🗺️ Roadmap — what AnythingMCP is shipping next

[keysersoft]

🗺️ AnythingMCP — public roadmap

This thread tracks where AnythingMCP is heading. The full document lives in ROADMAP.md — this discussion is where you can comment, push back, and propose changes.

Now (in active development)

• More pre-built adapters — community-requested SaaS connectors (vote in Which integrations should we build next?)
• Improved adapter authoring DX — better validation errors, scaffolding CLI
• Tool-level rate limiting per role
• Sharper observability: per-tool latency histograms, error-rate dashboards

Next

• Streaming tool responses for long-running calls
• Tool composition (chain tools without leaving the gateway)
• Multi-tenant Cloud parity
• Adapter marketplace (curated plugin index)
• gRPC connector type
• Webhook ingestion as MCP "events"
• Native MCP elicitation & resources support

Want to influence priorities?

• 👍 React on the items above
• 💡 Open a new thread in Ideas
• 🐛 Found a bug? Open an issue

⭐ Star and 👀 Watch the repo to be notified when items ship.

[github-actions[bot]]

🚀 v0.1.23 — silence MCP duplicate-registration warnings is out

Published 2026-05-10 — see the full release notes.

Silences Dynamic tool 'X' already registered in module — Overwriting. warnings emitted at boot.

The internal ToolRegistry correctly handles cross-tenant tool-name collisions; only the upstream single-tenant @rekog/mcp-nest registry was generating noise. The fix registers each name on the upstream registry only when it first appears, and releases it only when the last entry leaves.

See #152 for details.

---

Update with docker compose pull && docker compose up -d (self-hosted) or wait for the Cloud rollout (~24h after this comment).
⭐ Star · 👀 Watch → Releases · 💡 Vote on the next adapter

[github-actions[bot]]

🚀 v0.1.24 — OpenAPI 3.1, healthcheck UX, SSRF allowlist, re-import preserve, MCP coercion is out

Published 2026-05-12 — see the full release notes.

Six customer-driven fixes from the FastAPI / koch-filesystem-bridge integration:

Connector import / parsing

• OpenAPI 3.1 normalizer (#1) #163 — OpenAPI 3.1 docs (FastAPI ≥ 0.100, NestJS modern, spring-doc 3.x, Hono) now import cleanly. Internal normalizer downgrades 3.1-only constructs (`type: [X,'null']`, `anyOf+null`, `const`, `examples` plural, `exclusiveMinimum:`) to their 3.0 equivalents and relabels the document to `3.0.3` so swagger-parser accepts it. `info.summary` stripped defensively.
• Preserve operator config across OpenAPI re-imports (#6) #168 — Re-importing a spec no longer wipes operator customisations. Tools are matched by `operationId` first, then `(method, path)`. Custom `responseMapping` and the operator's `isEnabled` toggle survive. Tools removed from upstream get a `deprecated` badge instead of staying as zombies; role assignments and invocation history preserved.

Tool runtime

• Coerce string→number/boolean on MCP tool params (P2) #169 — MCP tool param schemas use `z.coerce.*` for `integer` / `number` / `boolean` / `date-time`, so clients that serialize arguments as strings (`{"top_k": "5"}`) pass validation. Coercion still rejects non-coercible strings (`"abc"`).

Test / debug UX

• Connector healthcheckPath + classified test errors (#3) #165 — `Connector.healthcheckPath` auto-detected from imported OpenAPI specs (`/health`, `/healthz`, `/_health`, `/ping`, `/status`, or first GET with no required params). Editable from the connector detail page. Test response now classifies the result as `ok` / `auth_failed` (401–403) / `not_found` (404 + hint) / `unreachable` (DNS/SSRF/timeout) / `error`. UI banners coloured by kind.
• DTO @ApiProperty + MCP arguments alias (#5 + #4) #162 — All public-API DTOs decorated with `@ApiProperty`. `/api/docs-json` now exposes proper schemas for everything (CreateConnectorDto, LoginDto, ImportToolsDto, …). Tool test endpoint accepts MCP-standard `{ arguments: {...} }` alongside legacy `{ params: {...} }`.

Security / on-prem

• Persistent SSRF allowlist + admin UI + test fix hint (#2) #166 — SSRF allowlist editable from `/admin/settings#ssrf` (global, ADMIN-only). DB-backed list merges with `SSRF_ALLOWED_HOSTS` env var. Failing connector tests due to SSRF carry a `suggestedFix` link straight to the allowlist page.

DB migrations (both additive, nullable, no backfill)

• `connectors.healthcheck_path`
• `mcp_tools.operation_id`, `mcp_tools.deprecated_at`

---

Update with docker compose pull && docker compose up -d (self-hosted) or wait for the Cloud rollout (~24h after this comment).
⭐ Star · 👀 Watch → Releases · 💡 Vote on the next adapter

[github-actions[bot]]

🚀 v0.1.25 — Sorare adapter, LOGIN_TOKEN auth, GraphQL schema-slicing for every connector is out

Published 2026-05-18 — see the full release notes.

First release that ships a full GraphQL story end-to-end. The Sorare Fantasy Football adapter lands, the new `LOGIN_TOKEN` AuthType lets adapters describe any bcrypt-style sign-in handshake declaratively, and every GraphQL connector — catalog or user-created — now gets a server-side schema-slicing proxy baked in so agents can drive APIs whose introspection is disabled or whose SDL is too large for the context window.

New: Sorare Fantasy Football adapter (18 tools)

Built-in adapter for Sorare's GraphQL API. Bcrypt-salted login, JWT cached for ~30 days, automatic re-issue 24 h before expiry and on any 401. Featured on the homepage with `priority: 100`.

Tools (live-audited against api.sorare.com with real credentials, 17/19 happy-path pass, the two remaining are deliberate NOT_FOUND probes against fake IDs):

• Identity & wallet: `sorare_current_user`, `sorare_wallet_balance`, `sorare_my_trophies_summary`, `sorare_user_by_slug`
• Cards & inventory: `sorare_list_my_cards`, `sorare_get_card_by_slug`, `sorare_list_player_cards`
• Players & form: `sorare_search_player`, `sorare_player_recent_scores`, `sorare_player_floor_price`
• Market & auctions: `sorare_live_sale_offers`, `sorare_token_prices`, `sorare_get_auction`, `sorare_get_lineup`
• Generic GraphQL escape hatch (auto-injected for every GraphQL connector): `sorare_graphql_schema_url`, `sorare_graphql_schema`, `sorare_graphql_query`, `sorare_graphql_mutation`, `sorare_graphql_subscription`

Five multilingual MDX guides for the marketing site (en/de/it × ChatGPT/Claude/OpenClaw/generic MCP) plus five SEO-targeted Markdown guides under `docs/guides/` so GitHub Search surfaces `sorare-to-mcp`, `connect-sorare-to-claude`, `connect-sorare-to-chatgpt`, `connect-sorare-to-openclaw`, `connect-sorare-to-cloud`.

New: `LOGIN_TOKEN` AuthType

A declarative spec for APIs that POST credentials → receive a long-lived bearer, optionally with client-side bcrypt against a salt fetched from the upstream. Adapter authors describe the entire flow in JSON; no per-provider code.

The shared `LoginTokenService` handles salt fetch → bcrypt → `signIn` → token cache (in-memory + AES-256-GCM-encrypted DB row in the new `connector_auth_cache` table) → proactive refresh ≥ 24 h before expiry → forced re-login on 401, all behind a per-key mutex.

Wired into both the REST and GraphQL engines (`injectAuth` + 401-retry path). Field-by-field reference: `docs/connectors/login-token-auth.md`.

New: GraphQL schema-slicing proxy — every GraphQL connector, automatically

---

Update with docker compose pull && docker compose up -d (self-hosted) or wait for the Cloud rollout (~24h after this comment).
⭐ Star · 👀 Watch → Releases · 💡 Vote on the next adapter

[github-actions[bot]]

🚀 v0.1.26 — License activation handoff is out

Published 2026-05-19 — see the full release notes.

Highlights

End-to-end license auto-activation between the cloud instance and anythingmcp.com/pricing:

• Activate License Key field is now always visible on /settings/license for admins — including during an active cloud trial. Previously hidden until the trial expired, which surprised customers who purchased a license mid-trial.
• Upgrade Plan / View Plans links carry a return_url pointing back to the originating cloud instance, driven by NEXT_PUBLIC_MARKETING_URL (default https://anythingmcp.com).
• New /settings/license/activate callback page: reads ?key=AMCP-..., validates the format, calls PUT /api/license/key if an admin is signed in, otherwise bounces through /login?redirect=... and resumes activation after sign-in.
• Companion change on the marketing site (anythingmcp-website#57): after a successful Stripe checkout, the marketing site redirects the customer back to ${return_url}?key=<licenseKey> (host allowlisted to prevent open-redirects), turning the email-and-paste loop into a one-click handoff.

Companion PRs

• anythingmcp#216 — cloud frontend
• anythingmcp-website#57 — marketing site
• anythingmcp#217 — version bump

---

Update with docker compose pull && docker compose up -d (self-hosted) or wait for the Cloud rollout (~24h after this comment).
⭐ Star · 👀 Watch → Releases · 💡 Vote on the next adapter

[github-actions[bot]]

🚀 v0.1.27 — Tenant-scoped license lookup is out

Published 2026-05-19 — see the full release notes.

Highlights

Security/billing fix: cross-tenant license entitlement leak in cloud mode.

Pre-fix, an org with zero licenses could see another org's key as "License verified successfully" because getCurrentLicense fell back to a single instance-wide pointer (site_settings.license_key), and the unscoped POST /api/license/verify read from the same place. After this release, every license lookup in cloud mode is scoped to the calling organizationId.

• getCurrentLicense: in cloud, returns null when the calling org has no license. No global pointer fallback, no auto-binding of orphan licenses.
• verifyLicense: scoped to organizationId in cloud.
• setLicenseKey / requestTrialLicense: stop writing the global pointer in cloud; persist organizationId on the trial record.
• verifyOnStartup: no-op in cloud.

Self-hosted single-tenant behavior is unchanged — the site_settings.license_key mechanism still works for self-hosted installs.

Companion PR

• anythingmcp#219 — the fix + 6 unit tests
• anythingmcp#220 — version bump

---

Update with docker compose pull && docker compose up -d (self-hosted) or wait for the Cloud rollout (~24h after this comment).
⭐ Star · 👀 Watch → Releases · 💡 Vote on the next adapter

[github-actions[bot]]

🚀 v0.1.28 — LicenseWall covers cloud no-license + MCP runtime check is org-scoped is out

Published 2026-05-19 — see the full release notes.

Follow-ups to v0.1.27 — see #221. LicenseWall now blocks the cloud UI when an org has no license (was silently allowed through after the per-org isolation fix). dynamic-mcp-tools now passes organizationId through to checkLicenseActive so MCP tool calls work in cloud.

---

Update with docker compose pull && docker compose up -d (self-hosted) or wait for the Cloud rollout (~24h after this comment).
⭐ Star · 👀 Watch → Releases · 💡 Vote on the next adapter

[github-actions[bot]]

🚀 API Auth Update is out

Published 2026-05-20 — see the full release notes.

What's Changed

• Fix Copy button on http by @D3nisty in Fix Copy button on http #223
• docs(sorare): embed launch video on the 3 announcement landings (DSGVO 2-click) by @keysersoft in docs(sorare): embed launch video on the 3 announcement landings (DSGVO 2-click) #224
• docs(sorare): YouTube video embed on every Sorare guide (DSGVO 2-click) by @keysersoft in docs(sorare): YouTube video embed on every Sorare guide (DSGVO 2-click) #226
• auth: mandatory email verification in cloud mode by @keysersoft in auth: mandatory email verification in cloud mode #227
• feat(settings): redesign organization settings page by @mirkopoloni in feat(settings): redesign organization settings page #229
• fix(css): add custom chevron arrow for select elements and adjust pad… by @ozer0602 in fix(css): add custom chevron arrow for select elements and adjust pad… #228
• whatsapp-business: add WhatsApp Business Cloud API connector + multilingual guides by @keysersoft in whatsapp-business: add WhatsApp Business Cloud API connector + multilingual guides #230
• connectors: add WordPress + WooCommerce adapters by @keysersoft in connectors: add WordPress + WooCommerce adapters #231
• connector-batch-1: foundation + 81 new SaaS connectors (in progress) by @keysersoft in connector-batch-1: foundation + 81 new SaaS connectors (in progress) #232
• fix(docker): copy scripts/regenerate-catalog.mjs into backend builder by @keysersoft in fix(docker): copy scripts/regenerate-catalog.mjs into backend builder #233
• connectors: batch 2a — 15 greenfield SaaS adapters (data, monitoring, time-tracking, social, support) by @keysersoft in connectors: batch 2a — 15 greenfield SaaS adapters (data, monitoring, time-tracking, social, support) #236
• connectors: batch 2b — 33 more greenfield SaaS adapters + engine fixes (catalog 134→167) by @keysersoft in connectors: batch 2b — 33 more greenfield SaaS adapters + engine fixes (catalog 134→167) #237
• connectors: enforce VIEWER role restriction on connector/tool creation by @keysersoft in connectors: enforce VIEWER role restriction on connector/tool creation #238

New Contributors

• @D3nisty made their first contribution in Fix Copy button on http #223
• @mirkopoloni made their first contribution in feat(settings): redesign organization settings page #229
• @ozer0602 made their first contribution in fix(css): add custom chevron arrow for select elements and adjust pad… #228

Full Changelog: v0.1.28...v0.1.29

---

Update with docker compose pull && docker compose up -d (self-hosted) or wait for the Cloud rollout (~24h after this comment).
⭐ Star · 👀 Watch → Releases · 💡 Vote on the next adapter

[github-actions[bot]]

🚀 v0.1.30 — DATEV + SAP + Playtomic + GA4 (9 PRs) is out

Published 2026-05-23 — see the full release notes.

What's Changed

• Fix/dropdown option placement on touch by @ozer0602 in Fix/dropdown option placement on touch #235
• license: soft-warn cap policy + /usage endpoint + UsageBanner by @keysersoft in license: soft-warn cap policy + /usage endpoint + UsageBanner #239
• Update README to remove 'Fork' instruction by @CatWotan in Update README to remove 'Fork' instruction #240
• connectors: render brand logos in the installed-connector list by @keysersoft in connectors: render brand logos in the installed-connector list #241
• store: align Adapter Store cards with the marketing-site Marketplace by @keysersoft in store: align Adapter Store cards with the marketing-site Marketplace #242
• connectors: add google-analytics-4 (Admin + Data + Realtime + Funnel) by @keysersoft in connectors: add google-analytics-4 (Admin + Data + Realtime + Funnel) #243
• adapters: SAP Concur + Business One + S/4HANA Cloud + 2 engine extensions by @keysersoft in adapters: SAP Concur + Business One + S/4HANA Cloud + 2 engine extensions #245
• store: instructions panel + reveal-toggle in install modal + GA4 logo by @keysersoft in store: instructions panel + reveal-toggle in install modal + GA4 logo #244
• Playtomic: padel/tennis/futsal court search via MCP (full + public connectors + 15 SEO guides) by @keysersoft in Playtomic: padel/tennis/futsal court search via MCP (full + public connectors + 15 SEO guides) #246
• datev: rewrite adapter against official OpenAPI specs by @keysersoft in datev: rewrite adapter against official OpenAPI specs #247
• Bump version to 0.1.30 by @keysersoft in Bump version to 0.1.30 #248

New Contributors

• @CatWotan made their first contribution in Update README to remove 'Fork' instruction #240

Full Changelog: v0.1.29...v0.1.30

---

Update with docker compose pull && docker compose up -d (self-hosted) or wait for the Cloud rollout (~24h after this comment).
⭐ Star · 👀 Watch → Releases · 💡 Vote on the next adapter