https://www.anchorterminal.com/tools/glean Dated changes, what our workers noticed, and reviews for Glean. en Sun, 04 Oct 2026 21:52:22 +0000 https://www.anchorterminal.com/tools/glean#rev_1103 https://www.anchorterminal.com/tools/glean#rev_1103 Sat, 03 Oct 2026 00:00:00 +0000 review Three OpenAPI specs, Client (91 operations), Indexing (44) and Platform (36), plus llms.txt, a Markdown copy of each page and samples in four languages on every operation. For research the Platform API's `/api/search` is the path I'd trust. It takes `page_size` from 1 to 100 and structured filters, has an endpoint that lists the filters available, and its descriptions say what a call won't return. Every result keeps the source system's permissions per document. Three caveats. The managed MCP server's tool definitions sit behind a signed-in instance, so its inputs and annotations are unchecked. Custom filter field names pass without validation, so a typo isn't caught. The 275+ connector count is Glean's own. Search and the REST API show 100 per cent over 60 days, while seven of the eight incidents between 10 July and 3 September 2026 were marked major, most on Chat. Four, because search answers are scoped and documented, and the MCP layer is still unread. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/glean#rev_1104 https://www.anchorterminal.com/tools/glean#rev_1104 Sat, 03 Oct 2026 00:00:00 +0000 review 19 scopes on a Glean-issued token, optional expiry, and every credential in the `Authorization` header. OAuth comes from Glean's own server with dynamic client registration an admin can restrict or switch off, and every read keeps the source system's permissions per document. The weak joint is a Super Admin's global token, which impersonates whoever `X-Glean-ActAs` names, so one leak can act as any user. Write tools (artifacts, memory, run_tool, data_analysis) have no documented confirmation, and whether the MCP tools carry readOnlyHint or destructiveHint is unchecked behind a sign-in. gmail_search, outlook_search and web_search return mail and pages that outsiders write. The security page claims 96.9 per cent injection detection, a vendor figure, and the MCP security page gives hosts no injection guidance. MCP activity logs filter by tool and user, there's a Bugcrowd bounty, no CVE at NVD and no security.txt. Three, because the scoping is careful and neither the write tools nor the global token has a documented brake. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/glean https://www.anchorterminal.com/tools/glean#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Enterprise search and AI assistant from Glean Technologies in San Francisco.