What is OpenConnector?

OpenConnector is an open-source gateway that lets AI agents connect to over 1,500 SaaS providers through a single catalog of more than 10,000 ready-made actions. It works with a variety of credential formats — including API keys, OAuth2, custom credentials, and no-auth providers — keeping provider secrets behind a runtime boundary so agents never see raw tokens. The software exposes actions via MCP (Model Context Protocol), HTTP, and OpenAPI, and includes a web console for browsing providers, configuring credentials, creating runtime tokens, and debugging actions. You can run it yourself with Docker Compose, plain Docker, Node.js, a Helm chart on Kubernetes, or on Cloudflare Workers using D1 and R2. State lives in SQLite by default, with PostgreSQL 15+ as an option, and transit files can stay local or go to any S3-compatible store. OAuth providers require you to register your own OAuth apps when self-hosting; a hosted option with managed OAuth is also available from the vendor.

Should you self-host OpenConnector?

OpenConnector scores 65/100 on selfhost.directory (how scoring works) and ranks #41 of 209 in AI Agents. It has 6 110 GitHub stars.

It shipped 10 stable releases in the past year. The latest, v1.9.4, came out on 27 October 2026. New versions land roughly every 3 days.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is Other-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is Webhook.site (66/100, 6 786 stars). It scores higher overall, so compare the two before you pick. See OpenConnector vs Webhook.site side by side.

Features

Action Allow/Block Policies
Cloudflare Workers deployment
Connector Gateway
Credential encryption
Credential Management
HTTP/OpenAPI Interface
MCP Support
Prebuilt Actions Catalog
Provider Proxy Allow/Block
S3-compatible Transit Storage
Web Console

How to configure OpenConnector

HOST127.0.0.1Bind address
Bind address
OOMOL_CONNECT_ADMIN_TOKENRequires bearer-token auth for local admin API, docs, and web console
Requires bearer-token auth for local admin API, docs, and web console
OOMOL_CONNECT_ALLOWED_ACTIONSComma-separated executable action allowlist. Supports service.* and *
Comma-separated executable action allowlist. Supports service.* and *
OOMOL_CONNECT_ALLOWED_CUSTOM_OAUTHEnables connection-scoped OAuth apps for * or a comma-separated service list
Enables connection-scoped OAuth apps for * or a comma-separated service list
OOMOL_CONNECT_ALLOWED_PROXIESComma-separated provider proxy allowlist. Supports service names and *
Comma-separated provider proxy allowlist. Supports service names and *
OOMOL_CONNECT_BLOCKED_ACTIONSComma-separated executable action denylist. Supports service.* and *
Comma-separated executable action denylist. Supports service.* and *
OOMOL_CONNECT_BLOCKED_PROXIESComma-separated provider proxy denylist. Supports service names and *
Comma-separated provider proxy denylist. Supports service names and *
OOMOL_CONNECT_DATABASE_CONNECT_TIMEOUT_MS10000PostgreSQL connection timeout in milliseconds
PostgreSQL connection timeout in milliseconds
OOMOL_CONNECT_DATABASE_POOL_MAX10Maximum PostgreSQL connections per Node runtime instance
Maximum PostgreSQL connections per Node runtime instance
OOMOL_CONNECT_DATABASE_URLPostgreSQL connection URL
PostgreSQL connection URL
OOMOL_CONNECT_DATA_DIR./dataSQLite database, local transit files, and Node upload staging
SQLite database, local transit files, and Node upload staging
OOMOL_CONNECT_EGRESS_TRUSTED_HOSTSTrusted hosts routed through a corporate VPN
Trusted hosts routed through a corporate VPN
OOMOL_CONNECT_ENCRYPTION_KEYEncrypts credentials, Marketplace API keys, OAuth config, pending OAuth state, and completed idempotent Action responses
Encrypts credentials, Marketplace API keys, OAuth config, pending OAuth state, and completed idempotent Action responses
OOMOL_CONNECT_JWKS_URINode-only JWKS endpoint for validating runtime JWT access tokens
Node-only JWKS endpoint for validating runtime JWT access tokens
OOMOL_CONNECT_JWT_AUDIENCEExpected API aud claim for runtime JWT access tokens
Expected API aud claim for runtime JWT access tokens
OOMOL_CONNECT_JWT_ISSUERExpected iss claim for runtime JWT access tokens
Expected iss claim for runtime JWT access tokens
OOMOL_CONNECT_NEW_ENCRYPTION_KEYNew key used by runtime:data rotate-key
New key used by runtime:data rotate-key
OOMOL_CONNECT_ORIGINhttp://localhost:<PORT>Public origin used for OAuth redirect URLs and Action guide request examples
Public origin used for OAuth redirect URLs and Action guide request examples
OOMOL_CONNECT_RUNTIME_TOKENOptional bootstrap runtime bearer token for /v1 and MCP callers
Optional bootstrap runtime bearer token for /v1 and MCP callers
OOMOL_CONNECT_S3_BUCKETBucket used when the Node transit-file backend is s3
Bucket used when the Node transit-file backend is s3
OOMOL_CONNECT_S3_ENDPOINTAWS S3S3-compatible endpoint for MinIO, Cloudflare R2, Alibaba Cloud OSS, or another object store
S3-compatible endpoint for MinIO, Cloudflare R2, Alibaba Cloud OSS, or another object store
OOMOL_CONNECT_S3_FORCE_PATH_STYLEfalseUse path-style S3 URLs
Use path-style S3 URLs
values: true, false
OOMOL_CONNECT_S3_REGIONus-east-1S3 signing region
S3 signing region
OOMOL_CONNECT_TRANSIT_FILE_BACKENDlocalNode transit-file backend: local or s3
Node transit-file backend: local or s3
values: local, s3
OOMOL_CONNECT_TRANSIT_FILE_MAX_BYTES104857600Maximum transit file upload size
Maximum transit file upload size
OOMOL_CONNECT_TRANSIT_FILE_TTL_SECONDS86400Transit file lifetime before cleanup
Transit file lifetime before cleanup
PORT3000Local HTTP server port
Local HTTP server port

FAQ

What is the difference between a Tool and a Skill? Why does OOMOL manage Skills?

A Tool is a concrete action an agent can call, such as reading a GitHub PR, writing to Google Sheets, or sending a Slack message. A Skill is reusable execution knowledge for an agent: which oo tools to call, how to pass parameters, and how to check results. The agent follows the Skill, while OOMOL provides oo tools plus cross-agent installation, publishing, and sharing.

Which apps and Tools does OOMOL support? What if I need something missing?

OOMOL provides 1500+ connections, including work systems such as Gmail, GitHub, Notion, and Slack, along with image, video, voice, transcription, and file services. Browse the App and Tool catalogs for available actions, or use Studio to connect a private API or custom capability.

How does OOMOL work with the agent I already use?

You can keep starting tasks in the agent you already use. Installing OOMOL App also installs oo CLI, and the App and CLI share the same account data. Any agent environment that can work through a CLI can call the available Tools and Skills.

What data and actions can agents access? Can I view, revoke, or limit them?

An agent's available capabilities come from the connected accounts, authorized scopes, and Tools provided by OOMOL. In OOMOL App, you can review connections, permissions, usage, results, and run records, then adjust access by account or Tool.

Will agents receive my account passwords or raw tokens?

OOMOL manages account authorization and credentials. Agents call third-party services through Tools within the scopes you approve, and each call leaves usage, results, and run records for review.

What does "connect once, use everywhere" mean?

After you connect services such as Gmail, GitHub, Notion, and Slack in OOMOL, agents connected to OOMOL can share those connections. You authorize account-based services first, and the corresponding Tools determine which actions an agent can call.

What does OOMOL enable AI agents to do?

OOMOL connects third-party service accounts, provides callable Tools, and lets Skills be installed, published, and shared across agents. You can keep working in Codex, Claude Code, Cursor, or a local agent.