mcp-anything

One MCP server that can discover and call (almost) any MCP server in the world.

mcp-anything is a meta-MCP server: instead of configuring dozens of MCP servers in your host (Claude Desktop, Claude Code, Cursor, ...), you configure exactly one. It indexes the official MCP registry locally and exposes five small meta-tools that let the model search for servers, inspect them, and call their tools on the fly — without ever loading thousands of tool schemas into the context window.

Host / LLM
    │  (5 meta-tools, constant context cost)
    ▼
mcp-anything ──── local BM25 index ◄──┬── official MCP registry   (moderated, richest metadata)
    │        (cross-source dedupe,    ├── PulseMCP    (~22k servers, stars & downloads)
    │         popularity-boosted      ├── npm         (~67k packages tagged mcp)
    │         ranking)                └── Glama       (~75k indexed servers)
    │
    │  security policy: SSRF guard · stdio allowlist · secrets injection · timeouts
    ▼
downstream MCP servers   (streamable-http / sse / stdio via npx·uvx)

Why

• Discovery: thousands of MCP servers exist; your host only knows the ones you hand-configured.
• Context: loading many servers burns your context window. Meta-tools keep the cost constant — the model searches for capabilities in two phases (search → inspect → call), the same pattern Anthropic's Tool Search uses.
• One config: a single entry in your MCP client config instead of one per server.

Quickstart

# Run directly (Node >= 20):
npx mcp-anything sync     # first-time index download (~few seconds)
npx mcp-anything serve    # start the meta-MCP server on stdio

Claude Code

claude mcp add anything -- npx -y mcp-anything serve

Claude Desktop / other hosts

{
  "mcpServers": {
    "anything": {
      "command": "npx",
      "args": ["-y", "mcp-anything", "serve"]
    }
  }
}

Then just ask your model things like "find an MCP server that can query Postgres and list its tools" — it will use the meta-tools by itself.

HTTP mode & hosted discovery

mcp-anything serve --http                    # streamable HTTP on :8080 (POST /mcp)
mcp-anything serve --http --discovery-only   # safe for public hosting: search/describe only

A public instance with execution enabled would be an open proxy — never host a full instance publicly. The Dockerfile defaults to discovery-only for exactly this reason. A hosted discovery instance lets any MCP client search the ecosystem; actually connecting and calling tools is what the local install is for.

CLI

mcp-anything sync             # refresh the registry index
mcp-anything search "weather" # search the index from your terminal
mcp-anything serve            # stdio MCP server (default command)

The meta-tools

Security model

Connecting an LLM to arbitrary servers from a public registry is dangerous by default. mcp-anything ships with conservative defaults and makes every relaxation explicit:

• Remote servers (streamable-http / sse): allowed, but private/loopback/link-local addresses (including cloud metadata endpoints like 169.254.169.254) and plain http: are blocked — an SSRF guard for registry entries that point into your network. Opt out with remote.allowPrivateNetwork (useful for local development only).
• Stdio servers (spawning npx / uvx processes): disabled by default. Running a package from a public registry is arbitrary code execution on your machine. Enable it only with an explicit per-package allowlist.
• Secrets: API keys are never indexed or exposed to the model. You map them per server in your config; they are injected at connect time (headers for remote, env for stdio).
• Untrusted output: results and tool descriptions from downstream servers are labeled as third-party data so the model treats them as data, not instructions. This reduces prompt-injection risk; it does not eliminate it — see SECURITY.md.
• Limits: connect/call timeouts, response-size truncation, bounded session pool.

Configuration

~/.config/mcp-anything/config.json (or --config <path>, or MCP_ANYTHING_CONFIG):

{
  "registryUrl": "https://registry.modelcontextprotocol.io",
  "sources": ["official"],
  "qualityFilter": true,
  "cacheTtlHours": 24,
  "maxServers": 10000,
  "policy": {
    "remote": {
      "enabled": true,
      "allowPrivateNetwork": false,
      "headers": {
        "io.github.example/github": { "Authorization": "Bearer ghp_..." }
      }
    },
    "stdio": {
      "enabled": false,
      "allowPackages": ["@modelcontextprotocol/server-filesystem"],
      "env": {
        "io.github.example/postgres": { "DATABASE_URL": "postgres://..." }
      }
    },
    "limits": {
      "callTimeoutMs": 60000,
      "connectTimeoutMs": 20000,
      "maxSessions": 8,
      "maxResultChars": 100000
    }
  }
}

Every field is optional; the defaults above (minus the example headers/env) are what you get with no config at all. registryUrl accepts any registry implementing the official REST API — including a private/self-hosted one.

Index sources — going wide

sources controls how much of the ecosystem gets indexed:

{ "sources": ["official", "pulsemcp", "npm"] }

Entries appearing in several catalogs are deduplicated by normalized repository URL and package identifier; the most-trusted source wins the identity, metadata is backfilled from the others, and stars/downloads accumulate. Ranking then combines BM25 relevance with a log-scaled popularity boost (and a bonus for official-registry entries), so search_mcp_servers surfaces the maintained implementation of a capability rather than the hundredth abandoned clone. qualityFilter (default on) drops entries with no way to connect and no usable description — with wide sources, more is only better if the junk stays out of the top-5. A failed source degrades gracefully: the sync keeps whatever the other sources returned and reports the failure.

Design notes

• Lexical search, not embeddings. Fully local, zero API cost, no index build step — and for tool discovery, keyword search with fuzzy matching performs comparably in practice (Anthropic's Tool Search made the same call with BM25/regex).
• Sessions, not stateless calls. MCP is session-oriented (initialize handshake, capability negotiation). Downstream connections are pooled and reused across calls with LRU eviction.
• Graceful degradation. If the registry is unreachable, the last-synced cache keeps working.

Prior art & positioning

This space is active: MetaMCP and other gateways aggregate servers you configure; Composio's Rube routes to its own curated catalog; hosts are growing native tool-search. mcp-anything's niche is the open combination: the public registry as the catalog, a local-first single binary, and an explicit security policy — no cloud account, no curation lock-in, self-hostable against a private registry.

Roadmap

• Live health checks and result-quality signals in ranking
• Per-tool (not just per-server) search by indexing tools/list of popular servers
• OAuth flow passthrough for remote servers that require it
• Container/Wasm sandboxing for stdio servers as an alternative to allowlisting
• Multiple registries with federation and dedupe
• Optional streamable-http serving mode (for shared/team deployment)

Development

npm install
npm test              # unit + end-to-end (mock registry + real downstream MCP server)
npm run typecheck
npm run build
node scripts/smoke.mjs  # spawns the built CLI as a real stdio MCP server

See CONTRIBUTING.md. Licensed MIT.