Twenty adapters. One contract. No pretending.
Every external source is governed through one connector contract and one evidentiary standard. Credentialed adapters require the customer's own credentials and rights, and live certification is per deployment. A catalog label is not a connector.
The registered adapters.
| Adapter | Source class | Credentials | What it returns and its honest limit | Status |
|---|---|---|---|---|
| Public web capture | Direct capture | None | Exact authorized HTTP(S) response with full redirect chain. The only path that makes page content citable. | Proven |
| RSS / Atom | Feed | None | Preserved feed envelope. An entry summary is not a complete article. | Proven |
| Google News RSS | News discovery | None | Aggregator metadata. Intermediary records are never publisher evidence. | Proven |
| GDELT DOC 2.0 | News discovery | None | Bounded article lists. Must pass current live certification before an operational claim. | Qualification target |
| Wikipedia | Reference discovery | None | Search and reference context, not independent primary evidence. | Proven |
| Brave Search API | General web discovery | API key plus stored-result rights reference | Official search candidates. Hard caps on offset and query length. | Implemented, needs configuration |
| YaCy | General web discovery | Self-hosted peer URL | Configured index. Coverage depends on the peer, not a copy of the whole web. | Proven |
| Common Crawl index | Historical web | None | Index metadata. Presence is not archived page content. | Qualification target |
| Wayback availability | Historical web | None | Exact-URL archive lookup with separately authorized replay capture. | Proven |
| Sitemap | Site inventory | None | Published URL inventory. Not authorization to fetch every descendant. | Proven |
| Discourse | Public forum | None | Public latest and top JSON only. | Qualification target |
| Bluesky | Public social | None (official AppView) | Post search from the official public endpoints only. | Proven |
| Mastodon | Public social | Administrator instance allowlist | Per-instance search and tags. Capability and failures reported per instance. | Proven |
| CISA KEV | Structured intelligence | None | Full official catalog sealed before any filtering. | Proven |
| MITRE ATT&CK TAXII 2.1 | Structured intelligence | None | Read-only collections with paging. STIX relationships remain review candidates. | Proven |
| Google Public DNS | Infrastructure | None | Resolver observations, not ownership. | Proven |
| IANA domain RDAP | Infrastructure | None | Bootstrap plus registry response. Registration is not control. | Proven |
| IANA IP/ASN RDAP | Infrastructure | None | Number-resource registration. Allocation is not routing attribution. | Proven |
| RIPEstat | Infrastructure | Usage-authorization reference | Routing context. | Implemented, needs configuration |
| Cert Spotter | Infrastructure | API key plus stored-result rights reference | Certificate-transparency issuances. Certificate presence is not identity. | Implemented, needs configuration |
Upload processing (documents, images, audio, video) is a separate capability and is counted separately from network adapters. GDELT has proven fail-closed behavior but has not yet passed live acceptance. Common Crawl and Discourse await recertification on the current revision.
What every adapter is held to.
- Connectors yield material. They never create facts or graph edges.
- Raw bytes are preserved. Redirects are denied except by the validated capture path, which refuses HTTPS-to-HTTP downgrades.
- A byte ceiling is enforced on declared length and on streamed accumulation. Content type and provider response schema are validated before anything is yielded.
- A missing credential or auditable authorization reference fails closed.
- Public URL handling resolves DNS once, rejects private and mixed answers, and refuses credentials in URLs and non-standard ports.
- Source availability requires both administrator authorization and actual provider health. Completing configuration never auto-enables a source.
Not current adapters.
OMAR does not claim sources it has not registered. These are not adapters today. They may be added as authorized demand and contracts exist, with Reddit and YouTube first.
X · Meta · Telegram · Reddit · YouTube · commercial news, social, and dark-web vendors · Shodan · Censys · VirusTotal · URLScan · passive DNS · Tor onion collection
When an official API or contract is unavailable, OMAR does not fall back to prohibited scraping. It does not rotate proxies to evade anti-bot measures, use leaked databases, impersonate accounts, or interact with targets.