Back to the catalog

onecli

Connect AI agents to external APIs with zero credential management. The OneCLI gateway transparently proxies all HTTPS traffic and injects s

Open source Repository Open in the app JSON README (API)

About

Connect AI agents to external APIs with zero credential management. The OneCLI gateway transparently proxies all HTTPS traffic and injects stored credentials (OAuth tokens, API keys, AWS signatures) into outbound requests. Supports 40+ services including GitHub, Gmail, Google Calendar, Jira, AWS, Stripe, Datadog, and more. Policy rules enforce block, rate limit, and manual approval at the gateway level.

Details

Kind
Plugins
Topic
Cloud & DevOps
Publisher
onecli
Origin
marketplace
Category
ferramentas
Stars
1
Forks
1
Open pull requests
2
Last push
2026-07-30T20:51:48Z
Repository state
ativo
Language
JavaScript
License
Apache-2.0
Added
2026-08-30 01:48:58
Updated
2026-08-30 01:48:58
Origin id
onecli/onecli-plugin/onecli

README

# OneCLI Agent Plugins

Connect AI coding agents to external APIs without managing credentials. The OneCLI gateway injects stored credentials into outbound requests automatically, so you don't need API keys in your environment or OAuth flows in your terminal.

This repo ships the OneCLI gateway plugin for two agent platforms from a single shared codebase:

| Plugin | Platform | Path |
|--------|----------|------|
| **onecli** for Claude Code | [Claude Code](https://claude.com/claude-code) | [`plugins/claude/`](plugins/claude/) |
| **onecli** for Codex | [OpenAI Codex](https://developers.openai.com/codex) | [`plugins/codex/`](plugins/codex/) |

**Supported services**: GitHub, Gmail, Google Calendar, Google Drive, Google Docs, Google Sheets, Jira, Confluence, AWS, Datadog, Notion, Cloudflare, Todoist, Outlook, Microsoft Word, YouTube, and more.

## How it works

All HTTPS traffic from the agent routes through the OneCLI gateway (`HTTPS_PROXY`), which intercepts requests and injects the right credentials (OAuth tokens, API keys, AWS SigV4 signatures). If a service isn't connected yet, the gateway returns a `connect_url` the agent shows you. Policy rules (block, rate limit, manual approval) are enforced at the gateway on every request.

The two plugins share the same runtime but activate differently, matching what each platform's hooks can do.

On Claude Code, the `SessionStart` hook fetches the gateway config once, writes live exports to `~/.onecli/env.sh`, and wires `BASH_ENV` so every Bash command picks them up. A `SessionEnd` hook cleans up.

On Codex, hooks run as child processes and cannot mutate the session environment, and there is no `SessionEnd` event. The `SessionStart` hook therefore writes `~/.onecli/env.sh` as a **credential-free loader**; a conservative `PreToolUse` hook auto-sources it for outbound Bash commands (such as `curl`, `gh`, `git push`, `npm install`), fetching fresh gateway exports per command via `bin/onecli-codex-env.mjs`. Cleanup is an explicit skill (`onecli-cleanup`), deliberately not wired to the turn-scoped `Stop` event.

## Install on Claude Code

From the Claude Code Directory: **Customize → Directory → Plugins**, search **OneCLI**, click **Install**. Or from the marketplace in this repo:

```
/plugin marketplace add onecli/onecli-plugin
/plugin install onecli@onecli
```

Then run `/onecli-setup` once and start a new session. See [`plugins/claude/README.md`](plugins/claude/README.md).

## Install on Codex

```bash
codex plugin marketplace add https://github.com/onecli/onecli-plugin.git
codex plugin add onecli@onecli
```

Start a new thread, then invoke the `onecli-setup` skill (`@onecli:onecli-setup`). See [`plugins/codex/README.md`](plugins/codex/README.md).

## Repo layout

```
src/                      TypeScript sources (single source of truth)
  shared/runtime.mts      gateway config, key resolution, CA bundle, quoting, probing
  claude/                 Claude Code hooks
  codex/                  Codex hooks + env helper
plugins/
  claude/                 self-contained Claude Code plugin (built hooks committed)
  codex/                  self-contained Codex plugin (built hooks committed)
.claude-plugin/marketplace.json    Claude Code marketplace → ./plugins/claude
.claude-plugin/plugin.json         root compatibility shim (see below)
hooks/hooks.json                   hooks for the root shim
.agents/plugins/marketplace.json   Codex marketplace → ./plugins/codex
tests/test_workflows.py   end-to-end tests for both plugins (fake gateway + API)
```

**Root compatibility shim**: the Anthropic community marketplace (`claude-community`) entry for `onecli` uses a `url` source pinned to a commit of this repo, treating the **repo root** as the plugin. The root `.claude-plugin/plugin.json` therefore remains a valid manifest that points `commands`, `agents`, `skills`, and `hooks` into `./plugins/claude/`, so root installs keep working and Anthropic's CI can continue auto-bumping the SHA pin safely. The shim's `version` must always match `plugins/claude/.claude-plugin/plugin.json` (enforced by tests). It can be removed once the community entry migrates to a `git-subdir` source pointing at `plugins/claude`.

Both platforms copy only the plugin directory into their install cache, so each `plugins/*` directory must stay self-contained: `src/shared` is bundled into every built hook by tsup. **Edit `src/`, never `plugins/*/hooks` or `plugins/*/bin` directly**, then rebuild.

## Development

```bash
npm install
npm run typecheck   # tsc over src/
npm run build       # tsup: src/ → plugins/claude/hooks, plugins/codex/{hooks,bin}
npm run test        # python3 tests/test_workflows.py
```

Built hook files are committed (plugins install straight from git). After changing `src/`, run `npm run build` and commit the outputs together with the sources.

## Requirements

- A [OneCLI](https://onecli.sh) account
- At least one connected service in the OneCLI dashboard

## License

Apache-2.0

More