@sift-wiki/api-anything-gateway

@sift-wiki/api-anything-gateway installs digest-pinned, declarative api-anything capsules and exposes their operations through one stable MCP connection. It runs read-only by default and emits no telemetry. The installed executable is api-anything-gateway.

Requirements

Node.js 22 or newer is required.

First run

npx -y @sift-wiki/api-anything-gateway install instagram
npx -y @sift-wiki/api-anything-gateway install linkedin
npx -y @sift-wiki/api-anything-gateway install x
npx -y @sift-wiki/api-anything-gateway doctor
npx -y @sift-wiki/api-anything-gateway search "social profile"
npx -y @sift-wiki/api-anything-gateway serve

You can install only the capsules you need. A successful install keeps stdout as one JSON object and adds a nextSteps object with the local credential file (when the capsule has authenticated operations), a doctor command, ready-to-copy MCP configuration, and search/serve commands. A short human summary goes to stderr, so scripts can continue parsing stdout as JSON.

Or install it globally:

npm install -g @sift-wiki/api-anything-gateway
api-anything-gateway doctor

The default command is serve. Common flags are --capsules DIR, --registry URL, --timeout-ms 30000, and --allow-writes instagram,linkedin,x. A write operation is executable only when its capsule slug is explicitly listed.

The registry defaults to https://api-anything-catalogue.unobtainiumrock.workers.dev; override it with --registry or API_ANYTHING_REGISTRY. Install a specific release with install <slug>@<version> --digest sha256:<digest> (or use --version). Commands copied from the catalogue include both pins.

Capsule home and credentials

Capsules resolve in this order: --capsules, API_ANYTHING_CAPSULES, then ~/.api-anything/capsules. lock.json is authoritative and pins each active release to an exact SHA-256 digest; index.json is the deterministic human-readable index. Invalid or tampered releases are isolated in quarantine.json and do not prevent other capsules from serving.

Credentials remain local. For a capsule named linkedin, the gateway reads ~/.api-anything/credentials/linkedin.env, overlays the real process environment, and delegates parsing to api-anything's public credentialsFromEnv. This is the same owner-only location written by api-anything login, so one captured session works through both packages. Credential values are never printed or sent to the catalogue. Keep these files out of version control; use mode 0700 for both parent directories and 0600 for each file.

Use the browser session for your own account and add only the file needed by the operations you call:

# ~/.api-anything/credentials/instagram.env — required for private/authenticated operations;
# public profile lookup works without it.
INSTAGRAM_COOKIES='sessionid=...; csrftoken=...; ds_user_id=...'

# ~/.api-anything/credentials/linkedin.env — LinkedIn operations require a logged-in session.
LINKEDIN_COOKIES='li_at=...; JSESSIONID="ajax:..."'

# ~/.api-anything/credentials/x.env — required for authenticated search and writes;
# public profile lookup works without it.
X_COOKIES='auth_token=...; ct0=...'

The same values can be supplied through the process environment. The general conventions are <SLUG>_COOKIES, <SLUG>_BEARER, <SLUG>_HEADERS, and <SLUG>_QUERY.

MCP client configuration

Claude Desktop / compatible JSON configuration:

{
  "mcpServers": {
    "api-anything": {
      "command": "npx",
      "args": ["-y", "@sift-wiki/api-anything-gateway", "serve"]
    }
  }
}

To opt one capsule into writes:

{
  "mcpServers": {
    "api-anything": {
      "command": "api-anything-gateway",
      "args": ["serve", "--allow-writes", "linkedin"]
    }
  }
}

The stable tools are search_capabilities, describe_capability, and call_operation. Up to twelve deterministic convenience tools are added from installed capsules, preferring mapped core features and then read-only operations. Stable operation IDs use slug/operation; direct tools use conservative slug__operation names. Search may show remote results with installed: false, but execution always requires a locally installed release.

Trust boundaries

• Installation downloads only JSON artifacts, hashes the exact response bytes, compares the registry-provided SHA-256, validates the ApiSpec through the public parseApiSpec, and then atomically activates the pinned release. If that digest-addressed artifact path already exists, the gateway rehashes and revalidates it before activation and atomically replaces corrupt bytes. JavaScript artifacts and revoked releases are refused.
• Published envelopes must use api-anything.capsule/v1, identify the api-anything framework on the compatible 0.1.x line, and match the selected registry release's framework version, slug, and version. For backward compatibility, a direct legacy raw ApiSpec JSON artifact is still accepted; it remains subject to digest, spec-name, explicit-effect, and origin validation.
• Before serving, listing, or diagnosing installed capsules, the gateway revalidates lifecycle state against the authoritative registry. A running gateway also revalidates a pin before dispatch once its 30-second lifecycle cache expires. Observed revocation is persisted and sticky. Once freshness expires, an unavailable registry fails closed and no target request is sent.
• Capsule, registry, artifact, operation, and prepare URLs require HTTPS on the default port. Declared operation and network-prepare URLs are accepted only on the baseUrl hostname or a true subdomain (for example, api.x.com under x.com). Resolver-only extra origins must be explicitly declared. Production dispatch resolves every target, rejects private/reserved answers, disables redirects, and pins the connection to the verified DNS answer.
• Every operation and prepare/resolver step must carry an explicit effect classification. POST-based reads are allowed when deliberately marked readOnly: true; unclassified or mutating work is denied unless that capsule is named in --allow-writes.
• A digest verifies integrity against registry metadata, not the publisher's identity. Choose a registry you trust and review capsules that can reach sensitive services.
• Capsules are declarative request templates, but calls still send network requests with your local credentials. Writes are denied per capsule unless explicitly enabled.
• Catalogue search receives only the search query. No credentials, installed artifacts, operation arguments, or usage telemetry are uploaded by default.