Maton AgentSAFE
Connect and automate 150+ apps (Google Workspace, Microsoft 365, GitHub, Notion, Slack, HubSpot, and more) through a unified API.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This repo helps you connect AI agents to Maton, which allows you to connect and automate 150+ apps (Google Workspace, Microsoft 365, GitHub, Notion, Slack, Airtable, HubSpot, and more) through a unified API.
Model Context Protocol (MCP)
Maton hosts a remote MCP server at https://mcp.maton.ai. It supports both OAuth and API key (Authorization: Bearer header) authentication, so you can connect securely from any MCP client.
- Remote (OAuth): point your MCP client at
https://mcp.maton.aiand complete the OAuth flow in the browser. - Local (API key): run the local proxy with
npx -y @maton/mcp --api-key=YOUR_MATON_API_KEY.
See the MCP package for setup instructions, Docker usage, and the full list of tools.
Agent Toolkit
The Maton Agent Toolkit connects popular agent frameworks to the Maton MCP server through function calling. It discovers the tools available on https://mcp.maton.ai and exposes them in each framework's native format.
- TypeScript (
@maton/agent-toolkit) — LangChain, Vercel's AI SDK, OpenAI, MCP. - Python (
maton-agent-toolkit) — OpenAI Agents SDK, LangChain, CrewAI, Strands.
npm install @maton/agent-toolkit # TypeScript uv pip install maton-agent-toolkit # Python
Plugins
We ship plugins for popular agent harnesses that wire up the Maton MCP server for you. Each plugin registers the remote server at https://mcp.maton.ai, so once installed the Maton tools are available and you complete the OAuth flow in your browser on first use.
Claude Code
Add this repo as a plugin marketplace, then install the Maton plugin:
claude plugin marketplace add maton-ai/agent-toolkit claude plugin install maton@maton-plugins
Cursor
- Run
/add-plugin. - Click Browse marketplace.
- Paste the repo link:
https://github.com/maton-ai/agent-toolkit. - Install the
142d73e83c89OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add agent-toolkit --env MATON_API_KEY=${MATON_API_KEY} -- npx -y @maton/[email protected]{
"mcpServers": {
"agent-toolkit": {
"command": "npx",
"args": [
"-y",
"@maton/[email protected]"
],
"env": {
"MATON_API_KEY": "${MATON_API_KEY}"
}
}
}
}Exposed tools (3)
1 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
create_contact | write | Create a CRM contact |
run_action | write | Run a pre-built action |
search_apps | read | Search supported apps |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (12)
tools/modelcontextprotocol/LICENSE
.dxtignore
.node-version
.flake8
cp ../../LICENSE LICENSE
import type {McpTool} from '../../shared/mcp-client';jest.mock('../../shared/mcp-client', () => {const actual = jest.requireActual('../../shared/mcp-client');const {createMatonAgentToolkit} = await import('../../ai-sdk/toolkit');@modelcontextprotocol/sdk, colors, @anthropic-ai/dxt, @eslint/compat, @types/jest, @types/node, @typescript-eslint/eslint-plugin, esbuild
build, twine, flake8, pydantic, pytest, pytest-asyncio, mcp
@modelcontextprotocol/sdk, zod, zod-to-json-schema, @eslint/compat, @eslint/eslintrc, @eslint/js, @types/jest, @types/node
Gates applied: no_behavioural_pass.
142d73e83c89full audit observations/trust-audit/mcp-server/maton-ai__maton-agent.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 142d73e83c89 | SAFE | B | 89 | first audit |
Questions
What is the Maton Agent MCP server?
Connect and automate 150+ apps (Google Workspace, Microsoft 365, GitHub, Notion, Slack, HubSpot, and more) through a unified API.
What tools does Maton Agent expose?
3 in total: 1 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Maton Agent safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Maton Agent need?
It reads MATON_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Maton Agent run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @maton/agent-toolkit at 0.1.1.
How current is this page?
The grade is for one exact copy of the source (142d73e83c89), read on 2026-10-08. The repository is watched and re-audited when it changes.