Oyster is a mobile-friendly web interface for controlling the pi coding agent from a browser. It streams pi over HTTP and Server-Sent Events, supports multiple sessions, and can be exposed through an ordinary HTTP tunnel.
1browser ── HTTP/SSE ──> Oyster ── RPC over stdio ──> pi --mode rpc
Use HTTPS with valid TLS for every remote connection. Plain HTTP is acceptable only on loopback for local development.
The bearer token authenticates requests but does not encrypt them. Without TLS, an observer can capture the token, prompts, transcripts, file contents, and OAuth interactions. The static page contains no secret, and local pi credentials remain in pi's own auth.json, but an authenticated Oyster client has powerful access to the agent and workspace.
A public tunnel makes the application internet-accessible. Treat the token and any URL containing it like a password, and follow the complete security guide.