Self-hosted TypeScript agent runtime with durable approvals and verifiable run records. Own it, approve it, audit it.
# Add to your Claude Code skills
git clone https://github.com/open-multi-agent/open-multi-agentGuides for using ai agents skills like open-multi-agent.
Last scanned: 7/14/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@vitest/coverage-v8: Vulnerability found",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "@vitest/mocker: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Large numeric range defeats documented `max` DoS protection",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express-rate-limit: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-xml-builder: fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes",
"severity": "high"
},
{
"type": "npm-audit",
"message": "form-data: form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono has CSS Declaration Injection via Style Object Values in JSX SSR",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite-node: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vitest: Vulnerability found",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "high"
}
],
"status": "FAILED",
"scannedAt": "2026-07-14T06:10:16.878Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how open-multi-agent compares with popular alternatives.
open-multi-agent is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by open-multi-agent. Self-hosted TypeScript agent runtime with durable approvals and verifiable run records. Own it, approve it, audit it. It has 6,997 GitHub stars.
open-multi-agent failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/open-multi-agent/open-multi-agent" and add it to your Claude Code skills directory (see the Installation section above).
open-multi-agent is primarily written in TypeScript. It is open-source under open-multi-agent on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh open-multi-agent against similar tools.
No comments yet. Be the first to share your thoughts!
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
No telemetry. No hosted control plane. Your keys, your models — cloud, local (Ollama, vLLM, llama-server), or Chinese providers — your environment. Nothing stops working when the people who built it leave.
Requires Node.js 20 or newer. For production, use a currently maintained Node.js LTS release. Node.js 20 is upstream-EOL and retained only as a migration compatibility window; OMA will remove it in the next major release, no earlier than 2026-10-31.
Scaffold a PR review agent, security analysis agent, or teaching DAG:
npm create oma-app@latest my-oma
In an interactive terminal, that one command selects a starter and runtime, installs dependencies, and runs a deterministic local demo. The demo needs no API key and makes no model request: scripted model responses drive the real OMA scheduler, result aggregation, and offline dashboard.
Or add OMA to an existing backend:
npm install @open-multi-agent/core
import { FileStore, OpenMultiAgent } from '@open-multi-agent/core'
// Your keys and your endpoint: a hosted provider, or a local server through baseURL.
const oma = new OpenMultiAgent({
defaultProvider: 'openai',
defaultModel: 'gpt-5.4',
// Consequential tool calls (file writes, shell) pause for a human decision.
onToolCall: ({ consequential }) => (consequential ? { action: 'suspend' } : { action: 'allow' }),
})
const team = oma.createTeam('ops', {
name: 'ops',
agents: [{ name: 'operator', systemPrompt: 'Reconcile overdue invoices.', toolPreset: 'readwrite' }],
})
// The checkpoint store keeps the run and its pending approvals durable.
const result = await oma.runTeam(team, 'Find overdue invoices and draft the reminders.', {
checkpoint: { store: new FileStore('./.oma/run.json') },
})
// result.status?.code === 'suspended' until a reviewer decides result.pendingApprovals,
// each bound to a hash of exactly what the reviewer was shown.
Set OPENAI_API_KEY to run this example. Providers covers other hosted models, local servers, OpenAI-compatible endpoints, and AI SDK providers.
runAgent() runs a single agent, runTasks() executes an explicit pipeline, and runTeam() plans from a goal. The Core package guide walks through all three modes, provider and credential setup, and the production checklist. The example index lists every runnable example across basics, cookbook workflows, patterns, providers, and integrations.
A plan, task dispatch, or tool-call gate can return suspend. The request is stored beside the checkpoint, bound to a SHA-256 hash of exactly what the reviewer saw, and the run resumes from that content after a restart. A decision is atomic and first-wins; a tampered request or a store without compare-and-set fails closed.
approval/durable.ts · durable-approval.test.ts (16 cases) · durable-approval-validation.test.ts (7 cases) · Guide
Attach a journal backend and the run records every block the model saw, every tool call and result, and every context rewrite. verifyRun() reads it back cold, offline, and checks that each block's named source event still reproduces it byte for byte; an evicted window is reported as inconclusive, not as a failure. It proves lineage and content, not that the file was never edited.
journal/verify.ts · journal/hash.ts · verify-run.test.ts (11 cases) · Guide
Declare governanceIntent: 'required' with requiredRoles, and the run is judged on an execution receipt: which roles ran, in what order, with which dependency edges, and whether an independent review happened. The evaluator never sees agent output text, and a run can succeed and still report unsatisfied.
orchestrator/governance.ts · observability/execution-receipt.ts · governance-floor.test.ts (16 cases) · Guide · Receipts
baseURL; any OpenAI-compatible endpoint and Vercel AI SDK providers. Providersoffline or allowlist, checked before a built-in adapter connects. A child policy can only tighten its parent, an unenforceable transport fails closed, and process and ACP backends sit outside it. LLM egress policyopen-multi-agent launched 2026-04-01 under MIT. Known users and integrations to date:
bash, file_*, grep) inside a Docker runtime. Confirmed production use. (~60 stars)Users
defineTool repo-context tools and a custom ContextStrategy for token-aware diff compression.runAgent / runTasks / runTeam with a custom coordinator, paired with DeepSeek.Integrations
runTeam workflow template.runAgent() and runTeam() as Baize slot capabilities.We build customer-owned systems on OMA for organizations that need one. Email jack@yuanasi.com.
Paid sponsors supporting open-multi-agent. Sponsorship does not affec