v0.53.0: management API and CLI, per-tool rate limits, tighter API keys

AnythingMCP 0.53.0: management API and CLI, per-tool rate limits, tighter API keys, 731 connectors

This release collects everything merged since 0.52.1. Version 0.52.2 was tagged without release notes, so its changes are listed here too. Main additions: a management API with the amcp command-line client, per-tool rate limits and latency stats for MCP roles, a webhook dashboard, stricter API key handling, and a catalog that grew from 694 to 731 connectors.

Management API and the amcp CLI

• Management-scoped API keys: a key can now be issued for the management API (/api/*), read-only or read-write, separate from MCP keys. MCP keys are refused on /api, and read-only keys cannot write (#1508).
• amcp CLI (npm i -g @anythingmcp/cli or brew install helpcode-ai/tap/amcp): browser login, MCP tool calls with JSON output, and amcp api for every management route, with a built-in route list (amcp api --list). Released separately as cli-v0.1.5 (#1508, #1514, #1515, #1520, #1524, #1525, #1572).
• The management API is documented in Swagger with real examples. Routes for the browser only are hidden from Swagger (#1528, #1558).
• Connector exports made with a read-only key never contain secrets, and exporting a connector from another workspace answers 404 (#1525).

Roles, limits and monitoring

• Per-tool rate limits for MCP roles: set them in Settings → Roles. A refused call is logged with the limit that refused it (#1544, #1556). Thanks @Coding-Professional.
• Per-tool latency and error rate in the audit view (#1521). Thanks @wunsir.
• Webhook dashboard: recent inbound events and the delivery URL of each connector with inbound webhooks (#1571). Thanks @rangarajan19.
• The tool registry is indexed by workspace and connector, and server/discover answers without the tool list. This keeps a burst of client handshakes from slowing down large instances (#1478).

Security

• API keys are scoped to the workspace they were created in. Before, a key followed its owner's active workspace and role (#1622).
• Per-user API keys are hashed at rest (keyed HMAC). Lookups use the hash (#1555).
• An MCP server's sign-in refuses a user from another workspace (#1609, #1613).
• Accounts must confirm their e-mail code before they can approve an AI client's access (#1566), and the sign-up code is checked on Enter (#1536).
• The app is kept out of search engines, except the Cloud sign-in page (#1562).

Connector engine

• loginBasicAuth for LOGIN_TOKEN logins: the login sends HTTP Basic built from username and password, for APIs such as Wazuh and the FileMaker Data API (#1460). Thanks @GallaGit.
• Token paths may point into a list (#1570), and query strings can be signed with sorted-query HMAC (#1543).
• A REST call that used up its whole deadline is not sent again (#1502). The "gave up" warning shows the HTTP status (#1505).
• Numeric limits and array item values of tool schemas reach the AI client (#1470).
• Installed catalog connectors send the catalog User-Agent (#1539).
• A __proto__ key stays data when a tool-call log excerpt is cut (#1469). The MCP in-flight gauge settles for clients that hung up early (#1577).
• Catalog search caps query length and trims words without a regex (#1501).

Connectors

• New:
  • from the community: Claris FileMaker (Data API, read-only, #1624, @GallaGit), Wazuh (#1461, @GallaGit), Faire (#1563, @aj-codespy), Factorial HR (#1534, @Aadithya-kl), Pixabay (#1468, @ak-bharadwaj), Podio (#1479, @ZYZ666-RGB);
  • from the team: TikTok Shop Seller (#1523, #1535), Falabella Seller Center (#1543), Grupo Éxito Marketplace (#1570), 15 adapters for helpdesk, company data, sports, fleet and market data (#1540), and catalog block 29: company registries, bol.com, Cin7, Tookan, Threads, NinjaOne, Housecall Pro, Egypt ETA (#1614).
• Widely used operations added to 16 adapters, among them eBay, Amazon, Mercado Libre and Etsy (#1541). Fudo gets expense, category and provider fields, plus stock and supplier tools (#1517).
• Handelsregister now uses the handelsregister.ai v1 API (#1606). Apify follows its MCP server 0.21 tool list (#1552). Ghost Admin API tokens are signed for each request (#1615).
• Clearer hints and limits for:
  • Etsy: tag length, title length, large offsets (#1471, #1503, #1527, #1553, #1569);
  • weclapp, Business Central and SAP Business One fields (#1476, #1549, #1569, #1619);
  • WooCommerce order lists, Mercado Libre visits, Printify pages and the eBay probe (#1504, #1578, #1619);
  • Odoo partners without the Invoicing app (#1597).
• Playtomic connectors are unlisted: Playtomic's login now needs app attestation (#1506).
• The Deepgram logo follows the new brand (#1616). Thanks @mwygant-dg.

Self-hosting

• A Docker Compose file for Coolify deployments (#1328). Thanks @flyingwebie.
• The files worker boots without Redis (#1526).
• Account and workspace deletion get a 60-second transaction timeout (#1567).
• File Search maintenance runs per workspace under row-level security (#1557).

AnythingMCP Cloud

These changes concern cloud.anythingmcp.com. Self-hosted instances are unchanged.

• Plans: the trial gets Team limits for File Search and code mode (#1599). Moving to Starter shows what changes before checkout, and items above the new plan's caps are paused, then restored on upgrade (#1601, #1602, #1603). Connectors with inbound webhooks are capped per plan (#1612). Code runs have a monthly cap and a per-workspace concurrency limit (#1492).
• Billing: each paid invoice is e-mailed as a PDF, and amcp invoices email switches it on or off (#1604). A link to the Data Processing Agreement is under Settings → License (#1511). Plan changes made on the licence site reach Cloud within seconds (#1560, #1561), and paid licences bind to their workspace within minutes (#1542).
• Setup: checks find the Odoo database name and test the address before a chat install (#1607, #1610). The YouTube API key field explains itself and refuses OAuth values (#1608). Servers that only accept approved IPs are shown the fixed outbound IP (#1487, #1493).
• Ended trials: the trial wall shows the workspace's own numbers, can switch workspace, and preselects the fitting plan. A no-login reactivation page serves blocked calls (#1475, #1497, #1573–#1576).
• ChatGPT: the AnythingMCP plugin and a File Search plugin with folder setup during authorization are listed in the ChatGPT plugin directory (#1486, #1494, #1545, #1546, #1550).
• Support chat: it can set up a connector, for example Telegram from a pasted bot token, and tells customers when a person takes over (#1583, #1585, #1623, #1625).

Docs

• The connector catalog by category (docs/catalog) and a catalog page for each connector: how to start without code, how it works, and every tool (#1548, #1554).
• Use-case guides for Odoo, Etsy and SFTP/FTP with Claude, and a CLI announcement guide, in English, German and Italian (#1514, #1516).

Other

• Dependency updates: Next.js 16.4.5, @nestjs/swagger, openid-client, imapkit, jmespath, pino-pretty, @azure/identity (msal-node 7.2.1) and others.
• CI boots the backend and the files worker from the build on every PR, and the CLI is tested on Linux, Windows and macOS (#1532, #1537).

Thanks to everyone who contributed to this release: @GallaGit, @Coding-Professional, @wunsir, @rangarajan19, @aj-codespy, @Aadithya-kl, @ak-bharadwaj, @ZYZ666-RGB, @flyingwebie and @mwygant-dg.

Docker image: helpcodeai/anythingmcp:v0.53.0