Open Mercato AI Agent

by open-mercato• 1.9k•• Scanned•Claim this listing•Request removal
Coding Agentsadmin panelagenticai agentsai codingcrm

The AI-Engineering Foundation Framework for business apps: open-source TypeScript, with multi-tenancy, RBAC, events and domain modules already decided as conventions and specs, so Cursor, Claude Code and Codex build features instead of re-deciding architecture. Start with 80% done.

Open Mercato is an open-source ai agent by open-mercato, written mainly in TypeScript, with 1,895 GitHub stars and the MIT license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit c0ee1c7. Seen able to run dynamic code, read environment and secrets, connect to the internet. Scan policy

aboutREADMEsecurityreviews
Scanned
Full scan at c0ee1c7 · Nov 5, 2026
Scanned
Static code scanwarn
Secrets scanfail
Dependency audit24 known vulnerabilitiespass
Manifestnonewarn
Buildfail
Boot & handshaken/a
Network egressn/a
Reproducible (×3)n/a

Findings (139)

  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • medium
    Contacts a hard-coded IP address instead of a domain name.
    packages/create-app/agentic/shared/ai/harness/writable-behavior-oracles.mjs:324
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    packages/starter/src/certs.mjs:113
  • medium
    Very long encoded string literal. Often used to hide a payload.
    packages/ui/src/assets/source-icons.generated.ts:3325
  • medium
    Very long encoded string literal. Often used to hide a payload.
    packages/ui/src/assets/source-icons.generated.ts:3325
  • medium
    Very long encoded string literal. Often used to hide a payload.
    packages/ui/src/assets/source-icons.generated.ts:3325
  • medium
    Very long encoded string literal. Often used to hide a payload.
    packages/ui/src/assets/source-icons.generated.ts:3325
  • medium
    Very long encoded string literal. Often used to hide a payload.
    packages/ui/src/assets/source-icons.generated.ts:3325
  • medium
    Install or build failed in a clean environment
    irements for details. ➤ YN0000: └ Completed ➤ YN0000: ┌ Fetch step ➤ YN0000: └ Completed in 1s 211ms ➤ YN0000: ┌ Link step ➤ YN0001: │ Error: EPERM: operation not permitted, chmod '/w/node_modules/@open-mercato/cli/bin/mercato' ➤ YN0000: └ Completed in 1m 15s ➤ YN0000: · Failed with errors in 1m 17s
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/ai-assistant/src/modules/ai_assistant/lib/__tests__/mcp-server-config-hardening.test.ts:42
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/ai-assistant/src/modules/ai_assistant/lib/__tests__/mcp-server-config-hardening.test.ts:61
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/ai-assistant/src/modules/ai_assistant/lib/__tests__/mcp-server-config-hardening.test.ts:71
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/ai-assistant/src/modules/ai_assistant/lib/__tests__/mcp-server-config-hardening.test.ts:122
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/carrier-inpost/src/modules/carrier_inpost/__tests__/client.test.ts:25
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/core/src/modules/workflows/lib/__tests__/activity-executor.test.ts:1135
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/core/src/modules/workflows/lib/__tests__/activity-executor.test.ts:1185
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/core/src/modules/workflows/lib/__tests__/activity-executor.test.ts:1186
  • low
    In tests/examples/docs: Sends data to a paste site, webhook catcher or chat webhook — common exfiltration channels.
    packages/core/src/modules/workflows/lib/__tests__/activity-executor.test.ts:1203
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/core/src/modules/workflows/lib/__tests__/activity-executor.test.ts:1204
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/core/src/modules/workflows/lib/__tests__/activity-executor.test.ts:1205
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/core/src/modules/workflows/lib/__tests__/activity-executor.test.ts:1678
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    packages/create-app/src/lib/agent-harness-example-read-policy.test.ts:655
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    packages/create-app/src/lib/agent-harness-example-read-policy.test.ts:1051
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    packages/create-app/src/lib/agent-harness-example-read-policy.test.ts:1519
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    packages/create-app/src/lib/agent-harness-example-read-policy.test.ts:1586
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    packages/create-app/src/lib/agent-harness-release.test.ts:411
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    packages/create-app/src/lib/agent-harness-release.test.ts:411
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    packages/create-app/src/lib/agent-harness-release.test.ts:411
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    packages/create-app/src/lib/agent-harness-release.test.ts:412
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    packages/create-app/src/lib/agent-harness-release.test.ts:412
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/create-app/src/lib/agent-harness-release.test.ts:1292
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    packages/create-app/src/lib/application-csp.test.ts:27
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/enterprise/src/modules/sso/lib/__tests__/oidc-url-safety.test.ts:28
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/search/src/__tests__/embedding.test.ts:126
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/search/src/modules/search/api/embeddings/__tests__/route.ollama-base-url.test.ts:105
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/search/src/vector/lib/__tests__/ollama-url-safety.test.ts:80
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/search/src/vector/lib/__tests__/ollama-url-safety.test.ts:290
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/shared/src/lib/__tests__/url-safety.test.ts:68
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/shared/src/lib/__tests__/url-safety.test.ts:158
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/shared/src/lib/__tests__/url-safety.test.ts:198
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/shared/src/lib/__tests__/url-safety.test.ts:259
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/storage-s3/src/modules/storage_s3/__tests__/health.test.ts:30
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/storage-s3/src/modules/storage_s3/__tests__/s3Driver.test.ts:119
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/sync-akeneo/src/modules/sync_akeneo/__tests__/client.test.ts:39
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/tillio/src/modules/tillio/__tests__/client.test.ts:84
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/tillio/src/modules/tillio/__tests__/client.test.ts:131
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/tillio/src/modules/tillio/__tests__/url-guard.test.ts:8
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/tillio/src/modules/tillio/__tests__/url-guard.test.ts:38
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    packages/ui/src/theme/__tests__/theme-init-script.test.ts:17
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/web-research-browser/src/__tests__/launchWiring.test.ts:15
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/web-research-browser/src/__tests__/navigationGuard.test.ts:13
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/web-research-browser/src/__tests__/navigationGuard.test.ts:14
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/web-research-browser/src/__tests__/navigationGuard.test.ts:105
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/web-research/src/net/__tests__/client.test.ts:251
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/web-research/src/net/__tests__/client.test.ts:263
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/web-research/src/net/__tests__/ssrf.test.ts:238
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/webhooks/src/modules/webhooks/data/__tests__/validators.test.ts:37
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/webhooks/src/modules/webhooks/lib/__tests__/delivery-url-safety.test.ts:72
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/webhooks/src/modules/webhooks/lib/__tests__/url-safety.test.ts:96
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/webhooks/src/modules/webhooks/lib/__tests__/url-safety.test.ts:176
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    scripts/__tests__/ci-merge-coverage.test.mjs:18
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    scripts/__tests__/dev-splash-shared.test.mjs:59
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    scripts/__tests__/preview-workflows.test.mjs:148
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    scripts/__tests__/preview-workflows.test.mjs:152
  • low
    Possible example credential in docs/tests: generic-api-key
    .ai/analysis/forms-integration-test-plan.md:486
  • low
    Possible example credential in docs/tests: generic-api-key
    apps/docs/docs/api/auth.mdx:48
  • low
    Possible example credential in docs/tests: curl-auth-header
    apps/docs/docs/api/business-rules/sets.mdx:21
  • low
    Possible example credential in docs/tests: curl-auth-header
    apps/docs/docs/api/business-rules.mdx:21
  • low
    Possible example credential in docs/tests: curl-auth-header
    apps/docs/docs/api/business-rules/logs.mdx:21
  • low
    Possible example credential in docs/tests: generic-api-key
    apps/docs/docs/cli/api-keys.mdx:41
  • low
    Possible example credential in docs/tests: curl-auth-header
    apps/docs/docs/api/feature-toggles.mdx:24
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    apps/docs/docs/cli/auth-setup.mdx:64
  • low
    Possible example credential in docs/tests: curl-auth-header
    apps/docs/docs/user-guide/workflows/signals.mdx:82
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    .ai/ui-components.md:3383
  • low
    Possible example credential in docs/tests: generic-api-key
    apps/docs/docs/framework/modules/payment-gateways.mdx:178
  • low
    Possible example credential in docs/tests: generic-api-key
    docs/design-system/figma-audit/cryptocurrency-coverage.json:2
  • low
    Possible example credential in docs/tests: generic-api-key
    docs/design-system/figma-audit/foundations-assets.json:2
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/checkout/src/modules/checkout/commands/__tests__/create-transaction-reservation.test.ts:70
  • low
    Possible example credential in docs/tests: generic-api-key
    8 matches in this file
    packages/checkout/src/modules/checkout/api/pay/[slug]/submit/__tests__/route.test.ts:173
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/cli/src/lib/testing/__tests__/integration.test.ts:508
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/core/src/modules/auth/__integration__/TC-AUTH-067-logout-without-access-token.spec.ts:139
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/core/src/modules/auth/api/profile/__tests__/profile-display-name.test.ts:106
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    packages/core/src/modules/business_rules/api/__tests__/openmercato-call-options.route.test.ts:119
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/core/src/modules/business_rules/lib/__tests__/action-executor.test.ts:500
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/core/src/modules/forms/__tests__/audit-format.test.ts:11
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/core/src/modules/inbox_ops/__integration__/TC-INBOX-005.spec.ts:99
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/core/src/modules/integrations/__integration__/TC-INT-009.spec.ts:56
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/core/src/modules/payment_gateways/lib/__tests__/transaction-fields.test.ts:68
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/core/src/modules/push_notifications/lib/__tests__/push-delivery.test.ts:59
  • low
    Possible example credential in docs/tests: generic-api-key
    4 matches in this file
    packages/core/src/modules/translations/lib/__tests__/extract-record-id.test.ts:25
  • low
    Possible example credential in docs/tests: private-key
    packages/create-app/src/lib/framework-context.test.ts:146
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    packages/create-app/src/lib/agent-harness-evaluator.test.ts:1865
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/enterprise/src/modules/agent_orchestrator/lib/webSearch/__tests__/secretStorage.test.ts:39
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/enterprise/src/modules/sso/lib/__tests__/state-cookie.test.ts:9
  • low
    Possible example credential in docs/tests: stripe-access-token
    packages/gateway-stripe/src/modules/gateway_stripe/__integration__/TC-STRIPE-001.spec.ts:214
  • low
    Possible example credential in docs/tests: stripe-access-token
    packages/shared/src/lib/auth/__tests__/apiKeyAuthCache.test.ts:121
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    packages/webhooks/src/modules/webhooks/api/webhooks/[id]/__tests__/credential-headers.test.ts:27
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/web-research-browser/src/__tests__/egressProxy.test.ts:334
  • low
    Possible example credential in docs/tests: stripe-access-token
    scripts/__tests__/dev-runtime-state.test.mjs:45
  • low
    @hono/node-server@1.19.14: 2 known vulnerabilities
    GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f
    yarn.lock
  • low
    @humanfs/node@0.16.7: 1 known vulnerability
    GHSA-p498-v437-472g
    yarn.lock
  • low
    deepmerge@4.3.1: 1 known vulnerability
    GHSA-gcqx-w48m-w2h4
    yarn.lock
  • low
    fast-uri@3.1.7: 5 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-hrr3-gc8f-f4qj, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h
    yarn.lock
  • low
    glob@10.5.0: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    yarn.lock
  • low
    glob@11.1.0: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    yarn.lock
  • low
    glob@13.0.0: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    yarn.lock
  • low
    glob@13.0.6: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    yarn.lock
  • low
    katex@0.16.47: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    yarn.lock
  • low
    minimatch@10.2.3: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    yarn.lock
  • low
    moment@2.30.1: 1 known vulnerability
    GHSA-4p3w-j4w9-5jqw
    yarn.lock
  • low
    postcss@8.5.22: 1 known vulnerability
    GHSA-fxqj-rqcc-2cmp
    yarn.lock
  • low
    postcss-selector-parser@7.1.1: 2 known vulnerabilities
    GHSA-rj75-hqrm-r3gf, GHSA-w9m9-85wc-3x92
    yarn.lock
  • low
    protobufjs@7.6.4: 1 known vulnerability
    GHSA-j3f2-48v5-ccww
    yarn.lock
  • low
    qs@6.15.2: 3 known vulnerabilities
    GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx
    yarn.lock
  • low
    serialize-javascript@7.0.5: 1 known vulnerability
    GHSA-m5mm-p8h7-m29v
    yarn.lock
  • low
    package.json has a postinstall script
    node scripts/official-modules-setup.mjs && husky
    package.json
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
registry.npmjs.orgrepo.yarnpkg.com
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Open Mercato alternatives

View more →

Similar ai agents in Coding Agents, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Open Mercato (this page)
open-mercato
1.9kMITNov 1, 2026Scanned, no flagged issues
AutoGPT
Significant-Gravitas
188kNone foundNov 1, 2026Not scanned yet
Langchain
langchain-ai
149kMITNov 1, 2026Scanned, no flagged issues
Gemini CLI
google-gemini
109kApache-2.0Nov 1, 2026Scanned, no flagged issues
MetaGPT
FoundationAgents
71kMITJan 21, 2026Scanned, no flagged issues
Oh My Openagent
code-yeongyu
71kNone foundNov 1, 2026Not scanned yet