OpenWork MCP Gateway
OFFICIAL SERVEROne hosted OAuth endpoint for the skills, plugins, workflows and connections an OpenWork org shares
Self-hosted auth gateway that runs prebuilt Actions across 1,000+ SaaS apps over MCP
By OOMOL Lab TypeScript Local · stdio, Streamable HTTP Developer toolsProductivityCommunication
83 popularity score ★ 6.2k ↓ 2.4k/wk
Opens the app, which asks before it adds the server.
claude mcp add --transport http openconnector http://localhost:3000/mcp{
"mcpServers": {
"openconnector": {
"url": "http://localhost:3000/mcp"
}
}
}{
"servers": {
"openconnector": {
"type": "http",
"url": "http://localhost:3000/mcp"
}
}
}[mcp_servers.openconnector]
url = "http://localhost:3000/mcp"gemini mcp add --scope user --transport http openconnector http://localhost:3000/mcpOpens the app, which asks before it adds the server. Then replace each <NAME> in its settings with your value.
claude mcp add openconnector -- docker run -d --name open-connector -p 3000:3000 -v open_connector_data:/app/data -e 'OOMOL_CONNECT_ORIGIN=<OOMOL_CONNECT_ORIGIN>' -e 'OOMOL_CONNECT_ENCRYPTION_KEY=<OOMOL_CONNECT_ENCRYPTION_KEY>' -e 'OOMOL_CONNECT_ADMIN_TOKEN=<OOMOL_CONNECT_ADMIN_TOKEN>' ghcr.io/oomol-lab/open-connector:latest{
"mcpServers": {
"openconnector": {
"command": "docker",
"args": [
"run",
"-d",
"--name",
"open-connector",
"-p",
"3000:3000",
"-v",
"open_connector_data:/app/data",
"-e",
"OOMOL_CONNECT_ORIGIN=<OOMOL_CONNECT_ORIGIN>",
"-e",
"OOMOL_CONNECT_ENCRYPTION_KEY=<OOMOL_CONNECT_ENCRYPTION_KEY>",
"-e",
"OOMOL_CONNECT_ADMIN_TOKEN=<OOMOL_CONNECT_ADMIN_TOKEN>",
"ghcr.io/oomol-lab/open-connector:latest"
]
}
}
}{
"mcpServers": {
"openconnector": {
"command": "docker",
"args": [
"run",
"-d",
"--name",
"open-connector",
"-p",
"3000:3000",
"-v",
"open_connector_data:/app/data",
"-e",
"OOMOL_CONNECT_ORIGIN=<OOMOL_CONNECT_ORIGIN>",
"-e",
"OOMOL_CONNECT_ENCRYPTION_KEY=<OOMOL_CONNECT_ENCRYPTION_KEY>",
"-e",
"OOMOL_CONNECT_ADMIN_TOKEN=<OOMOL_CONNECT_ADMIN_TOKEN>",
"ghcr.io/oomol-lab/open-connector:latest"
]
}
}
}{
"servers": {
"openconnector": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-d",
"--name",
"open-connector",
"-p",
"3000:3000",
"-v",
"open_connector_data:/app/data",
"-e",
"OOMOL_CONNECT_ORIGIN=<OOMOL_CONNECT_ORIGIN>",
"-e",
"OOMOL_CONNECT_ENCRYPTION_KEY=<OOMOL_CONNECT_ENCRYPTION_KEY>",
"-e",
"OOMOL_CONNECT_ADMIN_TOKEN=<OOMOL_CONNECT_ADMIN_TOKEN>",
"ghcr.io/oomol-lab/open-connector:latest"
]
}
}
}[mcp_servers.openconnector]
command = "docker"
args = ["run", "-d", "--name", "open-connector", "-p", "3000:3000", "-v", "open_connector_data:/app/data", "-e", "OOMOL_CONNECT_ORIGIN=<OOMOL_CONNECT_ORIGIN>", "-e", "OOMOL_CONNECT_ENCRYPTION_KEY=<OOMOL_CONNECT_ENCRYPTION_KEY>", "-e", "OOMOL_CONNECT_ADMIN_TOKEN=<OOMOL_CONNECT_ADMIN_TOKEN>", "ghcr.io/oomol-lab/open-connector:latest"]gemini mcp add --scope user openconnector docker -- run -d --name open-connector -p 3000:3000 -v open_connector_data:/app/data -e 'OOMOL_CONNECT_ORIGIN=<OOMOL_CONNECT_ORIGIN>' -e 'OOMOL_CONNECT_ENCRYPTION_KEY=<OOMOL_CONNECT_ENCRYPTION_KEY>' -e 'OOMOL_CONNECT_ADMIN_TOKEN=<OOMOL_CONNECT_ADMIN_TOKEN>' ghcr.io/oomol-lab/open-connector:latestOOMOL_CONNECT_ENCRYPTION_KEY |
Optional: Encrypts stored credentials and OAuth settings; without it they are kept in plaintext. |
|---|---|
OOMOL_CONNECT_ADMIN_TOKEN |
Optional: Bearer token protecting the admin API and web console. |
OOMOL_CONNECT_RUNTIME_TOKEN |
Optional: Bootstrap bearer token MCP and /v1 callers must send. |
OOMOL_CONNECT_ORIGIN |
Optional: Public origin used for OAuth redirect URLs; defaults to http://localhost:<PORT>. |
OOMOL_CONNECT_DATABASE_URL |
Optional: PostgreSQL URL; SQLite in the data directory is used when unset. |
OOMOL_CONNECT_DATA_DIR |
Optional: Directory for the SQLite database and transit files. |
OOMOL_CONNECT_ALLOWED_ACTIONS |
Optional: Comma-separated allowlist of executable Actions, e.g. service.*. |
OOMOL_CONNECT_BLOCKED_ACTIONS |
Optional: Comma-separated denylist of Actions. |
OOMOL_CONNECT_ALLOW_PRIVATE_NETWORK |
Optional: Lets provider connections reach private networks; false by default. |
PORT |
Optional: HTTP port, 3000 by default. |
In a container, a setting goes in with -e NAME=value after docker run.
OpenConnector is a gateway made by OOMOL that sits between an agent and the web services a user already has accounts with. You connect each provider once (GitHub, Gmail, Notion, Slack, BigQuery, Airtable, Supabase and many more) with an API key or an OAuth sign-in, and the gateway stores those credentials and runs prebuilt Actions against the provider on the agent's behalf. The agent never receives the provider secrets, only account labels and the results of each run.
The MCP side is deliberately small. Instead of one tool per Action, it offers five discovery tools: the agent lists apps and connected accounts, searches the Action catalog, reads the guide and input schema for one Action, then executes it, optionally choosing a named connection such as a work account. The same Actions are also reachable over a plain HTTP API, a generated OpenAPI document, a TypeScript SDK and the oo CLI, and a web console handles credentials, runtime tokens, Action debugging and run logs.
You run it yourself from the Docker image, a single-file binary, Node.js from source, a Helm chart or Cloudflare Workers, with SQLite or PostgreSQL for state. OOMOL also sells a hosted version with its own OAuth apps already registered. The npm package of the same name is the embeddable runtime library for a Node.js or Bun application, not a standalone server.
| Runtime | Docker |
|---|
Docker (multi-arch image for amd64 and arm64), or Node.js 22 or newer to run from source. An MCP client that can connect to a remote HTTP server and send an Authorization header. Your own accounts and API keys with each provider you want to use; OAuth providers also need an OAuth app you register with that provider, unless you use OOMOL's paid hosted runtime. PostgreSQL 15+ is optional.
The MCP endpoint accepts stateless POST JSON-RPC only and keeps no GET SSE stream open. MCP execute_action calls take no idempotency key, unlike the HTTP Action endpoint. Self-hosted, you must register your own OAuth apps for OAuth providers. Without OOMOL_CONNECT_ENCRYPTION_KEY, credentials and OAuth settings are stored in plaintext; if the key is lost, encrypted data cannot be recovered. PostgreSQL migrations must be run by hand before starting a version that needs them.
Suits teams building agent products that need many SaaS integrations behind one endpoint, with credentials, scopes and allow/block rules kept on a server they control and an audit log of every run. The five-tool design keeps an agent's tool list short however many providers are connected. It is more setup than a single-purpose server: you run a container, set secrets, and connect each provider yourself. If you only need one service, that service's own MCP server is simpler; if you do not want to register OAuth apps, the docs point to OOMOL's hosted connectors instead.
list_appslist_connectionssearch_actionsget_action_guideexecute_action