MCP Observatory
3m ago Tracked 59,936 Last 3m ago 24h 2,437
github TypeScript analyzed 8066634 no deep scan

oomol-lab/open-connector

github

Open-source auth gateway connecting 1500+ SaaS providers to AI agents through SDK, CLI, MCP, HTTP, and OpenAPI.

maintainer
oomol-lab
licence
Apache-2.0
first seen
2026-07-03
last seen
2026-09-18
releases · 30d
5
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 5 tools
transport http counts 5 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • execute_action
  • get_action_guide
  • list_apps
  • list_connections
  • search_actions
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 8066634 · analyzer v33 · 7h ago

skills & prompt files 2

danger signals53

code evidence vv1.6.1 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 6286

filesystem 45

  • fs (weak) oomol-lab-open-connector-8066634/examples/local-http/app_store_connect.ts :5 import { readFileSync } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/scripts/build-binary.ts :2 import { existsSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/scripts/build-runtime-package.ts :2 import { cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/scripts/copy-catalog-assets.test.ts :3 import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/scripts/copy-catalog-assets.ts :1 import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/scripts/ensure-generated.ts :2 import { readdir, stat } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/scripts/generate-catalog.ts :3 import { mkdir, rename, rm, writeFile } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/scripts/generate-provider-registry.ts :3 import { readFile, writeFile } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/scripts/provider-source.ts :3 import { readdir } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/scripts/release/compute-release-version.ts :11 import { appendFile } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/scripts/runtime-data.ts :1 import { mkdir } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/scripts/smoke-binary.ts :5 import { access, mkdtemp, rm } from "node:fs/promises";
show 28 more
  • fs (weak) oomol-lab-open-connector-8066634/scripts/typecheck.ts :2 import { mkdir } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/src/catalog-index.test.ts :3 import { existsSync } from "node:fs";
  • fs oomol-lab-open-connector-8066634/src/catalog-index.ts :3 import { readFile, stat } from "node:fs/promises";
  • fs oomol-lab-open-connector-8066634/src/catalog-lazy-schemas.ts :4 import { readFileSync } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/src/catalog-store.test.ts :4 import { mkdir, mkdtemp, readdir, rm, stat, writeFile } from "node:fs/promises";
  • fs oomol-lab-open-connector-8066634/src/catalog-store.ts :4 import { readdir, readFile } from "node:fs/promises";
  • fs oomol-lab-open-connector-8066634/src/mail/imap-smtp/protocol.ts :9 import { createWriteStream } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/src/mail/imap-smtp/runtime.test.ts :4 import { readFileSync } from "node:fs";
  • fs oomol-lab-open-connector-8066634/src/mail/imap-smtp/runtime.ts :13 import { createWriteStream } from "node:fs";
  • fs oomol-lab-open-connector-8066634/src/providers/dokploy/generate.ts :3 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/src/providers/provider-source-guards.abort-predicate.test.ts :1 import { readdirSync, readFileSync } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/src/providers/provider-source-guards.auth-status.test.ts :1 import { readdirSync, readFileSync } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/src/providers/provider-source-guards.basic-auth.test.ts :1 import { readdirSync, readFileSync } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/src/providers/provider-source-guards.clone-baseline.test.ts :1 import { readdirSync, readFileSync, writeFileSync } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/src/providers/provider-source-guards.regex-charset.test.ts :1 import { readdirSync, readFileSync } from "node:fs";
  • fs oomol-lab-open-connector-8066634/src/providers/zhihu/executors.ts :3 import { createWriteStream, openAsBlob } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/src/server/api/static-routes.test.ts :2 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
  • fs oomol-lab-open-connector-8066634/src/server/api/static-routes.ts :5 import { readdirSync, readFileSync } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/src/server/connect-server.test.ts :31 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/src/server/connector-runtime.test.ts :3 import { cp, mkdtemp, mkdir, readFile, rm } from "node:fs/promises";
  • fs oomol-lab-open-connector-8066634/src/server/connector-runtime.ts :7 import { mkdir } from "node:fs/promises";
  • fs (weak) oomol-lab-open-connector-8066634/src/server/eager-imports.test.ts :1 import { readFileSync } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/src/server/files/node-transit-file-upload.test.ts :1 import { mkdir, mkdtemp, readdir, rm, stat, utimes, writeFile } from "node:fs/promises";
  • fs oomol-lab-open-connector-8066634/src/server/files/node-transit-file-upload.ts :5 import { createWriteStream } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/src/server/files/s3-transit-files.test.ts :9 import { mkdtemp, rm, writeFile } from "node:fs/promises";
  • fs oomol-lab-open-connector-8066634/src/server/files/s3-transit-files.ts :13 import { createReadStream } from "node:fs";
  • fs (weak) oomol-lab-open-connector-8066634/src/server/files/transit-files.test.ts :1 import { mkdtemp, readdir, rm, unlink, utimes, writeFile } from "node:fs/promises";
  • fs oomol-lab-open-connector-8066634/src/server/files/transit-files.ts :3 import type { Stats } from "node:fs";

5 more not shown — this panel samples each group; the count above is the real total.

shell / exec 11

  • shell (weak) oomol-lab-open-connector-8066634/scripts/build-binary.ts :1 import { spawnSync } from "node:child_process";
  • shell (weak) oomol-lab-open-connector-8066634/scripts/build-runtime-package.ts :1 import { spawnSync } from "node:child_process";
  • shell (weak) oomol-lab-open-connector-8066634/scripts/dev-local.ts :1 import type { ChildProcess } from "node:child_process";
  • shell (weak) oomol-lab-open-connector-8066634/scripts/ensure-generated.ts :1 import { spawnSync } from "node:child_process";
  • shell (weak) oomol-lab-open-connector-8066634/scripts/release/compute-release-version.ts :10 import { spawnSync } from "node:child_process";
  • shell (weak) oomol-lab-open-connector-8066634/scripts/release/github-release.ts :16 import { spawnSync } from "node:child_process";
  • shell (weak) oomol-lab-open-connector-8066634/scripts/release/publish-npm.ts :14 import { spawnSync } from "node:child_process";
  • shell (weak) oomol-lab-open-connector-8066634/scripts/smoke-binary.ts :1 import type { ChildProcess } from "node:child_process";
  • shell (weak) oomol-lab-open-connector-8066634/scripts/typecheck.ts :1 import { spawn } from "node:child_process";
  • shell oomol-lab-open-connector-8066634/src/providers/dokploy/generate.ts :1 import { spawnSync } from "node:child_process";
  • shell (weak) oomol-lab-open-connector-8066634/src/server/storage/d1-runtime-store.test.ts :633 exec(sql: string): void {

network 40

  • net (weak) oomol-lab-open-connector-8066634/examples/local-http/client.ts :20 const response = await fetch(url, init);
  • net (weak) oomol-lab-open-connector-8066634/examples/openai-tools/run-hackernews.ts :100 const response = await fetch("https://api.openai.com/v1/responses", {
  • net (weak) oomol-lab-open-connector-8066634/examples/weixin-bot-login.ts :87 const response = await fetch(url, {
  • net (weak) oomol-lab-open-connector-8066634/scripts/copy-catalog-assets.test.ts :119 async fetch(request) {
  • net (weak) oomol-lab-open-connector-8066634/scripts/healthcheck.ts :6 const response = await fetch(url, {
  • net (weak) oomol-lab-open-connector-8066634/scripts/smoke-binary.ts :6 import { createServer } from "node:net";
  • net oomol-lab-open-connector-8066634/src/core/guarded-fetch.ts :135 /** Base transport behind each guarded fetch (undefined = global fetch) so re-wrapping never stacks guards. */
  • net (weak) oomol-lab-open-connector-8066634/src/mail/imap-smtp/host-pinning.test.ts :3 import type { LookupFunction, TcpNetConnectOpts } from "node:net";
  • net oomol-lab-open-connector-8066634/src/mail/imap-smtp/protocol.ts :3 import type { LookupFunction, Socket, TcpNetConnectOpts } from "node:net";
  • net oomol-lab-open-connector-8066634/src/marketplace/marketplace-service.ts :208 response = await this.fetch(url, {
  • net oomol-lab-open-connector-8066634/src/mcp.ts :179 return await handler.fetch(request);
  • net oomol-lab-open-connector-8066634/src/providers/abuseipdb/executors.ts :9 import { isIP } from "node:net";
show 28 more
  • net oomol-lab-open-connector-8066634/src/providers/api_void/executors.ts :5 import { isIP } from "node:net";
  • net oomol-lab-open-connector-8066634/src/providers/baidu_maps/runtime.ts :173 // the bytes sent by the proxy's fetch(url) match the RFC-1738 bytes the SN was
  • net oomol-lab-open-connector-8066634/src/providers/convex/executors.ts :4 import { isIP } from "node:net";
  • net oomol-lab-open-connector-8066634/src/providers/dokploy/generate.ts :189 const response = await fetch(defaultSourceUrl);
  • net oomol-lab-open-connector-8066634/src/providers/googlephotos/actions.ts :305 mediaItemIds: s.stringArray("The list of media item IDs to fetch (1-50).", { minItems: 1, maxItems: 50 }),
  • net oomol-lab-open-connector-8066634/src/providers/iplocate/runtime.ts :5 import { isIP } from "node:net";
  • net oomol-lab-open-connector-8066634/src/providers/ipqualityscore/executors.ts :5 import { isIP } from "node:net";
  • net oomol-lab-open-connector-8066634/src/providers/leadboxer/runtime.ts :3 import { isIP } from "node:net";
  • net oomol-lab-open-connector-8066634/src/providers/provider-runtime.ts :193 /** Deployment-gated private-network opt-in applied to this provider's egress fetch (currently Dokploy). */
  • net oomol-lab-open-connector-8066634/src/providers/sunsama_mcp/official-actions.ts :1593 description: "The page number to fetch (0-based)",
  • net (weak) oomol-lab-open-connector-8066634/src/server/api/action-markdown.test.ts :30 expect(markdown).toContain('fetch("https://connector.example.com/v1/actions/github.delete_repository"');
  • net oomol-lab-open-connector-8066634/src/server/api/action-markdown.ts :112 `const response = await fetch(${JSON.stringify(endpoint)}, {`,
  • net (weak) oomol-lab-open-connector-8066634/src/server/api/runtime-jwt.test.ts :1 import type { Server } from "node:http";
  • net (weak) oomol-lab-open-connector-8066634/src/server/cloudflare.test.ts :38 async fetch(request) {
  • net oomol-lab-open-connector-8066634/src/server/cloudflare.ts :39 async fetch(request: Request, env: CloudflareEnv, _ctx: CloudflareExecutionContext): Promise<Response> {
  • net (weak) oomol-lab-open-connector-8066634/src/server/cloudflare/catalog-assets.test.ts :164 async fetch(request) {
  • net oomol-lab-open-connector-8066634/src/server/cloudflare/catalog-assets.ts :113 return assets.fetch(
  • net oomol-lab-open-connector-8066634/src/server/cloudflare/cloudflare-bindings.ts :31 fetch(request: Request): Promise<Response>;
  • net (weak) oomol-lab-open-connector-8066634/src/server/connect-server.test.ts :1014 const responsePromise = app.fetch(request);
  • net (weak) oomol-lab-open-connector-8066634/src/server/connector-runtime.test.ts :34 expect((await runtime.fetch(new Request("https://host.example/unrelated"))).status).toBe(404);
  • net oomol-lab-open-connector-8066634/src/server/connector-runtime.ts :104 fetch(request: Request): Promise<Response>;
  • net oomol-lab-open-connector-8066634/src/server/index.ts :105 const response = await runtime.fetch(context.req.raw);
  • net oomol-lab-open-connector-8066634/web/provider-icons-plugin.ts :42 const response = await fetch(catalogUrl);
  • net oomol-lab-open-connector-8066634/web/src/actions-page.tsx :442 const response = await fetch(`/v1/actions/${props.action.id}`, {
  • net oomol-lab-open-connector-8066634/web/src/api.ts :36 return readJson<T>(await fetch(path, { credentials: "same-origin", ...init }));
  • net oomol-lab-open-connector-8066634/web/src/default-marketplace-discovery.ts :11 const response = await fetch(url, {
  • net (weak) oomol-lab-open-connector-8066634/web/src/model.test.ts :37 expect(examples.typescript).toContain('fetch("https://connector.example.com/v1/actions/github.get_current_user"');
  • net oomol-lab-open-connector-8066634/web/src/model.ts :510 `const response = await fetch(${JSON.stringify(endpoint)}, {`,

secrets 11

  • secrets (weak) oomol-lab-open-connector-8066634/examples/homebox-live-check.ts :19 const apiKey = process.env.HOMEBOX_API_KEY?.trim();
  • secrets (weak) oomol-lab-open-connector-8066634/examples/local-http/app_store_connect.ts :21 const privateKey = privateKeyPath ? readFileSync(privateKeyPath, "utf8") : process.env.APP_STORE_CONNECT_PRIVATE_KEY;
  • secrets (weak) oomol-lab-open-connector-8066634/examples/local-http/browser_use.ts :18 if (!process.env.OOMOL_CONNECT_RUNTIME_TOKEN || !connectionName) {
  • secrets (weak) oomol-lab-open-connector-8066634/examples/local-http/client.ts :2 return bearerHeaders(process.env.OOMOL_CONNECT_ADMIN_TOKEN, headers);
  • secrets (weak) oomol-lab-open-connector-8066634/examples/local-http/github.ts :5 const token = process.env.GITHUB_TOKEN;
  • secrets (weak) oomol-lab-open-connector-8066634/examples/local-http/gmail.ts :7 const clientSecret = process.env.GMAIL_CLIENT_SECRET;
  • secrets (weak) oomol-lab-open-connector-8066634/examples/local-http/notion.ts :6 const token = process.env.NOTION_TOKEN;
  • secrets (weak) oomol-lab-open-connector-8066634/examples/openai-tools/run-hackernews.ts :40 const apiKey = process.env.OPENAI_API_KEY;
  • secrets (weak) oomol-lab-open-connector-8066634/scripts/runtime-data.ts :28 const nextEncryptionKey = process.env.OOMOL_CONNECT_NEW_ENCRYPTION_KEY;
  • secrets oomol-lab-open-connector-8066634/src/providers/crossref/runtime.ts :375 const secret = process.env.OOMOL_CONNECT_ENCRYPTION_KEY?.trim();
  • secrets oomol-lab-open-connector-8066634/src/server/index.ts :67 encryptionKey: process.env.OOMOL_CONNECT_ENCRYPTION_KEY,

database 4

  • db (weak) oomol-lab-open-connector-8066634/src/server/storage/postgres-integration.test.ts :2 import { Pool } from "pg";
  • db oomol-lab-open-connector-8066634/src/server/storage/postgres-migrations.ts :3 import type { Pool, PoolClient } from "pg";
  • db (weak) oomol-lab-open-connector-8066634/src/server/storage/postgres-runtime-store.test.ts :6 import { Pool } from "pg";
  • db oomol-lab-open-connector-8066634/src/server/storage/postgres-runtime-store.ts :24 import type { PoolClient } from "pg";

tool registrations 5

  • list_apps oomol-lab-open-connector-8066634/src/mcp.ts :150
  • list_connections oomol-lab-open-connector-8066634/src/mcp.ts :154
  • search_actions oomol-lab-open-connector-8066634/src/mcp.ts :158
  • get_action_guide oomol-lab-open-connector-8066634/src/mcp.ts :162
  • execute_action oomol-lab-open-connector-8066634/src/mcp.ts :166

install hooks 1

  • postinstall oomol-lab-open-connector-8066634/package.json :10 node scripts/ensure-generated.ts

declared dependencies 44

  • @modelcontextprotocol/client@^2.0.0
  • @modelcontextprotocol/server@^2.0.0
  • @aws-sdk/client-s3@^3.1111.0
  • @cfworker/json-schema@^4.1.1
  • @hono/node-server@^2.0.10
  • @scalar/hono-api-reference@^0.11.7
  • ali-oss@^6.23.0
  • busboy@^1.6.0
  • fast-xml-builder@^1.3.0
  • fast-xml-parser@^5.10.1
  • fast-xml-validator@^1.4.1
  • hono@^4.13.5
show 28 more
  • imapflow@^1.7.8
  • jose@^6.2.3
  • mailparser@^3.9.28
  • mdast-util-from-markdown@^2.0.3
  • mdast-util-gfm@^3.1.0
  • mdast-util-to-markdown@^2.1.2
  • micromark-extension-gfm@^3.0.0
  • minisearch@^7.2.0
  • mqtt@^5.15.2
  • nodemailer@^9.1.1
  • pg@^8.23.0
  • pino@^10.3.1
  • rss-parser@^3.13.0
  • yaml@^2.9.0
  • zod@^4.4.3
  • @electric-sql/pglite@^0.5.5
  • @electric-sql/pglite-socket@^0.2.8
  • @hyrious/configs@^0.1.6
  • @types/ali-oss@^6.23.3
  • @types/bun@1.4.0
  • @types/busboy@^1.5.4
  • @types/mailparser@^3.4.6
  • @types/mdast@^4.0.4
  • @types/node@^26.0.1
  • @types/nodemailer@^8.0.1
  • @types/pg@^8.23.1
  • oxfmt@^0.56.0
  • oxlint@^1.71.0

4 more not shown — this panel samples each group; the count above is the real total.

obfuscation 1

  • dynamic require()/import() oomol-lab-open-connector-8066634/scripts/provider-source.ts :23 const module = (await import(`../src/providers/${service}/definition.ts`)) as ProviderDefinitionModule;