B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · General
open-multi-agent
Self-hosted TypeScript agent runtime with durable approvals and verifiable run records. Own it, approve it, audit it.
Bottom line: Signal-based grade (5/7 points): very widely starred on GitHub, listed in several sources, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 47/100
- Rank
- Not ranked: outside the 500 most popular tools
- GitHub stars
- 7k
What it does
Open-Multi-Agent is a self-hosted TypeScript runtime for building and running AI agents with built-in durable approval workflows and cryptographically verifiable audit logs. You deploy it on your own infrastructure, control agent execution, and maintain complete records of all runs for compliance and debugging.
Who it’s for
Engineering teams and enterprises that need agent automation with strong governance requirements, audit trails, and the ability to self-host and customize the runtime. Organizations uncomfortable with third-party agent platforms or operating in regulated industries will find the transparency and control appealing.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/open-multi-agent/open-multi-agent (opens external site) for latest instructions. Likely installation via:
npm install @open-multi-agent/core
For Claude Desktop MCP integration, consult the official documentation—the setup pattern typically involves configuring an mcpServers entry pointing to your self-hosted instance.
Risks
- Approval bypass: Durable approvals are only as secure as the authentication and authorization layer; misconfiguration could allow unapproved agent actions.
- Supply chain exposure: Direct TypeScript/npm dependency on a 7k-star but low-adoption project; monitor for unmaintained dependencies or security advisories.
- Self-hosting operational burden: Running your own runtime means you own patching, updates, and infrastructure security—no managed SLA.
- Audit log integrity: Verifiable records are only tamper-evident if crypto implementation and log storage are secure; weak signing or accessible logs undermine trust.
- Credential scope creep: Agents granted broad permissions to external systems (APIs, databases) can exfiltrate data if prompts are manipulated or code is compromised.
How to stay secure
Least-privilege permissions
- Grant agents only the minimum API scopes and database roles needed per workflow; use separate service accounts for each agent rather than shared credentials.
- Implement approval rules that require explicit sign-off for sensitive actions (data export, external API calls, credential updates); enforce MFA on approval accounts.
- Rotate agent credentials monthly and revoke access immediately after task completion; use short-lived tokens (15–60 min) instead of long-lived keys.
- Audit approval logs weekly to detect patterns of consistent approvals from the same user without variation.
Network isolation
- Run open-multi-agent in a private subnet with egress only to whitelisted internal services and approved external APIs; block all other outbound traffic.
- Use a secrets manager (HashiCorp Vault, AWS Secrets Manager) to inject credentials at runtime; never commit secrets to source control or environment files.
- Implement TLS 1.3 for all agent-to-service communication and verify certificate pinning for critical external integrations.
- Restrict SSH/RDP access to the host running the agent runtime to a bastion/jump box with audit logging.
Monitoring
- Log all approval requests, denials, and agent actions with timestamps and user identifiers; centralize logs in an immutable store (S3, syslog server) separate from the runtime.
- Alert on approval denials, failed authentication attempts, and unapproved agent invocations within 5 minutes of occurrence.
- Validate audit log signatures weekly using the crypto keys documented in the open-multi-agent source; flag any signature mismatches immediately.
- Monitor npm/TypeScript dependency advisories daily; automate patching for critical vulnerabilities and require manual review for major version updates.
Red flags to watch for
- Agents requesting broad, vague permissions ("admin," "all APIs") or permissions unrelated to their documented task.
- Approval chains where the same user approves and executes actions, or approvals granted within seconds of request submission.
- Audit logs with gaps, mismatched signatures, or missing entries for actions confirmed in external system logs.
- Dependency updates from open-multi-agent or transitive npm packages not released in 3+ months, or security advisories with no published fix.
Alternatives
- Anthropic Claude with tool use + governance layers – tighter integration with Claude API but less self-hosting control.
- LangChain + custom approval middleware – more flexible but requires building governance from scratch.
- Replit Agent – managed agent runtime with built-in approvals, but less transparency than self-hosted.
- n8n or Zapier – lower-code workflow automation with audit trails, but not AI-agent-native.