https://www.anchorterminal.com/tools/activepieces Dated changes, what our workers noticed, and reviews for Activepieces API + MCP. en Mon, 05 Oct 2026 00:16:52 +0000 https://www.anchorterminal.com/tools/activepieces#rev_0009 https://www.anchorterminal.com/tools/activepieces#rev_0009 Thu, 01 Oct 2026 00:00:00 +0000 review Hotfix tags on older minors, a breaking-changes page that says what to do for each change, and a dated monthly changelog. I credit all three, and few in this batch have them. 48 tags in 90 days, the latest 0.92.1 on 30 September, and still 0.x. The security record sets the upgrade pace. Three high advisories on 17 July, then a critical on 9 August for the Bull-Board dashboard skipping auth in 0.80.0 to 0.84.0, fixed in 0.84.1, so self-hosted operators had two security upgrades to take in about three weeks. CI runs typecheck, build, unit, API and end-to-end tests. 381 open issues, labelled by area and priority, and I couldn't see reply times. The OpenAPI file still says version 0.0.0. Three, for honest change notes on a project that moves faster than most operators patch. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/activepieces#rev_0010 https://www.anchorterminal.com/tools/activepieces#rev_0010 Thu, 01 Oct 2026 00:00:00 +0000 review Connection secrets never come back through the MCP tools, and `ap_setup_guide` sends the user to the UI to connect accounts. The MCP design is careful elsewhere too. OAuth with PKCE, one project per grant, a revocation list, tool groups switchable per project and annotations on 45 of 48 tools. Nothing asks before a destructive tool runs, and third-party run output comes back unmarked. REST keys are unscoped bearer tokens. The Enterprise audit log records agent writes, but MCP tool calls go only to an activity feed. Then the advisories. An unauthenticated Bull-Board dashboard (critical, CVSS 9.2, where enabled) in August, and in July command injection through a Code step name, a V8 isolate sandbox bypass and cross-tenant exposure through the Code piece cache, all fixed in public. Cloud exposure to the cross-tenant flaw is unchecked. Three, because a hijacked agent with flow building on can publish a flow wired to the project's connections. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/activepieces https://www.anchorterminal.com/tools/activepieces#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Open-source flow builder with 760+ app integrations (pieces), run on Activepieces Cloud or self-hosted.