LoginSign Up
← Back to all sparks
A

Appsmith

DEVOPS
Velocity6.3

Open-source low-code platform for building custom internal applications.

www.appsmith.com ↗

Appsmith ships an embedded MCP server, letting AI clients build and edit apps via structured tool calls

mcp-serverai-agentsinternal-toolsopen-sourcesecurity-hardening
◆Current state
Appsmith 2.4 ships an embedded MCP server in beta, enabling AI agents to build and edit applications through tool calls rather than raw DSL manipulation. Safety constraints are built in from day one: destructive operations require a human-approval handshake, git-connected apps are gated by branch state, and every agent commit lands in a protected mcp/ namespace with a non-strippable prefix. This coincides with the explicit EOL of Appsmith's own AI layer — a deliberate trade of first-party AI for open MCP client compatibility.
◆Where it's heading
The MCP server positions Appsmith as an AI-editable application platform, not just a tool where humans do all the building. The series of security hardening releases across v2.1–v2.4 (over 30 CVE and GHSA patches) reads as deliberate preparation for agent access: hardening the surface before opening it. The v2.3 Ask AI expansion to Community Edition and the v2.4 Appsmith AI EOL together complete the transition from proprietary AI layer to MCP-native extensibility.
◆Prediction
Expanded MCP tool coverage — more widget primitives, datasource management, and deployment operations — is the logical next step once the beta stabilizes. The prepare_*/confirm_* handshake model may evolve based on early adoption feedback, particularly from teams wanting fully automated pipelines.

◆Recent moves

  1. 2d ago

    Release v2.4.2 🌈

    Patch release addressing Bouncy Castle and other dependency CVEs, a server memory issue in page cloning, and minor UI fixes. The Appsmith AI EOL reminder (September 30) is a repeat notice from v2.4, not new information. Routine security maintenance ahead of the EOL cutover.

    View source ↗
  2. 9d ago

    Release v2.4.1 🌈

    Security-focused patch: Databricks URL validation closes an SSRF vector in JDBC connections, CVE-2026-75595 in netty-handler is patched, and UQI filter column names are validated to prevent SQL injection. The hardened WebClient builder lands on AI and Google Sheets plugins. Non-interactive appsmithctl restore adds an automation path for operators.

    View source ↗
  3. 16d ago

    Appsmith 2.4: embedded MCP server (beta) for AI-driven app building

    ⚡ SPARK

    Appsmith 2.4 ships an opt-in embedded MCP server (beta) that lets AI clients build and edit applications through tool calls, gated by the caller's own user permissions. Simultaneously, Appsmith's own AI datasource reaches end of life — the product is trading its proprietary AI layer for open MCP compatibility.

    View source ↗
  4. 1mo ago

    Release v2.3 🌈

    v2.3 is primarily a large security hardening sprint — over 15 CVEs and GHSA patches including a path traversal fix in Git imports, multiple datasource authorization bypasses, and an XSS fix in SQL autocomplete. The functional additions (Ask AI for Community Edition, AI Copilot for Custom Widgets, new Card widget) expand the AI authoring surface that v2.4's MCP server will build on.

    View source ↗
  5. 2mo ago

    Release v2.2 🌈

    v2.2 ships a long-requested feature: copying APIs, queries, and JavaScript objects across applications. Security batch addresses 17 vulnerabilities identified in release image scans, including blocking Redis datasource connections to the internal Appsmith Redis instance (GHSA-qhfj-g87x-m39w) — a critical internal SSRF path.

    View source ↗
  6. 4mo ago

    Release v2.1 🌈

    v2.1 hardens the attack surface: comprehensive non-routable IP filter on WebClient closes multiple SSRF paths (GHSA-v49v-673j-g4vj, GHSA-m23h-pvf3-2m7p), Caddy admin interface locked to local socket, and Supervisord admin port removed. These are the hardening moves visible in v2.1–v2.3 that precede opening the MCP server in v2.4.

    View source ↗