Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

MCP server · Org-owned · Audited from source

Anytype MCP Server

by anyproto/anytype-mcpMIT licenceAudited 26 Oct 2026 · source a6c9639773d3

npm @anyproto/anytype-mcp 2.0.1stdio★ 536
✓SAFEGrade B · 89/100 · 26 Oct 2026 · a6c9639
536GitHub stars
InstallView source on GitHub ↗

Is it safe? Yes — SAFE, grade B (89/100). It exposes 4 tools: 3 read, 1 write and 0 destructive. The audit recorded 13 findings (0 critical, 0 high, 1 medium, 12 low). Maintainer's description: An MCP server enabling AI assistants to interact with Anytype - your encrypted, local and collaborative wiki - to organize objects, lists, and more through natural language.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Anytype MCP Server (anyproto/anytype-mcp)”. Retrieved 26 Oct 2026. https://modelsatlas.com/mcp/anyproto/anytype-mcp

Trust audit

Audit 0.4.1 · full source read 26 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high1 medium12 low0 info

13 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemNone observedNothing seen in the source
  • NetworkNone observedNothing seen in the source
  • ShellNone observedNothing seen in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

LayerWhat we checkResult
L0 ProvenanceRepo owner, licence, archive status, activityPASS
L1 Static sourceSecrets, path traversal, supply chainWARN 13 findings
L2 InstructionsPrompt injection and authority framing in docs and tool descriptionsPASS
L3 InventoryDeclared tools match the sourcePASS
L4 SandboxRun in isolation and watch behaviourSKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

  • Repository owner anyprotoOrganizationAccount type recorded when we read the repository.
  • PackagePublished on npm@anyproto/anytype-mcp at version 2.0.1
  • LicenceMITFrom the repository, as read at the audited commit.
  • Last pushTodayActivity of the repository when we read it.
  • Source commit reada6c9639773d3The audit covers exactly this commit, read on 26 Oct 2026.

Runtime

  • Sandbox runNot run yetThis audit read the source only; it did not execute the server.
  • Tool inventory4 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (13)

Sorted by severity

MEDIUMInformation disclosuredisclose.log_secret · src/auth/get-key.ts:28
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`\nYour API KEY: ${apiKey}`);
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · scripts/__tests__/parse-openapi.test.ts:3
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { OpenAPIToMCPConverter } from "../../src/openapi/parser";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · scripts/__tests__/start-server.test.ts:5
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { loadOpenApiSpec, ValidationError } from "../../src/init-server";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · scripts/__tests__/start-server.test.ts:304
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
vi.doMock("../../src/init-server", () => ({
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · scripts/__tests__/start-server.test.ts:325
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
vi.doMock("../../src/init-server", () => ({
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · src/client/__tests__/download-file.test.ts:9
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { OpenAPIToMCPConverter } from "../../openapi/parser";
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:100
F-04 Network egressCWE-200 · CWE-319Layer L1
By default, the server connects to `http://127.0.0.1:31009`. For `anytype-cli` (port `31012`) or other custom base URLs, set `ANYTYPE_API_BASE_URL`:
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:151
F-04 Network egressCWE-200 · CWE-319Layer L1
"args": ["-y", "@anyproto/anytype-mcp", "run", "http://127.0.0.1:31009/v1/docs/openapi.json"]
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · scripts/__tests__/start-server.test.ts:81
F-04 Network egressCWE-200 · CWE-319Layer L1
expect(axios.get).toHaveBeenCalledExactlyOnceWith("http://127.0.0.1:31009/v2/docs/openapi.json");
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · scripts/__tests__/start-server.test.ts:95
F-04 Network egressCWE-200 · CWE-319Layer L1
["http://127.0.0.1:31009/v2/docs/openapi.json"],
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · scripts/__tests__/start-server.test.ts:96
F-04 Network egressCWE-200 · CWE-319Layer L1
["http://127.0.0.1:31009/docs/openapi.json"],
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.base64_blob · README.md:4
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
<a href="https://cursor.com/en-US/install-mcp?name=anytype&config=eyJlbnYiOnsiT1BFTkFQSV9NQ1BfSEVBREVSUyI6IntcIkF1dGhvcml6YXRpb25cIjpcIkJlYXJlciA8WU9VUl9BUElfS0VZPlwiLCBcIkFueXR5cGUtVmVyc2lvblwiOlwiMj
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.base64_blob · README.md:5
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
<a href="https://lmstudio.ai/install-mcp?name=anytype&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBhbnlwcm90by9hbnl0eXBlLW1jcCJdLCJlbnYiOnsiT1BFTkFQSV9NQ1BfSEVBREVSUyI6IntcIkF1dGhvcml6YXRpb25cIjp
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

4 declared in source · 0 destructive

3 read1 write0 destructive
ToolRiskWhat it does
createABwriteCreate an A-B object. A schema description
GardenreadVegetables
getABreadGet an A-B object
getComposedreadGet a composed resource

Install

Package version 2.0.1 · audited commit a6c9639

Add to CursorAdd to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 2.0.1. The audit covers commit a6c9639 only.

claude mcp add anytype-mcp -- npx -y @anyproto/[email protected]

The command pins the package version recorded in the source (2.0.1); the audit covers commit a6c9639773d3. Transport: stdio. No environment variables required.

Audit history

  1. ✓SAFE B 89 / 100

    First audit · a6c9639773d3

README badge

For maintainers · updates on every re-audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B 
[![ModelsAtlas: SAFE B](https://modelsatlas.com/mcp/anyproto/anytype-mcp/badge.svg)](https://modelsatlas.com/mcp/anyproto/anytype-mcp/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Anytype MCP Server

What is the Anytype MCP Server MCP server?
An MCP server enabling AI assistants to interact with Anytype - your encrypted, local and collaborative wiki - to organize objects, lists, and more through natural language.
What tools does Anytype MCP Server expose?
4 in total: 3 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Anytype MCP Server safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Anytype MCP Server need?
No credential environment variables were found in its source, so it appears to need none.
How does Anytype MCP Server run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @anyproto/anytype-mcp at 2.0.1.
How current is this page?
The grade is for one exact copy of the source (a6c9639773d3), read on 2026-10-26. The repository is watched and re-audited when it changes.

Sources

  • anyproto/anytype-mcp on GitHub — the source we read, its licence, stars and activityObserved · 26 Oct 2026
  • ModelsAtlas trust audit — SAFE verdict for commit a6c9639773d3Observed · 26 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.