AnythingMCP

v0.1.33 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 1mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-agents api-gateway chatgpt chatgpt-apps claude claude-connectors

+14 more

database-mcp-server gemini graphql-to-mcp mcp mcp-gateway mcp-servers model-context-protocol no-code openapi-to-mcp rest-to-mcp self-hosted soap-to-mcp sql-to-mcp typescript

Affected surfaces

auth

Summary

AI summary

Fixes a production 403 lockout that denied legitimate owners access to their MCP servers after OAuth login.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Low	Adds membership‑based tenant isolation for `/mcp/:serverId`, allowing multi‑org users to access all their workspaces while denying cross‑org access (#311) Adds membership‑based tenant isolation for `/mcp/:serverId`, allowing multi‑org users to access all their workspaces while denying cross‑org access (#311) Source: llm_adapter@2026-06-10 Confidence: high	—
Feature	Low	Adds eight new read‑only reverse‑engineered connectors: Playtomic, OpenTable, Resy, Vinted, Untappd, Idealista, Trenitalia (#unspecified) Adds eight new read‑only reverse‑engineered connectors: Playtomic, OpenTable, Resy, Vinted, Untappd, Idealista, Trenitalia (#unspecified) Source: llm_adapter@2026-06-10 Confidence: high	—
Feature	Low	Migrates Etsy connector to OAuth2 with automatic refresh‑token rotation (#unspecified) Migrates Etsy connector to OAuth2 with automatic refresh‑token rotation (#unspecified) Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix
Bugfix	Medium	Corrects Claude Desktop connection config to use `type: "http"` instead of invalid `url` (#310) Corrects Claude Desktop connection config to use `type: "http"` instead of invalid `url` (#310) Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Medium	Resolves weclapp filter 400 errors using a general `__rawquery` passthrough engine (#308) Resolves weclapp filter 400 errors using a general `__rawquery` passthrough engine (#308) Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Medium	Fixes OAuth org resolution, preventing 403 lockouts for legitimate owners (#309) Fixes OAuth org resolution, preventing 403 lockouts for legitimate owners (#309) Source: llm_adapter@2026-06-10 Confidence: low	—

Full changelog

Fixes

auth: membership-based tenant isolation for /mcp/:serverId — multi-org users can reach every workspace they belong to; cross-org access stays denied (#311)
auth: resolve OAuth org by id OR email — fixes a production 403 lockout where legitimate owners were denied their own MCP servers after OAuth login (#309)
dashboard: Claude Desktop connection config now uses type: "http" (was the invalid "url", which Claude Desktop silently skipped) (#310)
weclapp: fix filter 400s via a general __rawquery engine passthrough — weclapp property-operator filters now work (#308)

Connectors

8 reverse-engineered read-only connectors live: Playtomic (+ public), OpenTable, Resy, Vinted, Untappd, Idealista, Trenitalia
Etsy migrated to OAuth2 with automatic refresh-token rotation

Notes

No breaking changes. Tenant isolation remains fail-closed and was verified against production data.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track AnythingMCP

Get notified when new releases ship.

About AnythingMCP

All releases →