe the performance carefully and scale up as required.

OTLP

MANAGEMENT_TRACING_EXPORT_ENABLED: true
MANAGEMENT_OTLP_METRICS_EXPORT_ENABLED: true
MANAGEMENT_OTLP_METRICS_EXPORT_URL: http://.../v1/metrics
MANAGEMENT_TRACING_SAMPLING_PROBABILITY: 1
MANAGEMENT_OPENTELEMETRY_TRACING_EXPORT_OTLP_ENDPOINT: http://.../v1/traces

If you don’t use OTLP monitoring you should disable with

MANAGEMENT_LOGGING_EXPORT_ENABLED=false;
MANAGEMENT_OTLP_METRICS_EXPORT_ENABLED=false;
MANAGEMENT_TRACING_EXPORT_ENABLED=false;

Security Hardening

MUST: TLS is required for all production Pi-AI deployments
MUST: The token used must be specific for the user and have permissions limited to the minimum required. For example to use the create_chart tool the user account must be a chart designer in the same way they would through the application interface
MUST: You should rotate api tokens on a regular basis, for example every 3 months
MUST: You should store api tokens using in a secure fashion, for example not in plain text files or source code, for example you can utilise environment variables
SHOULD: Pi-AI should be deployed in a network segment with restricted limited access to the allow-listed pi dashboard urls.
SHOULD: You should use mTLS between Pi-AI and Pi instances in production

Application Health and Monitoring

You should use OpenTelemetry monitoring for traces and metrics in production via the settings above
You should monitor the health of the application with the health endpoint:
- http://localhost:9919/actuator/health (look for status: ‘UP’)
- Note this endpoint provides operational monitoring only and does not constitute audit logging for regulatory purposes
You must use structured logging in production, configurable via PI_AI_JSON_LOGGING
You must retain logs for at least 6 months to satisfy obligations under EU AI Act Art. 19
Log output is sent to stdout or the filesystem on Windows

Human Oversight

It is very important that human oversight is used in conjunction with agentic AI. Agents can take many actions without a human being fully aware or validating.

You should review logs regularly from both Pi-AI and your agentic tooling
You should confirm that tokens used have an appropriate level of permission, do not grant access to everything
You should establish a review process for anything created by AI
You should consider a staged roll-out, trialling in a low-risk test environment for instance
If unexpected behaviour is observed we recommend deactivating the token and using the audit logs to aid investigation
You can disable external MCP access by shutting down the PI-AI service.

Available MCP tools

The server exposes the following MCP tools:

Name	Purpose	Data Available

Name	Purpose	Data Available
get_v3_open_api_json_spec	Returns the V3 OpenAPI JSON spec for building valid API payloads	No customer data available (static info only)
create_chart	Creates a chart using a payload that matches `POST /api/v3/charts`	No customer data available (create only)
list_data_connections	Lists all data connections available to the user, eg HR_DB SALES_DB	Customer data connection details available to the user in use including names, connection settings etc
list_data_connection_columns	Lists database columns available to the user for the provided data connection id eg EMPLOYEE_NAME SALES_VALUE	Customer data connection column details available to the user in use including column names, column settings etc
list_categories	Lists categories available to the user eg HR dashboard Sales dashboard	Customer categories available to the user in use
skill_chart_builder	Provides the chart builder skill, providing assistance to agents building charts	No customer data available (static info only)

Note

Required headers

Requests must include these headers:

Authorization: Bearer <token>
- Must be a valid PI API token.
Pi-Url: <pi-instance-url>
- Must be an absolute URL for your Pi instance (for example <http://my-pi-host/pi>)
- Must be resolvable from the Pi-AI service; for example, if inside a container, there must be a route for that hostname to the location where the Pi dashboard is running.
- Must be allow-listed by server configuration.

If either header is missing or invalid, the tool call is rejected.

Using with Third-party AI Agents

The Pi-AI service provides an MCP Server which can be utilized by third-party AI Agents, for example Claude Code.

The following is an example mcp.json showing how you would configure the mcp server in Pi-AI in an external tool:

{
  "mcpServers": {
    "pi-ai": {
      "url": "https://pi-ai.panintelligence.cloud/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_PI_API_TOKEN>",
        "Pi-Url": "https://pi.panintelligence.cloud/pi"
      }
    }
  }
}

Known Limitations

The MCP server is currently limited to functionality used by the AI Chart Builder feature rather than being a comprehensive set of functionality
The MCP server is very lightweight and is unlikely to hit performance issues when deployed 1-1 with a pi server. If you configure it against multiple pi hosts you should monitor the performance carefully and scale up as required.
The chart creation feature in the MCP server is currently limited in terms of the parts of the chart configuration it can create, for example it cannot add filters or set chart attributes.

Prohibited Uses

Do not use with unsupervised autonomous operation without human review
Do not use with high-risk use cases as defined in the EU AI Act Annex III (employment decisions, credit scoring, healthcare decisions, law enforcement) unless a Fundamental Rights Impact Assessment (FRIA) has been completed
Do not use with LLM providers that have not been assessed for GDPR compliance
Do not deploy without TLS in any environment accessible from outside localhost

Future Roadmap

Pi-AI will be developed to build out the functionality in areas determined to be of use to customer and internal Panintelligence use-cases.