OneCLI is an open-source gateway that injects credentials from a central vault into AI agent HTTP calls, with a Rust gateway, Next.js dashboard, and AES-256-GCM encrypted storage. It supports local single-user mode or Google OAuth for multi-user setups and includes Docker-based local development.
Collecting history — the radar snapshots this repo daily. The trend line appears after 3 days of data (1 so far).
What it is
OneCLI is an open-source gateway that sits between AI agents and the services they call. Credentials are stored in a central vault and injected into outbound requests by the gateway, so agents do not see real secrets. The architecture includes a Rust gateway, a Web Dashboard, and a Secret Store using AES-256-GCM encryption. It supports multiple agents with per-agent access tokens and provides an API for the gateway to resolve credentials.
How it works
Real API credentials are stored in OneCLI. Agents are given placeholder keys (e.g. FAKE_KEY). When the agent makes an HTTP call through the gateway, the gateway matches the request to the right credentials, decrypts them, and injects them into the outbound request as headers or URL parameters. The agent never touches real secrets.
Getting started
Quick start options:
-
curl -fsSL https://onecli.sh/install | sh
-
Or run locally by cloning the repo and starting services with Docker Compose:
git clone https://github.com/onecli/onecli.git cd onecli docker compose -f docker/docker-compose.yml up -d --wait
Open http://localhost:10254 for the dashboard and http://localhost:10255 for the gateway. Local mode is single-user; Google OAuth can be enabled by setting NEXTAUTH_SECRET and Google credentials.
Local development prerequisites include mise, Rust, and Docker, with setup commands:
mise install
pnpm install
cp .env.example .env
pnpm db:generate
pnpm db:up
pnpm db:migrate
pnpm dev
Features
- Transparent credential injection: agents make normal HTTP calls; the gateway handles auth
- Encrypted secret storage: AES-256-GCM encryption at rest, decrypted only at request time
- Host & path matching: route secrets to the right API endpoints with pattern matching
- Multi-agent support: each agent gets its own access token with scoped permissions
- Easy setup: curl install command starts everything (app + PostgreSQL)
- Two auth modes: single-user (no login) for local use, or Google OAuth for teams
- Rust gateway: fast, memory-safe HTTP gateway
- Vault integration: connect Bitwarden (or other password managers) for on-demand credential injection without storing secrets on the server
Project structure
- apps/gateway: Rust gateway (port 10255)
- apps/web: Next.js dashboard (port 10254)
- packages/db: Prisma ORM + migrations
- docker/docker-compose.yml
Recent releases
- v1.45.0 (2026-07-31): features include install page, per-connection resources, approvals bell
- v1.44.0 (2026-07-29): features include agent grants — per-agent credential access replaces the project policy page
- v1.43.3 (2026-07-26): bug fixes related to gateway and OAuth token handling
- v1.43.2 (2026-07-26): bug fixes related to docker and process management
- v1.43.1 (2026-07-25): bug fixes related to OpenAI OAuth token refresh
Traction
- Stars: 2979
- Forks: 175
- Open issues: 104
License
Apache-2.0