Three primitives cover auth, proxy calls, and TypeScript functions
Nango organizes integration work around 3 pieces. Auth runs embedded authorization flows, stores credentials, and refreshes tokens. Proxy accepts an API request, finds the customer's connection, adds credentials, and handles retries and rate limits. Functions are TypeScript jobs for syncs, actions, webhooks, and triggers. The README lists more than 900 APIs for teams whose integration backlog has outgrown hand-built OAuth callbacks.
Developers can write a TypeScript function or ask the AI builder to generate one, then review and version the result before deployment. The runtime supplies API access, retries, storage, and logs, while the application calls it through SDKs, the HTTP API, or MCP. Teams still own schemas, provider quirks, idempotency, and the business rules around each external action.
Version 0.71.7 puts the full feature set behind paid deployment
The cloud quickstart starts with an account, an integration, one authorized connection, and a secret key. Free self-hosting has a much narrower table: API Auth and Proxy are included, with observability limited to those paths. Syncs, tool calls, webhooks, triggers, prebuilt integrations, MCP, branding controls, RBAC, and MFA sit in Nango Cloud or Enterprise self-hosting.
Nango can expose MCP tools that act on external APIs, and release v0.71.7 added a provider lookup plus agent-session and proxy-tool work. The management MCP server runs inside the main server but requires a dedicated hostname that differs from the public Nango hostname. This also expands the authentication and audit boundary around tools that can write to customer systems.
What happened when we ran it
Our sandbox installed 2,187 npm packages in 61 seconds and consumed 1,848 MB on disk. commit cc64d64 was a 287.4 MB checkout containing 9,553 files and roughly 348,820 lines of source. The monorepo used npm workspaces, had 20 CI workflow files, a Dockerfile, and a tests directory. Our harness found no standard build target, so it skipped the build step rather than claiming a compilation result.
The root test command failed with exit code 1 after 8 seconds. Its tail reports that test:integration exited first. The unit output then names a billing adapter file with 0 tests, while test:cli and test:unit received SIGTERM after the concurrent runner stopped the remaining processes. The captured tail ends around Node's CommonJS loader and does not contain the initiating exception. We can say the suite failed in our container; we cannot say why from this log.
The npm audit found 19 known vulnerabilities, consisting of 18 moderate findings and 1 low finding. There were no critical or high-severity findings in the supplied result. That is better than a dependency tree with urgent advisories, though 2,187 installed packages still create a wide update surface. The lab run did not start provider integrations, complete OAuth, execute a sync, or test the hosted service, so it measures repository setup rather than end-to-end product reliability.
Five Node services make Enterprise self-hosting an operations project
Nango's Enterprise guide lists 5 Node services: Server, Orchestrator, Jobs, Runner, and Persist. Its recommended baseline gives each 1 CPU and 2 GB of RAM, then adds Postgres, Redis, object storage, and Elasticsearch for execution data. Helm is the default deployment route, and managed images follow a 2-month release cadence with occasional hotfixes. This is a platform that needs ownership, monitoring, backups, and upgrade rehearsals.
The security setup deserves its own design review. A base64-encoded 256-bit key encrypts credentials and record data, and Connect UI also requires it. Key rotation is unsupported; changing the key later causes decryption failures. Production deployments should use external Postgres and Redis rather than the bundled local stores. The guide also documents outbound URL controls, internal service authentication, optional mTLS, dashboard access, and callback routing.
Elastic License 2.0 limits hosted-service use
The repository uses Elastic License 2.0. It permits use, modification, and distribution, while forbidding a third party from offering the software as a hosted or managed service that exposes a substantial set of its features. That is different from an OSI-approved permissive license. A SaaS embedding Nango to connect its own users may fit the intended use, but a company reselling the integration platform itself needs a legal review.
Issue 7412 reports a self-hosted runner retaining roughly 40 KB per task and exhausting the V8 heap around 10,000 tasks in the reporter's environment. Issue 7098 documents an OAuth 1 signature mismatch when an object query parameter contains a space. Both include detailed reproductions. They are reasons to test the exact provider mix and sustained task volume before a production cutover.
September 14 activity and 124 open items show a busy project
GitHub recorded 12,020 stars, 124 combined open issues and pull requests, and a last push on September 14, 2026. Release v0.71.7 arrived on September 11 with provider, webhook, audit, agent-session, billing, and security changes. Pull requests were still receiving review on September 14. The combined queue reflects both open work and a steady stream of contributions rather than 124 confirmed bugs.
Nango earns attention when integration infrastructure is already a product problem. The 900+ provider catalog, code-based functions, embedded auth, proxy, and MCP surface can replace several internal systems. Our failed 8-second root test and 1,848 MB install show that source-level ownership is expensive, while the free self-hosted limitations rule out many headline features. Trial the cloud path first unless data location or regulation requires Enterprise self-hosting, and test key recovery, provider failures, and runner endurance before migration.