Open-source auth gateway connecting 1000+ SaaS providers to AI agents through SDK, CLI, MCP, HTTP, and OpenAPI.
C elevated
- capability exposure inferred + 35
- recent drift inferred + 12
- tool safety inferred + 12
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 57s ago · see ecosystem CVEs →
- C · 44 → C · 56
- C · 56 → C · 44
- B · 32 → C · 56
- C · 35 → B · 32
Inferred surface — each links to servers holding it:
No known CVEs for this server.
- high dangerous code
obfuscated payload: dynamic require()/import()
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit e86860c · analyzer v28 · 2d ago
skills & prompt files 2
danger signals44
- suspicious endpoint 169.254.169.254 (cloud metadata) oomol-lab-open-connector-e86860c/src/core/guarded-fetch.test.ts :70
"http://169.254.169.254/latest/meta-data/", - suspicious endpoint 93.184.216.34 oomol-lab-open-connector-e86860c/src/core/guarded-fetch.test.ts :369
await guarded("https://93.184.216.34/"); - suspicious endpoint 100.100.100.200 (cloud metadata) oomol-lab-open-connector-e86860c/src/core/request.test.ts :74
"http://100.100.100.200/", - suspicious endpoint 169.254.169.254 (cloud metadata) oomol-lab-open-connector-e86860c/src/core/request.test.ts :75
"http://169.254.169.254/", - suspicious endpoint eu.posthog.com (telemetry) oomol-lab-open-connector-e86860c/src/oauth/oauth-flow-service.test.ts :434
posthog_base_url: "https://eu.posthog.com", - suspicious endpoint amplitude.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/amplitude/definition.ts :18
"Amplitude project Secret Key used as the Basic Auth password for Dashboard REST API requests. Find it in Amplitude Settings > Projects > General > Secret Key: https://amplitude.com/docs/apis/authenti - suspicious endpoint amplitude.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/amplitude/runtime.ts :14
export const amplitudeApiBaseUrl = "https://amplitude.com"; - suspicious endpoint analytics.eu.amplitude.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/amplitude/runtime.ts :15
export const amplitudeEuApiBaseUrl = "https://analytics.eu.amplitude.com"; - suspicious endpoint app.bugsnag.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/bugsnag/definition.ts :18
"Bugsnag personal auth token sent with the Authorization header using the token prefix. Find it on your Bugsnag project overview page after signing in: https://app.bugsnag.com/.", - suspicious endpoint www.bugsnag.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/bugsnag/definition.ts :22
homepageUrl: "https://www.bugsnag.com", - suspicious endpoint api.bugsnag.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/bugsnag/runtime.ts :13
export const bugsnagApiBaseUrl: string = "https://api.bugsnag.com"; - suspicious endpoint docs.datadoghq.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/datadog/definition.ts :21
"Datadog API key used for API requests. Create or view API keys in Organization Settings: https://docs.datadoghq.com/account_management/api-app-keys/", - suspicious endpoint www.datadoghq.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/datadog/definition.ts :45
homepageUrl: "https://www.datadoghq.com/", - suspicious endpoint docs.datadoghq.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/datadog/executors.ts :26
const datadogCredentialHelpUrl = "https://docs.datadoghq.com/account_management/api-app-keys/"; - suspicious endpoint api.datadoghq.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/datadog/executors.ts :28
us1: "https://api.datadoghq.com", - suspicious endpoint api.us3.datadoghq.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/datadog/executors.ts :29
us3: "https://api.us3.datadoghq.com", - suspicious endpoint api.us5.datadoghq.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/datadog/executors.ts :30
us5: "https://api.us5.datadoghq.com", - suspicious endpoint api.datadoghq.eu (telemetry) oomol-lab-open-connector-e86860c/src/providers/datadog/executors.ts :31
eu: "https://api.datadoghq.eu", - suspicious endpoint api.ap1.datadoghq.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/datadog/executors.ts :32
ap1: "https://api.ap1.datadoghq.com", - suspicious endpoint api.ap2.datadoghq.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/datadog/executors.ts :33
ap2: "https://api.ap2.datadoghq.com", - suspicious endpoint analytics.google.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/google_analytics/definition.ts :29
homepageUrl: "https://analytics.google.com", - suspicious endpoint developer.mixpanel.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/mixpanel/definition.ts :18
"Mixpanel service account secret used with HTTP Basic authentication for project-scoped query APIs. Create it from Mixpanel Service Accounts: https://developer.mixpanel.com/reference/service-accounts- - suspicious endpoint mixpanel.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/mixpanel/definition.ts :46
placeholder: "https://mixpanel.com", - suspicious endpoint data.mixpanel.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/mixpanel/definition.ts :55
placeholder: "https://data.mixpanel.com", - suspicious endpoint mixpanel.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/mixpanel/executors.ts :32
const mixpanelDefaultBaseUrl = "https://mixpanel.com"; - suspicious endpoint data.mixpanel.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/mixpanel/executors.ts :33
const mixpanelDefaultExportBaseUrl = "https://data.mixpanel.com"; - suspicious endpoint oauth.posthog.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/posthog/definition.ts :15
authorizationUrl: "https://oauth.posthog.com/oauth/authorize/", - suspicious endpoint us.posthog.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/posthog/definition.ts :59
"PostHog personal API key used with the Authorization Bearer header. Create or manage it at https://us.posthog.com/settings/user-api-keys or https://eu.posthog.com/settings/user-api-keys.", - suspicious endpoint posthog.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/posthog/definition.ts :74
homepageUrl: "https://posthog.com", - suspicious endpoint us.posthog.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/posthog/executors.ts :64
baseUrl: optionalString(input.metadata.posthog_base_url) ?? "https://us.posthog.com", - suspicious endpoint 169.254.169.254 (cloud metadata) oomol-lab-open-connector-e86860c/src/providers/provider-runtime.test.ts :103
new Response(null, { status: 302, headers: { location: "http://169.254.169.254/latest/meta-data/" } }), - suspicious endpoint segment.com (telemetry) oomol-lab-open-connector-e86860c/src/providers/segment/definition.ts :18
"Segment source write key sent as the writeKey JSON body field. Open the Segment app, select a source, then copy its write key from the source settings: https://segment.com/docs/connections/find-write - suspicious endpoint api.segment.io (telemetry) oomol-lab-open-connector-e86860c/src/providers/segment/executors.ts :25
const segmentApiBaseUrl = "https://api.segment.io/v1"; - suspicious endpoint sentry.io (telemetry) oomol-lab-open-connector-e86860c/src/providers/sentry/definition.ts :19
authorizationUrl: "https://sentry.io/oauth/authorize/", - suspicious endpoint sentry.io (telemetry) oomol-lab-open-connector-e86860c/src/providers/sentry/runtime.ts :8
export const sentryApiBaseUrl: string = "https://sentry.io/api/0/"; - suspicious endpoint api.telegram.org oomol-lab-open-connector-e86860c/src/providers/telegram/executors.ts :20
const telegramApiBaseUrl = "https://api.telegram.org"; - suspicious endpoint analytics.google.com (telemetry) oomol-lab-open-connector-e86860c/web/src/shared-ui.test.ts :24
homepageUrl: "https://analytics.google.com", - over-broad OAuth scope delete_repo oomol-lab-open-connector-e86860c/src/providers/databricks/actions.ts :390
"delete_repo", - over-broad OAuth scope gmail.modify oomol-lab-open-connector-e86860c/src/providers/gmail/scopes.ts :2
export const gmailModifyScope = "https://www.googleapis.com/auth/gmail.modify"; - over-broad OAuth scope https://www.googleapis.com/auth/documents oomol-lab-open-connector-e86860c/src/providers/googledocs/scopes.ts :2
export const googleDocsWriteScope = "https://www.googleapis.com/auth/documents"; - over-broad OAuth scope https://www.googleapis.com/auth/drive oomol-lab-open-connector-e86860c/src/providers/googledrive/scopes.ts :3
export const googleDriveFullScope = "https://www.googleapis.com/auth/drive"; - over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets oomol-lab-open-connector-e86860c/src/providers/googlesheets/scopes.ts :2
export const googleSheetsFullScope = "https://www.googleapis.com/auth/spreadsheets"; - over-broad OAuth scope https://www.googleapis.com/auth/drive oomol-lab-open-connector-e86860c/src/providers/googlesheets/scopes.ts :4
export const googleDriveFullScope = "https://www.googleapis.com/auth/drive"; - over-broad OAuth scope https://www.googleapis.com/auth/drive oomol-lab-open-connector-e86860c/src/providers/googleslides/scopes.ts :4
export const googleDriveFullScope = "https://www.googleapis.com/auth/drive";
- recent drift +12 capability drift →
[](https://mcpobservatory.com/servers/github:oomol-lab/open-connector/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of oomol-lab.