OpenMolt — Programmatic AI Agents in Node.js

TL;DR

TL;DR: OpenMolt is an MIT-licensed Node.js framework for building AI agents that think, plan, and act using any LLM, 30+ built-in integrations, and a scope-gated security model.

Source and Accuracy Notes

• Project page: openmolt.dev — verified via direct visit
• Source repository: github.com/ybouane/openmolt.dev — README read in full
• License: MIT (verified via LICENSE file in repo)
• HN launch thread: not available (Show HN pattern not detected in repo README)

What Is OpenMolt?

OpenMolt is a TypeScript-first framework for Node.js that lets you create autonomous AI agents powered by a self-directed reasoning loop called the Maestro loop. Agents loop through thinking, planning, and acting steps until a task is complete — calling real APIs, reading files, sending messages, and more — all driven by any LLM you choose.

The key differentiator is its security-by-design architecture: credentials never reach the LLM, integrations are scope-gated, and the filesystem integration is directory-restricted by default.

import OpenMolt from 'openmolt';

const om = new OpenMolt({
  llmProviders: {
    openai: { apiKey: process.env.OPENMOLT_OPENAI_API_KEY },
  },
});

const agent = om.createAgent({
  name: 'Comedian',
  model: 'openai:gpt-4o-mini',
  instructions: 'You are a witty stand-up comedian.',
});

const result = await agent.run('Tell me a joke!');
console.log(result);
```bash

## Setup Workflow

### Step 1: Install

```bash
npm install openmolt
```bash

### Step 2: Configure environment variables

OpenMolt uses environment variables for provider credentials. The README documents these as standard `PROVIDER_API_KEY` namespaced variables:

```bash
# Required for your chosen provider
OPENMOLT_OPENAI_API_KEY=sk-...
# or
OPENMOLT_ANTHROPIC_API_KEY=sk-ant-...
# or
OPENMOLT_GOOGLE_API_KEY=AIza ...
```bash

### Step 3: Create an agent

```typescript
import OpenMolt from 'openmolt';

const om = new OpenMolt({
  llmProviders: {
    openai: { apiKey: process.env.OPENMOLT_OPENAI_API_KEY },
  },
});

const agent = om.createAgent({
  name: 'EmailAssistant',
  model: 'openai:gpt-4o',
  instructions: 'You manage my inbox professionally.',
  integrations: [
    {
      integration: 'gmail',
      credential: { type: 'oauth2', config: { ... } },
      scopes: ['read'],  // read-only access
    },
  ],
});

const result = await agent.run('Summarize my unread emails from today.');
```bash

### Step 4: Run the agent

```bash
npx openmolt agent.json
```bash

Agents can also be run programmatically via `agent.run()` or scheduled on an interval/cron.

## Key Features

**Multi-provider LLM support.** Connect to OpenAI, Anthropic Claude, and Google Gemini with a unified `provider:model` string:

```typescript
model: 'openai:gpt-4o',      // or
model: 'anthropic:claude-3-5-sonnet', // or
model: 'google:gemini-2-0-flash',
```bash

**30+ built-in integrations.** Gmail, Slack, GitHub, Notion, Stripe, Discord, S3, Google Calendar, WhatsApp, Telegram, and more — attached with a single config block.

**Declarative HTTP tools.** Define custom integrations as data (endpoint URL, auth type, Liquid templates for request bodies) — no boilerplate code required.

**Zod-typed output.** Pass a Zod schema to `agent.run()` and get a validated, fully-typed object back.

**Memory system.** Long-term and short-term stores with `onUpdate` persistence callbacks for checkpointing and resume.

**Observable events.** Hook into every tool call, plan update, and LLM output via the events API.

## Security Model

OpenMolt's security architecture has three pillars:

1. **Scope-gated integrations.** When attaching an integration, you declare explicit scopes. The agent cannot exceed them regardless of what the LLM requests.
2. **Credential isolation.** API keys, OAuth tokens, and secrets are resolved server-side at execution time. The LLM prompt contains only tool names and schemas — never raw credentials.
3. **Directory-restricted filesystem.** The `FileSystem` integration is instantiated with an explicit allowlist of directories. Agents cannot read or write outside those paths.

```typescript
om.registerIntegration('fileSystem', OpenMolt.FileSystemIntegration('./output'));
// Only ./output is accessible

Practical Evaluation Checklist

• NPM package exists: openmolt on npm
• MIT license verified
• README documents all major features
• Integrations list matches: 30+ built-in (Gmail, Slack, GitHub, Notion, Stripe, Discord, S3, etc.)
• Multi-provider support confirmed (OpenAI, Anthropic, Google Gemini)
• Zod typed output documented
• Security model described (scope-gating, credential isolation, directory restriction)
• CLI runner confirmed: npx openmolt agent.json

FAQ

Q: What LLM providers does OpenMolt support? A: OpenAI, Anthropic Claude, and Google Gemini — configured via a unified provider:model string in the agent config.

Q: How does OpenMolt handle API credentials securely? A: Credentials are stored server-side and resolved at execution time. The LLM prompt contains only tool names and input/output schemas — never raw API keys or OAuth tokens.

Q: Can I add custom integrations beyond the built-in ones? A: Yes. The httpRequest integration lets you define any REST API as a declarative config with Liquid templates for request bodies and OAuth2 or API key authentication.

Q: Is there a hosted or managed option? A: No. OpenMolt is self-hosted only — you run it on your own infrastructure.

Conclusion

OpenMolt fills the gap between lightweight LLM wrappers and full orchestration platforms. Its Node.js/TypeScript foundation, scope-gated security model, and 30+ built-in integrations make it a practical choice for developers who want programmatic AI agents without surrendering credential security to a third-party platform.

License: MIT. Repo at github.com/ybouane/openmolt.dev.