onecli run wraps a coding agent process with OneCLI gateway access. Your agent’s HTTPS traffic routes through the gateway, which injects stored credentials automatically. The agent never sees raw API keys or OAuth tokens.
Supported agents
| Agent | Command |
|---|---|
| Claude Code | onecli run -- claude |
| Cursor | onecli run -- cursor |
| Codex | onecli run -- codex |
| Hermes | onecli run -- hermes |
| OpenCode | onecli run -- opencode |
--. The agents listed above also get an auto-installed skill file that teaches them how to use the gateway.
Setup
Install the CLI
What onecli run does
When you run onecli run -- claude, the CLI:
- Fetches gateway configuration from the OneCLI server
- Writes the gateway CA certificate to
~/.onecli/gateway-ca.pem - Fetches your configured secrets and generates a dynamic skill file at
~/.claude/skills/onecli-gateway/SKILL.mdlisting your actual services - Injects
HTTPS_PROXY, CA trust variables,ONECLI_AGENT_NAME, andONECLI_URLinto the child process - Hands over terminal control to the agent
How agents connect to services
The skill file teaches supported agents a simple workflow:-
Make the request directly. The agent calls the real API URL (e.g.
https://gmail.googleapis.com/...). No auth headers needed. If credentials are configured, the gateway injects them and the request succeeds. -
If it fails, help the user connect. The gateway returns a structured error with a
connect_url. The agent appends&source=agent&agent_name=(from$ONECLI_AGENT_NAME) and presents the link to the user. - Poll and retry. The agent polls the connection status and retries automatically once the user connects the service. No manual “try now” needed.
onecli secrets create.
Flags
| Flag | Description |
|---|---|
--agent <identifier> | Use a specific OneCLI agent identity instead of the default |
--gateway <host:port> | Override the gateway address (default: derived from API host) |
--no-ca | Skip CA certificate write and trust env injection |
--dry-run | Print the resolved config as JSON without launching the agent |
Dry run
Use--dry-run to inspect what onecli run would do without side effects:
Compared to the SDK path
onecli run is for coding agents running directly on your machine. If your agents run in Docker containers (e.g. via NanoClaw), use the Node.js SDK instead. Both paths use the same gateway, the same secrets, and the same policy rules.
onecli run | SDK / Docker | |
|---|---|---|
| Agent runs on | Your machine (local process) | Docker container |
| Setup | onecli run -- claude | applyContainerConfig(args) |
| Skill files | Auto-installed | Not applicable |
| Use case | Development with coding agents | Production orchestration |