Anvil v2.2.30: Many Hands, One Anvil

By /

Anvil v2.2.30: Many Hands, One Anvil

Anvil has always been the AI that runs where you work and answers to you — your models, your keys, your data, your machine. With v2.2.30, it answers to your team. Several people can work in one live Anvil session, each with their own identity, their own models, and their own permissions — and the host enforces those permissions where the work actually happens, not just in the interface. A refusal becomes something you can see and act on instead of a silent nothing.

Alongside that, this release does two things we have wanted for a long time. You can ask a panel of models the same question and compare their answers side by side before you commit to one. And a credential stops being something you paste: you write a handle, and the secret is resolved at the last possible moment — the model never sees it, the transcript never keeps it, and the tool never holds it.

Your team, in one session

An organization is a group of people sharing a running Anvil, not a list of logins.

  • Everyone brings their own identity. Each person’s messages, tool calls, and spend are attributed to them, verified on the host. You can answer “who ran that?” and “who spent that?” without guessing.
  • Roles are capability sets, not ranks. A role is a list of what someone may do plus the workspace it applies to — not a rung on a ladder. Organizations author their own roles rather than picking from a fixed menu, so access matches the job; the built-in roles stay as they are and cannot be redefined out from under you.
  • A seat is checked when it is taken, not just when it is offered. If a workspace has a limit, it is enforced at the moment an invitation is accepted. Checking only at the point of sending is how a team four-fifths full sends twenty invitations that were each legal when written and ends up well over the line.
  • Joining never means handing over. Bringing an Anvil into an organization grants other people access to it. It does not transfer ownership — that stays with one person, by design.
  • Reach is declared, never assumed. A role that does not say it needs the whole machine does not get the whole machine. The blast radius of a mistake is bounded by default rather than by discipline.
  • Ask for more, in the moment. When a task is blocked, request a scope increase from the app. The owner sees it, approves it once or permanently, and the task continues. Nobody leaves the session to hunt for an admin, and nothing gets shared “temporarily”.

Permissions that hold at the point of effect

Enforcement moved to where the action happens: the tool layer. This matters more than it sounds. Previously the interface hid what you could not do, and a denial looked like nothing happening. Now every tool — including MCP servers, LSP servers, and plugin tools — goes through the same gate, and a refusal is a result with the reason attached. A silent failure teaches you nothing; a named refusal tells you exactly what to ask for.

Ask five models. Compare the answers. Pick one.

/consult asks a configured panel of models the same question and brings the answers back together, each in its own section, with agreement and dissent marked.

  • The split is visible, not averaged. When three models agree and two disagree, you see a 3–2 split rather than a single confident-sounding summary. One confident model is a guess; a marked split is a decision.
  • Ask the dissenter why. A minority answer can be questioned through its own model. The outlier is often the one that saw the edge case the majority missed.
  • Accepting stages; proceeding sends. Marking a winner sends nothing — it stages it. Proceeding is a separate, deliberate step, so no click ever spends a turn you did not approve.

And /relay does the other shape of the same idea: chain models so each one builds on the last, using the right model for each leg of the problem.

Write the handle, not the secret

This is the change we are proudest of. A credential is referenced by handle, and Anvil substitutes the real value at the very last moment — at the boundary, after the tool call has been assembled.

You write {{vault:pg-appdb}} in a connection string, or Authorization: Bearer {{vault:token}} in a header, and that is what the model reasons about. That is also what the transcript keeps. Only the boundary ever sees the value.

  • The model never holds the secret. It works with a name. There is nothing to leak into a prompt, a log, or a provider’s servers — your credentials never become part of anyone else’s error report.
  • Resolved last, not first. Because substitution happens at the boundary, no intermediate step carries a plaintext copy. There is one substitution point to audit instead of an unknown number of places a secret might have been copied.
  • A wrong secret is refused, not guessed. Length and fingerprint are verified before use, so a mistyped handle fails immediately and loudly instead of authenticating against the wrong database two systems downstream.
  • It works inside anything. Connection strings, HTTP headers, config files, nested paths — the handle is just text until the boundary.

Secrets stop travelling

The vault got a hard audit this release, and several things changed underneath the handles.

  • The master password no longer crosses the wire. Unlocking, listing, reading, storing, and deleting all happen on the host. A compromised browser session cannot lift the key to everything else.
  • A secret is an effect, never a value. Tools spend a credential; they never receive it. A tool that never holds the secret cannot leak, log, or exfiltrate it.
  • Credentials are encrypted at rest, and the daemon can be unlocked without ever putting a password in a chat box.
  • Anvil notices secrets you paste. A detected secret becomes a vault entry and a reference in the conversation instead of sitting in plain text. The most common leak is an accidental paste, and that path is now closed by default.
  • You can see which credentials Anvil captured, grouped by what they are, with reveal gated on unlock and written to the audit trail with the credential and the person attached. “We think it’s safe” becomes a list you can review.
  • You can lend a credential without giving it away. Hand a colleague in the session the name of a vault entry for a set number of minutes. They can use it; they cannot read it, and they cannot lend it onward. The audit line names both of you, so “who used that key” has an answer that includes who authorised it. Then it expires on its own — the most reliable way to end an access is for nobody to have to remember to.

Costs you can trust

Anvil now prices a turn from a live pricing registry rather than a table baked into the binary. Context tiers, batch and priority service, cache TTLs, and per-provider quirks are all accounted for, so your numbers stay right when a vendor changes prices — with no client update.

Just as importantly, a model whose price is genuinely unknown is reported as unknown rather than billed at zero. A silent $0 is how budgets get blown; now a gap looks like a gap. /cost aggregates across every session — daily, weekly, monthly, yearly — broken out by provider, and in a shared session, by seat.

Attachments, voice, and read-aloud everywhere

  • Send a file from anywhere — desktop, browser, or phone. PDFs, Office documents, ebooks, audio, and archives all extract properly instead of hitting an “unknown type” wall. The context usually lives in documents, and now Anvil can read them wherever you are.
  • Voice recording shows its state and can be stopped, which matters most on a phone. You always know whether the microphone is live.
  • Read-aloud has a real control on desktop and mobile, instead of being a feature you had to know about.

Fleet control

/fleet fans a task out across the Anvils you own and routes by capability, so a job lands on a machine that can actually run it — without you keeping track of which machine is which.

Still great from the last release

If you are arriving now, v2.2.29 turned AnvilHub into mission control for every Anvil you run: claim a deployment, name it, give it a persona, choose its primary agent, and install or remove skills, plugins, and agents straight from the web. It also added the build-sync-publish loop that turns a private tool into a shared one on your terms, and curated starter templates so composing a chain begins from something that works. All of that is unchanged and still good.

Own it, together

Anvil is one local-first AI that speaks to every provider and does more than write code — it remembers across sessions, listens and speaks, runs agents, and automates real work. What v2.2.30 adds is company without compromise: a team that can share one Anvil, a panel of models that can argue in front of you, and credentials that stay yours even while the work gets done.

Upgrade

Anvil v2.2.30 ships as native binaries for macOS (Apple silicon and Intel), Linux (x86-64 and ARM64), Windows, FreeBSD, and NetBSD — one binary, 35 providers, 138 commands, no account required.

  • Homebrew: brew install culpur/tap/anvil
  • macOS / Linux: curl -fsSL https://anvilhub.culpur.net/install.sh | bash
  • Windows: irm https://anvilhub.culpur.net/install.ps1 | iex

Already running Anvil? anvil upgrade pulls the new release in place — existing sessions, memory, and vault contents carry forward. Organizations, roles, and scope requests are managed at anvilhub.culpur.net.

Scroll to Top