OpenMolt — Programmatic AI Agents in Node.js

TL;DR

TL;DR: OpenMolt is an MIT-licensed Node.js framework for building AI agents that think, plan, and act using any LLM, 30+ built-in integrations, and a scope-gated security model.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: openmolt.dev — verified via direct visit
• Source repository: github.com/ybouane/openmolt.dev — README read in full
• License: MIT (verified via LICENSE file in repo)
• HN launch thread: not available (Show HN pattern not detected in repo README)

What Is OpenMolt?

OpenMolt is a TypeScript-first framework for Node.js that lets you create autonomous AI agents powered by a self-directed reasoning loop called the Maestro loop. Agents loop through thinking, planning, and acting steps until a task is complete — calling real APIs, reading files, sending messages, and more — all driven by any LLM you choose.

The key differentiator is its security-by-design architecture: credentials never reach the LLM, integrations are scope-gated, and the filesystem integration is directory-restricted by default.

import OpenMolt from 'openmolt';

const om = new OpenMolt({
  llmProviders: {
    openai: { apiKey: process.env.OPENMOLT_OPENAI_API_KEY },
  },
});

const agent = om.createAgent({
  name: 'Comedian',
  model: 'openai:gpt-4o-mini',
  instructions: 'You are a witty stand-up comedian.',
});

const result = await agent.run('Tell me a joke!');
console.log(result);

Setup Workflow

Step 1: Install

npm install openmolt

Step 2: Configure environment variables

OpenMolt uses environment variables for provider credentials. The README documents these as standard PROVIDER_API_KEY namespaced variables:

# Required for your chosen provider
OPENMOLT_OPENAI_API_KEY=sk-...
# or
OPENMOLT_ANTHROPIC_API_KEY=sk-ant-...
# or
OPENMOLT_GOOGLE_API_KEY=AIza ...

Step 3: Create an agent

import OpenMolt from 'openmolt';

const om = new OpenMolt({
  llmProviders: {
    openai: { apiKey: process.env.OPENMOLT_OPENAI_API_KEY },
  },
});

const agent = om.createAgent({
  name: 'EmailAssistant',
  model: 'openai:gpt-4o',
  instructions: 'You manage my inbox professionally.',
  integrations: [
    {
      integration: 'gmail',
      credential: { type: 'oauth2', config: { ... } },
      scopes: ['read'],  // read-only access
    },
  ],
});

const result = await agent.run('Summarize my unread emails from today.');

Step 4: Run the agent

npx openmolt agent.json

Agents can also be run programmatically via agent.run() or scheduled on an interval/cron.

Key Features

Multi-provider LLM support. Connect to OpenAI, Anthropic Claude, and Google Gemini with a unified provider:model string:

model: 'openai:gpt-4o',      // or
model: 'anthropic:claude-3-5-sonnet', // or
model: 'google:gemini-2-0-flash',

30+ built-in integrations. Gmail, Slack, GitHub, Notion, Stripe, Discord, S3, Google Calendar, WhatsApp, Telegram, and more — attached with a single config block.

Declarative HTTP tools. Define custom integrations as data (endpoint URL, auth type, Liquid templates for request bodies) — no boilerplate code required.

Zod-typed output. Pass a Zod schema to agent.run() and get a validated, fully-typed object back.

Memory system. Long-term and short-term stores with onUpdate persistence callbacks for checkpointing and resume.

Observable events. Hook into every tool call, plan update, and LLM output via the events API.

Security Model

OpenMolt’s security architecture has three pillars:

1. Scope-gated integrations. When attaching an integration, you declare explicit scopes. The agent cannot exceed them regardless of what the LLM requests.
2. Credential isolation. API keys, OAuth tokens, and secrets are resolved server-side at execution time. The LLM prompt contains only tool names and schemas — never raw credentials.
3. Directory-restricted filesystem. The FileSystem integration is instantiated with an explicit allowlist of directories. Agents cannot read or write outside those paths.

om.registerIntegration('fileSystem', OpenMolt.FileSystemIntegration('./output'));
// Only ./output is accessible

Practical Evaluation Checklist

• [x] NPM package exists: openmolt on npm
• [x] MIT license verified
• [x] README documents all major features
• [x] Integrations list matches: 30+ built-in (Gmail, Slack, GitHub, Notion, Stripe, Discord, S3, etc.)
• [x] Multi-provider support confirmed (OpenAI, Anthropic, Google Gemini)
• [x] Zod typed output documented
• [x] Security model described (scope-gating, credential isolation, directory restriction)
• [x] CLI runner confirmed: npx openmolt agent.json

FAQ

Q: What LLM providers does OpenMolt support? A: OpenAI, Anthropic Claude, and Google Gemini — configured via a unified provider:model string in the agent config.

Q: How does OpenMolt handle API credentials securely? A: Credentials are stored server-side and resolved at execution time. The LLM prompt contains only tool names and input/output schemas — never raw API keys or OAuth tokens.

Q: Can I add custom integrations beyond the built-in ones? A: Yes. The httpRequest integration lets you define any REST API as a declarative config with Liquid templates for request bodies and OAuth2 or API key authentication.

Q: Is there a hosted or managed option? A: No. OpenMolt is self-hosted only — you run it on your own infrastructure.

Conclusion

OpenMolt fills the gap between lightweight LLM wrappers and full orchestration platforms. Its Node.js/TypeScript foundation, scope-gated security model, and 30+ built-in integrations make it a practical choice for developers who want programmatic AI agents without surrendering credential security to a third-party platform.

License: MIT. Repo at github.com/ybouane/openmolt.dev.