# conector

Self-hosted MCP gateway: connect 1,178 apps once and use them from Claude, Codex, Cursor, Gemini CLI, Copilot and 42 more AI agents.

- **Type:** MCP server
- **Trust:** 65/100 (B), scored on the package rubric
- **Verification:** verified (build provenance)
- **Version:** 0.1.6
- **Author:** Secra Solutions
- **License:** MIT
- **npm:** conector
- **Source:** https://github.com/Secra-Solutions/Conector
- **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport)

## Trust

65/100 (B), scored on the package rubric
- Publisher verified: no
- Build provenance: verified attestation
- npm trusted publishing (OIDC): yes
- Install scripts: suspicious script found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 0 days

## Security scan

- **Status:** warnings
- **Scanned:** 2026-10-21T18:34:45.543Z
- **Version scanned:** 0.1.6
- **CVEs:** none found by OSV at scan time
**Findings**
- injection-shaped content (warning) in the `pushover_send` tool: Exfiltration-shaped instruction

## Tools

40 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `openai_generate_image` — Generates images from a description with a GPT Image model and saves them on the server (Conector's
- `elevenlabs_text_to_speech` — Generates the audio of a text with an ElevenLabs voice and saves it on the server (Conector's downloads
- `deepl_translate` — Translates one or more texts with DeepL. Returns, in the same order, each translation and the detected source language.
- `aws_costs` — AWS cost by service and period (Cost Explorer). Each Cost Explorer query costs 0.01 USD.
- `make_scenarios` — List the Make scenarios (most recent first) with their status, schedule and last edit: across all
- `aircall_calls` — Lists the most recent calls: direction, status, duration, line, agent and the other party's number.
- `chatwork_send_message` — Posts a message to a Chatwork room (group, direct chat or “My Chat”).
- `line_send_message` — Sends a text (push) message to a user, group or room that follows the official account. Counts toward the monthly quota.
- `pushbullet_send` — Send a note (or a link) to all your Pushbullet devices, or to just one.
- `pushover_send` — Send a notification to the configured user or group (its key is already stored in Conector).
- `zulip_send_message` — Post a message in a channel (stream) with its topic, or send a direct message to one or more people by email.
- `close_search` — Search leads by text (company, contact, email, phone…) or with Close's search syntax
- `clickhouse_query` — Runs a read-only SQL query (SELECT, SHOW, DESCRIBE, EXPLAIN…) and returns columns and rows.
- `foursquare_search_places` — Searches for places by name, category or type (e.g. “cafe”) near a city or some coordinates.
- `geoapify_geocode` — Converts an address or a place into coordinates: returns the normalized address, latitude, longitude
- `geocodio_geocode` — Converts an address (US, Canada, Mexico or UK) into coordinates, with the normalized address and
- `geokeo_geocode` — Converts an address or a place into coordinates: returns the formatted address, latitude and longitude.
- `here_geocode` — Converts an address or a place into coordinates: returns the normalized address, latitude, longitude
- `tableau_session` — Signs in to Tableau (if needed) and returns the site and user ids (LUID), the site name and the
- `hackernews_front_page` — Returns the first stories of a Hacker News list with title, link, points, comments and author.
- `toggl_hours` — Your time entries between two dates (only the last 3 months; for earlier dates, use the Reports API): start, end,
- `jotform_responses` — Responses (submissions) of a form by submission date: id, date, status and each question with its answer as
- `surveymonkey_responses` — Responses of a survey, from the most recent to the oldest: id, date, status (completed, partial…), email if
- `crisp_conversations` — Chat conversations, paginated: session id, contact (name and email), state (pending, unresolved or
- `freshservice_search` — Filters tickets using Freshservice syntax: status (2 open, 3 pending, 4 resolved, 5 closed), priority (1
- `deel_people` — People in the organization (employees and contractors): id, name, email, job title, country, hiring type,
- `workable_candidates` — Candidates for all jobs or for one, optionally of a stage, by email or created since a date: id,
- `lemonsqueezy_orders` — Orders: id, number, date, customer, email, product, total, status (paid, refunded, partial_refund, pending,
- `quaderno_invoices` — Issued invoices, from the most recent to the oldest: id, number, date, customer, tax ID, country, total, currency, status
- `pennylane_invoices` — Customer invoices (issued) or supplier invoices (received), from the most recent to the oldest: id, number,
- `zohocrm_coql` — Runs a COQL query (Zoho CRM's SQL: select fields from Module where … order by … limit n offset m) and
- `zohocrm_search` — Searches the records of a module (Leads, Contacts, Accounts, Deals…) by criteria ((Field:operator:value), e.g.
- `canva_designs` — Your own designs and those shared with you: by relevance if you search for text and, otherwise, from the most recent to the oldest.
- `canva_export` — Exports a design to PDF, PNG, JPG or PPTX and saves it on the server (Conector's downloads folder); for PNG and JPG,
- `pinterest_pins` — Pins in the account or on a board: id, title, description, destination link, board, date and image. Returns
- `pinterest_analytics` — Account totals between two dates (default: the last 30 days; at most 90 days back): impressions,
- `sesamehr_employees` — Lists employees (active by default): id, name, email, code, phone and current presence (online,
- `sesamehr_work_entries` — Work entries (clock-ins and clock-outs) for the whole company or one employee between two dates: employee, type,
- `signaturit_requests` — Lists signature requests with their documents: request id and date and, per document, id, file, signer and
- `signaturit_download` — Downloads the signed document (or its audit report) of a request as a PDF and saves it on the server

## Install

**Verdict: do-not-install** — Do not install: 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it.
**Blocking**
- 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it. — tool:pushover_send: Exfiltration-shaped instruction
**Client configuration withheld.** Client configs are withheld because this entry has a blocking finding. Show the warnings below to the person installing it.
If they have seen the findings and still want to proceed, request the plan again with acknowledge_warnings=true.

## Blast radius

Moderate blast radius — holds an api key; runs on your machine.
- Floor 23, ceiling 23 (tier: moderate)
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/conector
- Install plan: https://forgeregistry.com/api/v1/packages/conector/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/conector
- HTML page: https://forgeregistry.com/registry/conector
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.