How to Configure AnythingMCP for Read-Only Access
Connect AI to company software without handing it the delete button.
AnythingMCP is an open-source MCP gateway from helpcode.ai in Freiburg, Germany. The current repository contains 257 adapters and supports REST, SOAP, GraphQL, databases, and existing MCP servers. It can let an AI client retrieve approved information from connected systems, but it does not magically connect every app or make AI safe by default. Start with one non-sensitive connector, dedicated read-only credentials, a role that exposes only approved lookup tools, response filtering, and audit-log review. Keep price changes, refunds, payments, publishing, sending, and deletion disabled until each action has been reviewed and placed behind human approval. This guide includes the setup commands, the three-level access rule, a ten-test launch checklist, and copyable prompts for daily founder reporting.
Most founders still use AI as a very intelligent tab.
They open ChatGPT or Claude, copy a number from the store, paste it into the chat, open the shipping dashboard, copy another number, then repeat the process for accounting, inventory, customer support, and analytics. The model can analyse what it receives, but a human remains responsible for collecting every piece of context.
MCP changes that arrangement. In plain English, the Model Context Protocol gives an AI client a standard way to discover and call approved tools. The model remains the brain. The business systems still hold the data. An MCP gateway sits between them and decides which tools are available.
AnythingMCP is one open-source implementation of that gateway. It can turn APIs, databases, legacy SOAP services, and packaged adapters into tools that compatible AI clients can call.
The opportunity is obvious. The danger is easy to miss. A tool that reads today’s revenue is useful. A tool that can change every product price is a different class of access. The correct first goal is not maximum automation. It is useful visibility with minimum authority.
Why this exists
Connecting one AI assistant to one modern API is possible. Connecting the same assistant to an ERP, CRM, store, database, shipping provider, and old internal service is where the real work begins.
Each system has its own authentication, request format, field names, permissions, and response structure. A founder may want one simple answer — “Which orders are delayed?” — while the underlying workflow requires several different calls.
AnythingMCP exists as the translation and governance layer. It exposes approved systems as MCP tools, stores credentials, records tool calls, and lets an operator control which tools and response fields reach the AI client.
The gateway is not the model. Claude or ChatGPT reasons about the request. AnythingMCP exposes approved tools. Your source systems and credentials determine what those tools can actually read or change.
What AnythingMCP actually connects
The current repository’s own adapter-count script reports 257 packaged adapters, 20 keyless adapters, and 2,385 tools. The safe public description is “more than 250 adapters” because the catalogue continues to change.
The project supports five connector types:
- REST APIs through OpenAPI, Swagger, Postman, cURL, or manual configuration.
- SOAP and WSDL services used by older enterprise software.
- GraphQL endpoints.
- Databases including PostgreSQL, MySQL, MariaDB, Microsoft SQL Server, Oracle, MongoDB, and SQLite.
- Existing MCP servers that can be bridged into the same gateway.
Packaged examples include logistics, ERP, accounting, ecommerce, HR, public data, banking, payments, messaging, and mapping services. An adapter is a prepared definition, not proof that every account can connect immediately. The underlying vendor may still require an API plan, OAuth approval, credentials, scopes, or account-specific configuration.
What the founder can ask
Once the required systems and tools have been connected and approved, the useful early questions are read-only operational questions:
- “Show today’s sales and compare them with yesterday.”
- “Which products are below their reorder threshold?”
- “List shipments that are currently delayed.”
- “Show unpaid invoices older than thirty days.”
- “Which support issues have been waiting the longest?”
- “Summarise the five numbers I should check before the morning meeting.”
These are examples of workflows, not universal built-in buttons. Each one depends on the relevant connector exposing the required fields and on your role being allowed to call the corresponding tools.
The five-minute local version
The official quick start requires Docker 24 or newer and OpenSSL. It starts a local instance bound to the current machine:
mkdir anythingmcp && cd anythingmcp
curl -fsSLo docker-compose.yml \
https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -dOpen http://localhost:3000. The first account registered becomes the administrator. The local MCP endpoint is http://localhost:4000/mcp.
Back up the generated
.envin your approved secret-management system. The encryption key decrypts connector credentials. Never paste that file or its values into an AI conversation.
The rest of this playbook is below.
Enter your email to read it. You also get one new playbook every week.
One email a week. Unsubscribe any time.
A local installation is useful for evaluation, but ChatGPT connects from the cloud and therefore requires a publicly reachable HTTPS endpoint. ChatGPT setup also depends on account eligibility, workspace policy, and developer-mode availability. Follow OpenAI’s current MCP app instructions at https://developers.openai.com/api/docs/guides/developer-mode and use a supported authentication mode; do not assume that manually entering a gateway API key is supported. Secure production deployment also requires a domain, TLS, authentication, backups, monitoring, updates, and an operator. For production, pin the Compose file to a reviewed commit and the container image to a version or digest rather than mutable main and :latest. “No code to define a connector” does not mean “no technical work to deploy it securely.”
The three-level permission rule
| Level | Access | Examples | Founder rule |
|---|---|---|---|
| Level 1 | Read-only | Lookup sales, stock, invoices, shipments, or support queues | Start here with narrow tools and non-sensitive data |
| Level 2 | Draft or prepare | Prepare a plain-text reply, proposed order, price update, or refund recommendation | AI prepares plain text; saving a draft or changing another system remains a write action |
| Level 3 | Execute | Send, publish, pay, refund, change prices, modify records, or delete | Disable by default; add individually with explicit approval controls |
The three levels below are a recommended operating policy, not built-in AnythingMCP modes. AnythingMCP can label tools with MCP annotations such as readOnlyHint and destructiveHint, and its role system can expose only whitelisted tools. Treat annotations as useful labels, not as the strongest enforcement boundary. The source system should also use a dedicated account that physically lacks write permissions.
For databases, the project documentation recommends a dedicated read-only user, limited table grants, static queries where possible, audit logging, and a role that whitelists only specific tools.
The safe founder rollout
Step 1: Choose one boring question
Do not begin with “run my company.” Choose one question with a verifiable answer, such as delayed shipments or unpaid invoices.
Step 2: Use a test workspace
Connect sample or non-sensitive data first. Do not test against payment systems, HR records, production customer data, or live write credentials.
Step 3: Create a dedicated service account
Give the connector its own account and the smallest possible scope. For a database, use a user restricted to SELECT and only the required tables. Do not reuse an administrator credential.
Step 4: Expose only the required tools
Use a separate, non-administrator AnythingMCP identity for the AI connection. Assign only the intended lookup role and inspect every other role assigned to that identity, because role permissions combine and a narrow role does not cancel a broader one. Organization administrators have unrestricted tool access. Remove create, update, send, refund, payment, and delete tools. Test the exact credentials the AI client will use—not the setup administrator’s credentials.
Step 5: Filter the response
AnythingMCP supports per-tool response mapping. Keep only the fields the model needs. Remove bank details, tax identifiers, access tokens, internal notes, salaries, and other unnecessary personal or confidential fields before the response leaves your infrastructure.
When a configured response transformation errors, the default behavior can fall back to the raw response. Set "fallbackToRaw": false so that transformation error fails the call instead. This does not detect a missing transformation or a transformation that succeeds while leaving sensitive fields behind. Prefer an explicit allowlist of output fields, then test nested data, arrays, and upstream schema changes.
Step 6: Test the boundaries
Ask the AI to retrieve the permitted information. Then deliberately test a change, deletion, refund, or publishing request using the exact restricted credentials configured in the AI client. A model refusing the request is not proof of enforcement. The operator must verify that the gateway or source system denies the write server-side because the required tool or upstream permission is absent.
Step 7: Inspect the audit log
Confirm which tool was called, what inputs were sent, what came back, how long it took, and whether sensitive fields appeared. Remember that full upstream responses stored in audit logs can themselves contain sensitive data and require retention and access controls.
The ten-test gateway checklist
- Source test: Record the official repository, exact release or commit, and licence.
- Ownership test: Name the person responsible for deployment, keys, updates, and incident response.
- Credential test: Confirm the connector uses a dedicated least-privilege account.
- Tool test: List every tool the assigned role can call; reject “all tools” as the default.
- Write test: Verify that price changes, sending, publishing, refunds, payments, and deletion are unavailable.
- Data test: Record which response fields can leave the gateway and which model provider receives them.
- Failure test: Break a response mapping and confirm sensitive tools fail closed.
- Injection test: Put hostile instructions inside a test ticket, webpage, or record and confirm the agent does not gain extra authority.
- Audit test: Confirm logs record enough evidence for investigation without becoming an uncontrolled copy of sensitive data.
- Revocation test: Revoke the service account or MCP key and verify access stops.
If any answer is unknown, the connector is not ready for production company data.
Copyable prompts
These prompts assume that the relevant read-only tools have already been connected and approved.
Morning operating report
Use only the approved read-only company tools.
Prepare a morning operating report for [DATE] covering:
1. Sales compared with yesterday and the same weekday last week.
2. Products below their approved reorder threshold.
3. Shipments currently delayed.
4. Unpaid invoices older than 30 days.
5. Customer-support items waiting longer than 24 hours.
For every number, name the source system and the time retrieved.
Do not create, update, send, publish, refund, pay, or delete anything.
If a required tool or field is unavailable, say exactly what is missing.
End with three issues for a human to review.Invoice review
Retrieve unpaid invoices older than [NUMBER] days using read-only tools.
Group them by customer and show invoice number, issue date, due date,
amount, currency, and current status. Do not contact customers or change
any record. Flag missing or inconsistent information for human review.Inventory check
Use the approved inventory tools to identify products below the stored
reorder threshold. Show current quantity, threshold, recent sales rate if
available, and the source timestamp. Do not create purchase orders or
change stock levels. Prepare recommendations only.Shipment exception report
List shipments whose current status indicates a delay or exception.
Show order reference, carrier, last scan, expected date, and customer-impact
summary. Do not message the customer or modify the shipment. Clearly mark
any conclusion that is inferred rather than supplied by the carrier.The part most demos skip
MCP can expand what an AI is capable of doing. It does not guarantee that the AI will choose the correct tool, interpret the data correctly, resist hostile instructions, or avoid an expensive mistake.
AnythingMCP encrypts stored credentials, supports role-based tool access, records calls, and can remove response fields before they reach the model. Those are meaningful controls. They do not replace upstream least-privilege credentials, network security, backups, model-provider review, prompt-injection testing, or human approval.
Self-hosting also does not mean all data stays inside your network. When Claude, ChatGPT, or another hosted model uses a tool result, the approved response fields are sent to that model provider. Self-hosting lets you control the gateway, credentials, and filtering. It does not turn a cloud model into a local model.
Honest limits
- A packaged adapter is a definition, not a guarantee that the vendor API, account plan, credentials, or required scopes are available.
- Cloud AI clients require a reachable HTTPS deployment. Secure production hosting is an infrastructure responsibility.
- Read-only annotations help clients understand intent, but access should also be enforced through roles and upstream credentials.
- AI can misread business context or combine correct data into an incorrect conclusion.
- Information retrieved from emails, tickets, webpages, and documents can contain prompt-injection instructions designed to manipulate an agent.
- Audit logs may retain complete upstream responses and therefore require access and retention controls.
- Response filtering fails open by default unless sensitive tools set
fallbackToRawtofalse. - AnythingMCP’s self-hosted core is licensed under AGPL-3.0-only. Code under ee/ directories has a separate commercial licence and is not required for self-hosting. Review the applicable source-distribution and modified-network-service obligations for your deployment.
- No gateway removes the need for human approval around payments, refunds, publishing, sending, price changes, account changes, and deletion.
What this changes
The old AI workflow began with copying company data into a chat. The new workflow can begin with an approved question and a controlled tool call.
The advantage is not giving AI unlimited access. The advantage is letting it retrieve exactly what a person would otherwise gather manually, while the company keeps control of credentials, permissions, fields, and consequential actions.
The founder rule is simple:
Connect one system. Expose one read-only job. Verify every call. Add authority only after the evidence says you should.
