mcp-anything

One MCP server that can discover and call (almost) any MCP server in the world.

mcp-anythingis ameta-MCP server: instead of configuring dozens of MCP servers in your host (Claude Desktop, Claude Code, Cursor, ...), you configure exactly one. It indexes theofficial MCP registrylocally and exposes five smallmeta-toolsthat let the model search for servers, inspect them, and call their tools on the fly — without ever loading thousands of tool schemas into the context window.

Host / LLM │ (5 meta-tools, constant context cost) ▼ mcp-anything ──── local BM25 index ◄──┬── official MCP registry (moderated, richest metadata) │ (cross-source dedupe, ├── PulseMCP (~22k servers, stars & downloads) │ popularity-boosted ├── npm (~67k packages tagged mcp) │ ranking) └── Glama (~75k indexed servers) │ │ security policy: SSRF guard · stdio allowlist · secrets injection · timeouts ▼ downstream MCP servers (streamable-http / sse / stdio via npx·uvx)

# Run directly (Node >= 20): npx mcp-anything sync # first-time index download (~few seconds) npx mcp-anything serve # start the meta-MCP server on stdio

claude mcp add anything -- npx -y mcp-anything serve

{ "mcpServers": { "anything": { "command": "npx", "args": ["-y", "mcp-anything", "serve"] } } }

Then just ask your model things like"find an MCP server that can query Postgres and list its tools"— it will use the meta-tools by itself.

mcp-anything serve --http # streamable HTTP on :8080 (POST /mcp) mcp-anything serve --http --discovery-only # safe for public hosting: search/describe only

A public instance with execution enabled would be an open proxy —never host a full instance publicly. The Dockerfile defaults to discovery-only for exactly this reason. A hosted discovery instance lets any MCP client search the ecosystem; actually connecting and calling tools is what the local install is for.

mcp-anything sync # refresh the registry index mcp-anything search "weather" # search the index from your terminal mcp-anything serve # stdio MCP server (default command)

Connecting an LLM to arbitrary servers from a public registry is dangerous by default.mcp-anythingships with conservative defaults and makes every relaxation explicit:

- Remote servers(streamable-http / sse): allowed,butprivate/loopback/link-local addresses (including cloud metadata endpoints like169.254.169.254) and plainhttp:are blocked — an SSRF guard for registry entries that point into your network. Opt out withremote.allowPrivateNetwork(useful for local development only).
- Stdio servers(spawningnpx/uvxprocesses):disabled by default.Running a package from a public registry is arbitrary code execution on your machine. Enable it only with an explicit per-package allowlist.
- Secrets: API keys are never indexed or exposed to the model. You map them per server in your config; they are injected at connect time (headers for remote, env for stdio).
- Untrusted output: results and tool descriptions from downstream servers are labeled as third-party data so the model treats them as data, not instructions. Thisreducesprompt-injection risk; it does not eliminate it — seeSECURITY.md.
- Limits: connect/call timeouts, response-size truncation, bounded session pool.

{ "registryUrl": "https://registry.modelcontextprotocol.io", "sources": ["official"], "qualityFilter": true, "cacheTtlHours": 24, "maxServers": 10000, "policy": { "remote": { "enabled": true, "allowPrivateNetwork": false, "headers": { "io.github.example/github": { "Authorization": "Bearer ghp_..." } } }, "stdio": { "enabled": false, "allowPackages": ["@modelcontextprotocol/server-filesystem"], "env": { "io.github.example/postgres": { "DATABASE_URL": "postgres://..." } } }, "limits": { "callTimeoutMs": 60000, "connectTimeoutMs": 20000, "maxSessions": 8, "maxResultChars": 100000 } } }

Every field is optional; the defaults above (minus the example headers/env) are what you get with no config at all.registryUrlaccepts any registry implementing the official REST API — including a private/self-hosted one.

sourcescontrols how much of the ecosystem gets indexed:

{ "sources": ["official", "pulsemcp", "npm"] }

Entries appearing in several catalogs arededuplicatedby normalized repository URL and package identifier; the most-trusted source wins the identity, metadata is backfilled from the others, and stars/downloads accumulate. Ranking then combines BM25 relevance with a log-scaled popularity boost (and a bonus for official-registry entries), sosearch_mcp_serverssurfaces the maintained implementation of a capability rather than the hundredth abandoned clone.qualityFilter(default on) drops entries with no way to connect and no usable description — with wide sources,moreis only better if the junk stays out of the top-5. A failed source degrades gracefully: the sync keeps whatever the other sources returned and reports the failure.

- Lexical search, not embeddings.Fully local, zero API cost, no index build step — and for tool discovery, keyword search with fuzzy matching performs comparably in practice (Anthropic's Tool Search made the same call with BM25/regex).
- Sessions, not stateless calls.MCP is session-oriented (initialize handshake, capability negotiation). Downstream connections are pooled and reused across calls with LRU eviction.
- Graceful degradation.If the registry is unreachable, the last-synced cache keeps working.

This space is active:MetaMCPand other gateways aggregateservers you configure; Composio's Rube routes toits own curated catalog; hosts are growing native tool-search.mcp-anything's niche is the open combination:the public registry as the catalog, a local-first single binary, and an explicit security policy— no cloud account, no curation lock-in, self-hostable against a private registry.

npm install npm test # unit + end-to-end (mock registry + real downstream MCP server) npm run typecheck npm run build node scripts/smoke.mjs # spawns the built CLI as a real stdio MCP server

Intelligent Al routing and integration platform for seamless provider switching