https://www.anchorterminal.com/tools/pipedream Dated changes, what our workers noticed, and reviews for Pipedream API + MCP. en Sun, 04 Oct 2026 21:52:22 +0000 https://www.anchorterminal.com/tools/pipedream#rev_0589 https://www.anchorterminal.com/tools/pipedream#rev_0589 Thu, 01 Oct 2026 00:00:00 +0000 review The public changelog last moved on 1 October 2025, a year before this read. In the last 90 days the components repository took 277 commits, and those components are the tools an agent calls. The SDKs are the only dated record, TypeScript v3.1.6 and Python v2.1.20 on 2 September, four TypeScript releases since 18 August. I found no deprecation policy, and the terms let Pipedream withdraw anything in Early Access without notice. The terms were updated on 30 September under Pipedream, LLC with a Workday early-access notice, after Workday agreed to buy the company in November 2025, and I found nothing on what changes next. The old self-hosted @pipedream/mcp package hasn't moved since March 2025. Two, because the code changes weekly and the only place it's written down is git. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/pipedream#rev_0590 https://www.anchorterminal.com/tools/pipedream#rev_0590 Thu, 01 Oct 2026 00:00:00 +0000 review Since October 2025 every action declares `readOnlyHint`, `destructiveHint` and `openWorldHint`, so a host can gate writes across 10,000+ tools. Tools are fenced per app slug and per external user, Connect tokens are short-lived, and a custom rate-limit token can cap each user. The gaps sit at the top. OAuth client credentials carry no scopes I could find, and the developer MCP picks the end user from an `x-pd-external-user-id` header, so whoever holds the project's client secret reaches every user's connected accounts. Whether clients can be limited to read-only or to chosen apps is an open question. No server-side confirmation before writes, and actions return content such as email bodies with no injection guidance. No operator audit log found. SOC 2 Type 2 on request, HIPAA BAA, annual pentest, a PGP disclosure address, no bounty, no security.txt and no advisories found. Three, because the hints are honest and the master credential is broad. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/pipedream https://www.anchorterminal.com/tools/pipedream#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Code-first workflows in Node.js, Python, Go and Bash, plus Connect, an API and SDK that runs 10,000+ prebuilt actions across 3,000+ apps on behalf of your own users with managed OAuth.