v0.20.0: Gmail, Outlook, Shopify, Salesforce and 22 more connectors, SOAP WS-Security

Connectors

26 more adapters in the catalog: 325 in total, up from 299.

• Mail and office. Gmail can read, search, label, write drafts, send and reply in a thread. Messages come back as decoded text instead of Gmail's MIME tree (#951). Microsoft Outlook covers mail, calendars and free/busy through Microsoft Graph (#932, #941). Slack works with channels, threads, messages and reactions (#951).
• Commerce. Shopify (Admin GraphQL, client credentials from a Dev Dashboard app), Printful, Gelato, Wix, PrestaShop and JTL Fulfillment Network (#951, #932, #933).
• CRM and work. Salesforce (REST API v67.0, OAuth through an External Client App, sandboxes and Developer Edition included), Asana and KeyCRM (#951, #933).
• Messaging and Ukraine. WhatsApp through Z-API, WaNotifier and Wassenger, plus Nova Poshta, Prom.ua and Rozetka (#933).
• MCP bridges to the vendors' official MCP servers: Linear, GitHub, Stripe, Atlassian, Snowflake, Firecrawl, Apify, Notion and Helium 10. A bridge takes the live tool list when it is installed. The MCP OAuth client now uses authorization endpoints as published (Stripe, Apify and Slack host theirs on other domains) and sends the RFC 8707 resource parameter (#904, #938).
• Kenjo, Scopevisio and Substack are fixed and PAYONE is retired (#933). Seven German adapters have proper instructions and corrected descriptions (#928). Etsy app keys are checked before the user is sent to the Etsy sign-in (#936, #924, #926).

SOAP

• WS-Security UsernameToken (PasswordText or PasswordDigest). Parameters are wrapped in the input element the WSDL declares, and parsed WSDLs are cached. JAX-WS style ports now get their SOAPAction (#952, fixes #735 and #736).
• SOAP 1.2, nested values, unqualified child elements, optional parameters and a connection test that keeps a service healthy when it answers but publishes no WSDL. Tools imported before this release keep sending exactly the same envelope; re-import the WSDL to pick up the new behaviour (#954).

Engine

• Opt-in features for adapters:

  • Errors that APIs report inside an HTTP 200 body are treated as failures (connector.config.errorWhen).
  • XML values are escaped.
  • Every cookie of a login response is kept.
  • The OAuth code exchange sends a User-Agent.

  Connectors that don't use these behave as before (#929).

• Email from a REST tool. A {"__mime": {...}} marker in a body mapping builds an RFC 5322 message, with encoded non-ASCII headers, an optional HTML part and protection against header injection. responseMapping.decode turns a Gmail message into headers and plain text. Both apply only where a tool asks for them (#951).

• Pasted addresses in subdomain variables. A whole address pasted into a variable like acme (for acme.weclapp.com) is shortened to the subdomain, for every adapter built that way. An address on another domain is refused with a message saying what to enter. The same applies when editing a connector's variables (#950, fixes #733; #925).

• Required variables. Setup asks for variables that only the tools use, such as an API key that goes in the request body. Before, such a connector counted as ready while the placeholder was sent to the vendor (#930). When the Odoo database name does not exist, the error names the right one (#931).

• OAuth editor. Client credentials edited there now reach every field derived from them (#923).

• Error hints for the AI client:

  • weclapp field names and Telegram chats (#924).
  • A 401 on a connector whose token is in the URL (#947).
  • Shopify apps that are not installed or lack customer data access, and Printful calls that need a store (#951).

• Invocation log and knowledge graph. The log keeps rows whose payload contains emoji cut in half or NUL characters, which Postgres refused before. Knowledge-graph ingest no longer stops for a whole workspace when a connector was deleted (#947).

Emails and sign-in

• Redesign. One layout for every email the backend sends, a restyled sign-in and authorization page, and one-click unsubscribe (List-Unsubscribe-Post) on lifecycle emails (#939, #944).
• Public stats. GET /api/public/stats returns aggregate numbers (GitHub stars, Docker pulls, and on Cloud workspaces and tool calls) for emails and pages (#939).

AnythingMCP Cloud

• Sign-up and trial. The card-trial plan picker starts on Starter (#940). The Claude Directory badge is hidden for people connecting ChatGPT or Muse (#945). The empty-workspace prompt records whether the card trial was offered (#927). A workspace that signed up through an ad is reported once to the licence site when its first tool call succeeds, so campaigns are measured on real use; inert on self-hosted (#955).
• Email copy. Emails no longer talk about prices or name a customer in the footer (#944).

Dependencies

shell-quote and sharp are overridden past their pinned vulnerable versions. Both are development-only and neither ships in the Docker image (#922).

Self-hosted

• Database and settings. No migration and no new setting.
• Outbound calls. The backend reads the public star and pull counts of this repository and of the Docker image from GitHub and Docker Hub, at start and at most once an hour, for the numbers in its emails. If those hosts can't be reached it keeps the last value and carries on.
• Docker image. helpcodeai/anythingmcp:v0.20.0.