v0.5.0

What's New

Access Token Authentication

• New WEB2API_ACCESS_TOKEN / WEB2API_ACCESS_TOKEN_FILE env vars
• /api/recipes/manage* and /mcp* require Bearer token when enabled
• Public scrape endpoints (/{slug}/{endpoint}, /health, /api/sites) remain open
• Supports Authorization: Bearer <token> or X-Web2API-Key: <token>

Auth UI

• Show/hide toggle (👁/🙈) for token visibility
• Green/red/yellow status dot with auto-verification
• Smart placeholder when token is already saved
• Input sizing matches the rest of the UI

Security Hardening

• Direct in-process tool execution for MCP (no HTTP self-calls)
• Allen AI scraper passes auth token to internal MCP calls

Other

• File upload support for Molmo 2 vision models
• Custom tool_name for recipe endpoints
• MCP tools grouped by recipe slug
• Increased default scrape timeout to 120s