Skip to content

v0.17.0: in the Claude directory, local models, SSRF hardening

Choose a tag to compare

View all tags
@keysersoft keysersoft released this 02 Oct 17:09
v0.17.0
5c70e1b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

AnythingMCP is in the Claude directory

Anthropic now lists AnythingMCP in the official Claude directory: claude.ai/directory/anythingmcp. From Claude, click Connect, sign in or create a workspace, approve, and Claude can search and run the tools of every connector in your workspace. Thank you to everyone who tested it with us. The README now carries the badge.

Security

Self-hosted instances should update.

  • Outbound requests to addresses that come from users (connector base URLs, token endpoints, spec and WSDL imports, MCP bridges) keep the SSRF check through redirects and when the connection is opened, not only before the request. The WSDL importer had no check at all; it has one now (#821, #826).
  • The SSRF allowlist applies to the whole instance, so it can only be edited on self-hosted instances, where the workspace admin is the operator. In Cloud it is set on the server (#826).
  • Accepting an invitation for an account that already exists now requires signing in as that account (#815).
  • cURL and Postman imports no longer stall on long runs of {{: the placeholder patterns are linear now. Thanks @pamod-madubashana (#789).
  • MCP endpoints have a per-caller rate limit, 1000 calls a minute per API key, user or IP by default (#820).

Everyone

  • Local models for the Knowledge Graph AI passes. Set KG_LLM_BASE_URL to any OpenAI-compatible endpoint (Ollama, LM Studio, vLLM, llama.cpp) and KG_LLM_MODEL to the model; KG_LLM_API_KEY is optional. A reply that isn't JSON skips that pass without overwriting anything. Thanks @bferanmi806-sketch (#816).
  • Updating a connector from the catalog keeps the tools you added yourself, and the preview shows the change tool by tool (#820).
  • Invocation logs keep an excerpt of large payloads (8 KB in, 16 KB out), and rows older than 14 days are shortened (#820).
  • A dropped network connection no longer signs you out; the page says "Connection lost" and reloads when the connection is back (#810).
  • The connect page turns green as soon as the first request from your AI client arrives (#806).

Connectors

  • Odoo: create, write and method calls with keyword arguments work (they all failed with 422), and the connection test uses an endpoint that checks the key (#822).
  • Etsy: valid includes on etsy_get_listing, clearer user_id guidance, and a new etsy_get_listings_by_shop (#819).

Cloud

  • Signing up from the Claude directory brings you straight back to the authorization page (#819).
  • 7-day trial with a card through Stripe (nothing charged during the trial), or without one; Settings → License says when the plan renews, ends or turns into a charge, and links to cancellation directly (#806, #817).

Self-hosted

  • Two additive database migrations (licenses.billing, mcp_tools.origin) run on start, as usual.
  • docker-compose.yml passes the KG_LLM_* variables and the provider keys through to the app.
  • The Docker build now fails if a backend dependency would be missing from the image, instead of producing an image that cannot start (#825).

Docker: helpcodeai/anythingmcp:v0.17.0

Assets 2
Loading