Ogment

Invoke MCP tools via Ogment CLI — secure access to Linear, Notion, Gmail, PostHog, and 100+ SaaS integrations through Ogment's governance layer.

Security Scan

The skill's requirements and instructions align with its stated purpose (wrapping the Ogment CLI to access many SaaS integrations); nothing requested is unexplained or out of scope, though the usual user-consent and token-storage risks of delegating account access apply.

Purpose & Capability

The name/description claim secure access to many SaaS via the Ogment CLI; the skill requires the 'ogment' binary and documents CLI commands (auth, catalog, invoke). That is coherent — the node package @ogment-ai/cli is the expected install path to provide the 'ogment' binary and jq is a reasonable optional helper.

Instruction Scope

SKILL.md only instructs use of the Ogment CLI (auth flow, catalog, invoke) and does not ask to read unrelated files or environment variables. It does instruct the agent to extract a verificationUri and 'send it to your human as a clickable link' — expected for a device/browser-based auth flow, but the instructions do not advise inspecting requested scopes/permissions before approving.

Install Mechanism

Install spec uses an npm package (@ogment-ai/cli) to create the 'ogment' binary and Homebrew to install jq. This is a standard pattern; it is not an arbitrary URL download or archive extraction. The npm install step is the primary non-trivial install action (moderate trust required in the package and its publisher).

Credentials

The skill declares no required environment variables or credentials. Authentication is performed via the CLI's interactive/web verification flow (the user must approve). This is proportionate, but note that the auth flow will produce tokens/credentials stored by the CLI, enabling access to Gmail/Notion/etc. — a legitimate capability but sensitive.

Persistence & Privilege

The skill does not request always:true, does not require config paths, and does not modify other skills. Autonomous invocation is allowed by default (platform standard); combined with delegated SaaS access, this increases impact but is expected for an integration skill.

Assessment

This skill simply wraps the Ogment CLI to let the agent call your connected SaaS through Ogment's governance layer — that is coherent with its description. Before installing: (1) verify you trust the npm package @ogment-ai/cli and the ogment.ai homepage; (2) understand the auth flow: you will be asked to approve access via a verification link and that approval grants the CLI tokens that can access Gmail, Notion, Slack, etc.; (3) check what scopes/permissions Ogment requests when you log in and only approve what you accept; (4) be aware the agent can invoke this skill autonomously (platform default), so consider restricting autonomous actions or limiting which accounts/permissions are connected if you want least privilege.

Ogment CLI Skill

Securely invoke MCP tools via the Ogment CLI. Access your connected SaaS tools (Linear, Notion, Gmail, Slack, Supabase, etc.) through Ogment's governance layer.

Quick Start

Step 1: Check Auth

ogment auth status

• If loggedIn: true → skip to Step 3
• If loggedIn: false → continue to Step 2

Step 2: Login (if needed)

ogment auth login

Extract verificationUri from the response and send it to your human as a clickable link:

🔐 Approve Ogment access: 👉 Click to approve

Wait for approval, then verify with ogment auth status.

Step 3: Discover What's Available

ogment catalog
ogment catalog <serverId>

Step 4: Summarize to Your Human

✅ Connected to Ogment! Here's what I can access:

• Gmail: 11 tools (messages, threads, drafts)
• Notion: 5 tools (search, fetch, comments)
• Slack: 7 tools (conversations, users)

What would you like me to help with?

Core Workflow

auth status → catalog → catalog <server> → invoke <server> <tool>

Discover servers

ogment catalog

List tools

ogment catalog <serverId>

Inspect tool schema

ogment catalog <serverId> <toolName>

Invoke a tool

ogment invoke <serverId> <toolName> --input '<json>'

Common Patterns

Gmail (requires userId: "me")

ogment invoke <server> gmail_listMessages --input '{"userId": "me", "maxResults": 10}'
ogment invoke <server> gmail_getMessage --input '{"userId": "me", "messageId": "<id>"}'

Notion

ogment invoke <server> Notion_notion-search --input '{"query": "quarterly review"}'

Supabase

ogment invoke <server> Supabase_execute_sql --input '{"query": "SELECT * FROM users LIMIT 5"}'

Linear

ogment invoke <server> Linear_list_issues --input '{}'