Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Open-source credential gateway with a built-in vault. give your AI agents access to services without exposing keys.
| Date | Stars |
|---|---|
| 2026-07-31 | 2938 |
| 2026-08-03 | 2938 |
| 2026-08-06 | 2997 |
Today
+59 stars today
This week
— stars this week
This month
— stars this month
Momentum
296.0
growth rate 0.00%/day
<picture> <source media="(prefers-color-scheme: dark)" srcset="assets/onecli-logo-dark.gif"> <source media="(prefers-color-scheme: light)" srcset="assets/onecli-logo-light.gif"> <img alt="OneCLI" src="assets/onecli-logo-light.gif" width="100%"> </picture> <p align="center"> <b>The secret vault for AI agents.</b><br/> Store once. Inject anywhere. Agents never see the keys. </p> <p align="center"> <a href="https://onecli.sh">Website</a> · <a href="https://onecli.sh/docs">Docs</a> · <a href="https://discord.gg/PSztzsQB3g">Discord</a> </p> --- <picture> <source media="(prefers-color-scheme: dark)" srcset="assets/onecli-flow-dark.gif"> <source media="(prefers-color-scheme: light)" srcset="assets/onecli-flow-light.gif"> <img alt="How OneCLI works" src="assets/onecli-flow-light.gif" width="100%"> </picture> ## What is OneCLI? OneCLI is an open-source gateway that sits between your AI agents and the services they call. Instead of baking API keys into every agent, you store credentials once in OneCLI and the gateway injects them transparently. Agents never see the secrets. **Why we built it:** AI agents need to call dozens of APIs, but giving each agent raw credentials is a security risk. OneCLI solves this with a single gateway that handles auth, so you get one place to manage access, rotate keys, and see what every agent is doing. **How it works:** You store your real API credentials in OneCLI and give your agents placeholder keys (e.g. `FAKE_KEY`). When an agent makes an HTTP call through the gateway, the OneCLI gateway matches the request to the right credentials, swaps the `FAKE_KEY` for the `REAL_KEY`, decrypts them, and injects them into the outbound request. The agent never touches the real secrets. It just makes normal HTTP calls and the gateway handles the swap. ## Architecture <picture> <source media="(prefers-color-scheme: dark)" srcset="assets/onecli-architecture-dark.svg"> <source media="(prefers-color-scheme: light)" srcset="assets/onecli-architecture-light.svg"> <img alt="OneCLI Architecture" src="assets/onecli-architecture-dark.svg" width="100%"> </picture> - **[Rust Gateway](apps/gateway)**: fast HTTP gateway that intercepts outbound requests and injects credentials. Agents authenticate with access tokens via `Proxy-Authorization` headers. - **[Web Dashboard](apps/web)**: Next.js app for managing agents, secrets, and permissions. Provides the API the gateway uses to resolve which credentials to inject for each request. - **Secret Store**: AES-256-GCM encrypted credential storage. Secrets are decrypted only at request time, matched by host and path patterns, and injected by the gateway as headers or URL query parameters. ## Quick Start The fastest way to run OneCLI locally: ```bash curl -fsSL https://onecli.sh/install | sh ``` Or, if you prefer to run it manually: ```bash git clone https://github.com/onecli/onecli.git cd onecli docker compose -f docker/docker-compose.yml up -d --wait ``` Open **http://localhost:10254**, create an agent, add your secrets, and point your agent's HTTP gateway to `localhost:10255`. > The Quick Start runs OneCLI in **local mode** (single-user, no login), so no `.env` or `NEXTAUTH_SECRET` is required. To enable Google OAuth for multiple users, set `NEXTAUTH_SECRET` and the Google credentials (see [Configuration](#configuration)). ## Features - **Transparent credential injection**: agents make normal HTTP calls, the gateway handles auth - **Encrypted secret storage**: AES-256-GCM encryption at rest, decrypted only at request time - **Host & path matching**: route secrets to the right API endpoints with pattern matching - **Multi-agent support**: each agent gets its own access token with scoped permissions - **Easy setup**: `curl -fsSL https://onecli.sh/install | sh` starts everything (app + PostgreSQL) - **Two auth modes**: single-user (no login) for local use, or Google OAuth for teams - **Rust gateway**: fast, memory-safe HTTP ga
Excerpt of 6,457 characters
Read on GitHub
Guy Ben-Aharon · OneCLI
264
Jonathan Fishner · OneCLI · United States
27
4
2
2
2
1
Baruch Sadogursky · Tunisia
1
1
1
1
1
1
1
1
1
1
chaoliang yan · Australia
1
1
1
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:abc81837c0fd40e5, topic:ai-agents, desc:ai agents
matched fp:abc81837c0fd40e5, topic:mcp