anythingmcp - Moses Yebei

Abstract

#1 MCP Gateway on GitHub 🔌 188 ready connectors + any REST/SOAP/GraphQL/SQL system as custom connectors for Claude, ChatGPT and Copilot. Self-hosted, no-code, open source (AGPL-3.0). Learns how your systems connect. SSO and governance

The Problem

Companies run many legacy REST, SOAP, GraphQL or SQL services that have no native AI interface. Exposing those services to LLMs normally requires custom middleware, costly engineering, and often a separate “MCP server” that sits between the LLM and the data source.

What This Does

AnythingMCP is a self‑hosted gateway that turns any exposeable service into a connector for Claude, ChatGPT or Copilot. It ships 190 ready‑made adapter definitions (e.g. DHL, Datev, Weclapp) plus a plug‑in for arbitrary OpenAPI, Postman, WSDL, GraphQL or SQL endpoints.

The gateway is a NestJS/Express backend (packages/backend/src/main.ts) that exposes a RESTful API. The front‑end is a Next.js app (packages/frontend/src/components/tool-editor/index.tsx) that lets you upload or edit an adapter JSON, configure credentials, and bind it to a workspace. Credentials are stored AES‑256‑GCM‑encrypted; audit logs keep the raw upstream response on the host.

How It Is Wired

Entry point – packages/backend/src/main.ts calls NestFactory.create(AppModule) and starts the HTTP server on ${process.env.PORT}.
AppModule imports ConnectorModule, AuthModule, AuditModule.
ConnectorModule loads adapters from packages/backend/src/connectors and registers them in ConnectorService.
ConnectorService exposes invoke(name, params) which resolves the adapter, injects credentials via SecretsUtil (packages/backend/src/common/secrets.util.ts), and forwards the request to the target endpoint.
SecretsUtil decrypts stored secrets; its presence is flagged by the static audit as a Low/Security issue because the pattern matches potential secret leakage.
AuditModule writes the upstream response to a local log file; the log is only written once per invocation, so the blast radius is confined to the service’s own filesystem.
Front‑end (tool‑editor/index.tsx) posts the adapter JSON to /api/adapters which hits the same ConnectorService for persistence.
Docker (Dockerfile, docker-compose.quickstart.yml) builds a single image that contains the compiled TS (dist/) and starts the NestJS server. The quickstart script pulls the image, generates a .env with JWT_SECRET and ENCRYPTION_KEY, and spins up the stack with docker compose.

How To Use It

Setup ``bash mkdir anythingmcp && cd anythingmcp curl -fsSLo docker-compose.yml \ https://raw.githubusercontent.com/moses-y/anythingmcp/main/docker-compose.quickstart.yml printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env docker compose up -d ` The command uses the provided docker-compose.quickstart.yml and the Dockerfile` in the repo root.

Configuration - .env must contain JWT_SECRET, ENCRYPTION_KEY, and database URLs (e.g. POSTGRES_URL). - Adapter credentials are supplied via the front‑end; they are stored in the table connector_secrets encrypted by SecretsUtil.

Running After the containers are up, the gateway is reachable at http://localhost:3000. The LLM receives an MCP URL such as https://localhost:3000/mcp/fieldservice.

Real‑World Use

A field‑service company exposes a REST API that lists technicians’ visits. A user asks Claude: “Which companies did Technician X visit last week?” Claude calls the MCP URL, the gateway forwards the request to the REST endpoint, returns only the mapped fields (companyName, visitDate), and logs the raw response for compliance.

Code Health & Issues

Low/Security – 1 path with potential secret leakage: packages/backend/src/common/secrets.util.ts.
No other critical issues detected by the static audit.
The repo has a full CI pipeline (.github/workflows/ci.yml) and end‑to‑end tests (tests/).
Licensing is AGPL‑3.0, so any derivative must also be AGPL‑licensed.

The Bottom Line

AnythingMCP delivers a ready‑to‑run MCP gateway with minimal configuration. It is ideal for internal teams that need to expose legacy systems to LLMs without building custom middleware. The AGPL license and the need to run Docker locally may limit adoption in highly regulated or proprietary environments, but for open‑source or in‑house projects the value outweighs the trade‑offs.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

1,107 files

TypeScript442
JSON201
TSX64
SQL48
Markdown45
YAML28

ReactNext.jsExpressNestJSDocker

Module dependencies

The 10 most depended-upon modules of 519, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_nd_src_common_prisma_service["prisma.service"] n1_engines_oauth2_token_service["oauth2-token.service"] n2_nnectors_engines_rest_engine["rest.engine"] n3__engines_login_token_service["login-token.service"] n4_audit_security_event_service["security-event.service"] n5_backend_src_common_ssrf_util["ssrf.util"] n6_rc_common_deployment_service["deployment.service"] n7_ackend_src_auth_auth_service["auth.service"] n8_backend_src_adapters_catalog["catalog"] n9_ommon_crypto_encryption_util["encryption.util"] n4_audit_security_event_service --> n0_nd_src_common_prisma_service n3__engines_login_token_service --> n0_nd_src_common_prisma_service n3__engines_login_token_service --> n9_ommon_crypto_encryption_util n3__engines_login_token_service --> n5_backend_src_common_ssrf_util n1_engines_oauth2_token_service --> n0_nd_src_common_prisma_service n1_engines_oauth2_token_service --> n9_ommon_crypto_encryption_util n1_engines_oauth2_token_service --> n5_backend_src_common_ssrf_util n2_nnectors_engines_rest_engine --> n1_engines_oauth2_token_service n2_nnectors_engines_rest_engine --> n3__engines_login_token_service n2_nnectors_engines_rest_engine --> n5_backend_src_common_ssrf_util

Dependencies

16 of 114 declared dependencies are a major version behind. Resolved 114 of 114 against the registry.

Package	Declared	Latest	Behind
`@types/node`	^22.20.2	26.2.0	4 major
`https-proxy-agent`	^7.0.6	9.1.0	2 major
`@types/better-sqlite3`	^7.6.13	9.6.0	2 major
`typescript`	^5.7.3	7.0.2	2 major
`concurrently`	^9.2.4	10.0.5	1 major
`@nestjs/microservices`	^11.2.3	12.0.3	1 major
`@nestjs/terminus`	^11.0.0	12.0.0	1 major
`better-sqlite3`	^12.11.1	13.0.3	1 major

Findings

LowSecret-shaped paths present; the code-health audit confirms or clears them packages/backend/src/common/secrets.util.ts

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium4

low1

Pin third-party GitHub Actions to a commit SHAhigh7 occurrences

.github/workflows

appleboy/scp-action@v1.0.0, appleboy/ssh-action@v1, docker/setup-buildx-action@v4, docker/login-action@v4

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/ci.yml

2 workflow(s) declare no permissions, 1 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Pin the container base image by digestmedium5 occurrences

Dockerfile

node:${NODE_VERSION}, node:${NODE_VERSION}, node:${NODE_VERSION}

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/ci.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/ci.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.