v0.4.1 — In-Process Execution & Security Hardening

What's Changed

⚡ In-Process Tool Execution

MCP tools now execute recipes directly in-process instead of making HTTP self-calls via httpx. This eliminates network overhead and simplifies the architecture.

• New public execute_recipe_endpoint() function used by both MCP server and HTTP bridge
• MCP bridge no longer fakes Request objects or parses response bodies from JSON
• MCP server removes httpx dependency and WEB2API_INTERNAL_URL constant
• Cleaner error handling throughout the execution chain

🔒 Security Hardening

• Path traversal protection — uploaded filenames are sanitized, preventing ../ escape attacks
• Stricter param validation — query parameter names must be valid Python identifiers (rejects dashes, special chars, and Python keywords like class)

🧪 New Tests

• Path traversal upload rejection test
• MCP bridge special character preservation test
• Python keyword parameter name rejection test

🔧 Other

• Docker Compose port is now configurable via WEB2API_HOST_PORT env var (default: 8010)
• E2E tests allocate random ports to avoid conflicts
• Fallback version updated to 0.4.0

Full Changelog: v0.4.0...v0.4.1

v0.4.0 — Vision, Tool Names & File Uploads

What's New

👁 Vision Model Support (Molmo 2)

Web2API now supports file uploads — send images and videos to vision models like Molmo 2 8B.

# Analyze an image
curl -X POST "/allenai/molmo2?q=Describe this image" -F "files=@photo.jpg"

# Video understanding
curl -X POST "/allenai/molmo2?q=What happens in this video?" -F "files=@clip.mp4"

• New POST /{slug}/{endpoint} route accepting multipart form data
• Files saved to temp, forwarded to scrapers, cleaned up automatically
• File upload requests bypass the response cache
• Added molmo2 and molmo2-track endpoints to the Allen AI recipe

🏷 Custom Tool Names

Recipe endpoints can now define an tool_name field for AI-friendly MCP tool names:

endpoints:
  search:
    tool_name: "web_search"    # instead of brave-search__search

• Produces clean names that AI models handle better (e.g. web_search, translate_de_to_en)
• All built-in recipes updated with custom tool names
• Routing, filtering, and tool calls all work with custom names
• Falls back to {slug}__{endpoint} convention when not set

🔧 MCP Tools UI

• Tools are now grouped by recipe slug with a parent header showing the recipe name and tool count
• Grouping works correctly for both custom-named and default-named tools

⏱ Timeout Increase

• Default scrape timeout raised from 30s to 120s
• Allen AI scraper HTTP timeouts raised to 120s
• Allows tool-calling round trips to complete without timing out

📄 Recipe Docs

• "Recipe docs" links now correctly point to each recipe's README.md
• All recipes in the recipe catalog now have detailed README files
• Fixed URL path cleaning (removed stray ./ segments)

Full Changelog: v0.3.0...v0.4.0

v0.3.0 — MCP Server

What's New

🔌 MCP Protocol Server (/mcp/)

Web2API now includes a built-in Model Context Protocol server. Every installed recipe endpoint is automatically exposed as a native MCP tool — no configuration needed.

Connect Claude Desktop:

{
  "mcpServers": {
    "web2api": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://your-host/mcp/"]
    }
  }
}

Connect Claude Code:

claude mcp add --transport http web2api https://your-host/mcp/

• Each recipe endpoint registers as its own tool with typed parameters
• Tools rebuild automatically when recipes are installed, uninstalled, enabled, or disabled
• Streamable HTTP transport (stateless) — compatible with any MCP client
• Tool descriptions include the recipe site URL for better AI context

🛠 MCP HTTP Bridge (/mcp/tools)

A simpler REST bridge for non-MCP consumers (also powers the web UI):

• GET /mcp/tools — list all tools as JSON
• POST /mcp/tools/{name} — call a tool
• Path-based filtering: /mcp/only/brave-search/tools, /mcp/exclude/allenai/tools
• Query-based filtering: ?only=slug1,slug2 or ?exclude=slug1
• New MCP Tools tab in the web UI with copy-ready URLs

📦 Other Changes

• Git tree hash update detection — managed recipes show update availability via git tree comparison
• Endpoint params declaration — recipe endpoints can declare custom query parameters with descriptions
• UI improvements — update/up-to-date badges moved to title row, cleaner badge alignment
• Docker — port binding defaults to localhost only (for reverse proxy setups)

🧹 Cleanup

• Shared MCP utilities extracted to mcp_utils.py
• Dead code removed, duplicate helpers consolidated
• mcp and httpx added as dependencies

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

Recipe Management

• Externalized recipe catalog to a dedicated repository
• Refactored recipe management for catalog-based installs, updates, and discovery

Web Interface

• Switched to tabbed navigation
• Lazy-loaded recipe list for faster initial load
• UI cleanup and layout improvements

Docker

• Added git to the Docker image (required for catalog commands)

Documentation

• Local setup is now the primary quickstart (simpler, no Docker required)
• Clarified Docker CLI usage — all web2api commands need docker compose exec prefix

Self-Update

To update an existing installation:

# Git-based install
web2api self update apply --yes

# Docker
docker compose pull && docker compose up -d --build

Full Changelog: v0.1.0...v0.2.0

v0.1.0

Full Changelog: https://github.com/Endogen/web2api/commits/v0.1.0