OneCLI
A credential gateway for AI agents with a built-in vault. Store once, inject anywhere, agents never see the keys.
- Source repo
- onecli/onecli
- Stars
- ★ 3.6k
- Last updated
- 4d ago
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 28/100 · Major gaps
At a glance
- How it runs
- Works with
- Platform-specific
- Cost
- Free tier plus a paid hosted plan
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A local developer wants to run AI agents without exposing API keys in code or environment variables.
- Not a fit if
- Individuals unwilling to run PostgreSQL and multiple services
- Teams needing fully offline use with no external identity provider
- Small teams wanting zero-infrastructure, instant setup
- Source review
- 28/100 · Major gaps 4 safety controls not found
What does this agent do, and when should you use it?
OneCLI is an open-source credential gateway that sits between AI agents and the services they call. It uses a Rust-based high-performance gateway (apps/gateway) to intercept outbound HTTP requests and inject credentials at runtime. Real credentials are stored in an encrypted secret store using AES-256-GCM, decrypted only at request time, and injected based on host and path patterns. The web dashboard (apps/web) is a Next.js app for managing agents, secrets, and permissions. OneCLI supports a local single-user mode (no login) and Google OAuth for multi-user teams. Deployment is straightforward via Docker Compose or a one-line install script. The project is licensed under Apache-2.0.
OneCLI runs a Rust gateway (listening on port 10255) that intercepts outbound HTTP requests from AI agents. Agents authenticate using placeholder keys (e.g., FAKE_KEY), and the gateway, through MITM interception if HTTPS, replaces the placeholder with the REAL_KEY retrieved from the encrypted store and injects it as headers or query parameters. The web dashboard (port 10254) provides a UI to create agents, add secrets, and configure permissions. The gateway resolves which credentials to inject via an API provided by the dashboard. The secret store uses AES-256-GCM encryption, decrypting only at request time. OneCLI also supports integration with password managers like Bitwarden for on-demand injection without storing secrets on the server.
- A local developer wants to run AI agents without exposing API keys in code or environment variables.
- A team wants to centrally manage API keys for multiple AI agents, with the ability to rotate and revoke access independently.
- A security-conscious organization requires that sensitive credentials are never directly exposed to AI agents, but injected via an encrypted gateway.
- An administrator using Bitwarden wants on-demand credential injection for AI agents without storing secrets on the server.
- A user wants to audit AI agent calls to third-party APIs and access patterns.
How do you install or deploy this agent?
Install by running: curl -fsSL https://onecli.sh/install | sh. For manual install, clone the repo: git clone https://github.com/onecli/onecli.git, cd into it, then run docker compose -f docker/docker-compose.yml up -d --wait. After installation, open http://localhost:10254 to create agents and add secrets; the gateway listens on localhost:10255.
How do you use this agent?
After installation, create an agent in the web dashboard (port 10254) to get an access token. Configure secrets in the dashboard for the agent, specifying host and path patterns. Set your agent's HTTP gateway to localhost:10255 and use placeholder keys in requests. The gateway will automatically replace placeholders with real credentials. For multi-user mode, set NEXTAUTH_SECRET and Google OAuth credentials.
What are this agent's strengths and limitations?
- Transparent injection: agents use plain HTTP calls without modification; the gateway handles authentication.
- Encrypted storage: AES-256-GCM encryption, decrypting only at request time, reducing exposure risk.
- Multi-agent support: each agent has its own access token with scoped permissions.
- Vault integration with Bitwarden allows on-demand credential injection.
- Requires maintaining additional gateway components (Rust gateway and web dashboard) and infrastructure (PostgreSQL).
- HTTPS interception requires agents to trust OneCLI's certificate, which may introduce compatibility issues.
- No built-in identity provider; multi-user relies on Google OAuth.
- As a relatively new project, it may lack mature ecosystem and community support.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| OneCLI This agent | 28 · Major gaps | Self-hosted serviceFreemium | ★ 3.6k | 4d ago | TypeScript | — |
| Kasetto | 70 · Some gaps | CLIFree | ★ 210 | 3d ago | Rust | Codex · Claude Code |
| Agent Desktop | 85 · Good | CLIFree | ★ 1.8k | today | Rust | — |
| h5i — A Security-First Headless Browser for AI Agents | 84 · Good | CLIFree | ★ 788 | today | Rust | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: README describes least privilege (agents use placeholder keys, gateway injects real keys), but no implementation details or permission model docs. User confirmation not mentioned, no confirmation steps before actions. Data flow transparency: README explains how requests are intercepted and injected, but no audit logs or monitoring details. Sensitive data handling: claims AES-256-GCM encryption, but no key management details or security audit. Dependency security: no mention of vulnerability scanning or security policy. External effects: install script via curl poses supply chain risk, no checksum or signature verification. Rollback: no rollback mechanism mentioned. Source attribution: no author or maintainer info. Deductions: lack of implementation details and documentation support.
Evidence shows: Self-consistency: README description aligns with project structure, but no detailed architecture or data flow diagrams. Dependency availability: dependencies listed in package.json, but no version locking or integrity checks. Failure messages: no error handling or user prompt documentation. Deductions: lack of error handling docs and dependency integrity verification.
Evidence shows: Target audience clear (AI agent developers), use cases described. Capability boundaries: README explains gateway and dashboard functions, but no explicit limits or boundaries. Trigger precision: no detailed configuration or trigger condition docs. Environment fit: local dev and Docker deployment instructions provided, but no production deployment guide. Deductions: lack of detailed configuration and boundary docs.
Evidence shows: Information architecture clear, project structure explained. Install notes detailed, including quick start and local dev. Naming stability: version number exists, but no naming conventions. Examples and FAQ: basic examples provided, no FAQ. Known limitations: not mentioned. License: Apache-2.0, LICENSE file present. Versioning changelog: no CHANGELOG. Maintenance responsibility: no explicit maintainers or contribution guide. Deductions: lack of known limitations, FAQ, and changelog.
Evidence shows: Output usability: README provides usage examples, but no detailed API docs. Marginal value: addresses pain point of AI agent credential management, clear value. Cost benefit: open source free, but deployment and maintenance costs not assessed. Deductions: lack of detailed API docs and cost analysis.
Evidence shows: Claim traceability: some claims in README supported by docs, but no test results. Cross-source corroboration: no third-party verification or independent testing. Fact-inference separation: README distinguishes feature descriptions and architecture, but does not explicitly label inferences. Deductions: lack of test evidence and independent verification.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: dependency securityPin versions and run a dependency audit (npm audit, pip-audit) before installing; prefer running it in a container.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Not found in source: verifiable attributionInstall from the official repo or registry and check the publisher and URL to avoid look-alike packages.
- Install script via curl poses supply chain risk; verify checksums.
- No dependency vulnerability scanning or security audit; assess yourself.
- No rollback mechanism; backup before upgrades.
- No known limitations documented; use with caution in production.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
[2.14.0](https://github.com/onecli/onecli/compare/v2.13.0...v2.14.0) (2026-10-14) Features * missing OAuth permission warnings, Drive "Shared with me", Slack on Kubernetes ([#615](https://github.com/onecli/onecli/issues/615)) ([6a31200](https://github.com/onecli/onecli/commit/6a31200839dcf107303c829892333fd54a0ff8df))View on GitHub ↗ -
Release notes excerpt
[2.13.0](https://github.com/onecli/onecli/compare/v2.12.0...v2.13.0) (2026-10-14) Features * Send now, live replies, workspace timezone, desktop browser, shared connections ([#613](https://github.com/onecli/onecli/issues/613)) ([6297366](https://github.com/onecli/onecli/commit/6297366dbe4b35f7176526a7399e30dd82eead43))View on GitHub ↗ -
Release notes excerpt
[2.12.0](https://github.com/onecli/onecli/compare/v2.11.2...v2.12.0) (2026-10-08) Features * open tunnel lane for browsers, Runs and Network tabs in Activity ([#611](https://github.com/onecli/onecli/issues/611)) ([2174a54](https://github.com/onecli/onecli/commit/2174a54d1d48b26c0459bd612625584092a1c5c2))View on GitHub ↗