# manishpatel00/onecli-agentvault architecture

> Architecture diagram of the GitHub repository manishpatel00/onecli-agentvault, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/manishpatel00/onecli-agentvault
- Repository: https://github.com/manishpatel00/onecli-agentvault

## Overview

OneCLI-AgentVault is a credential gateway and isolation proxy for AI agents, with a web dashboard and API for managing agents, connections, and access policies. The main runtime flow is an agent request through the Rust gateway, which matches and injects stored credentials before forwarding traffic; the dashboard/API supports setup and management. The README documents that flow and the gateway/API relationship. Sampled code confirms API route registration and app-connection service calls, but most gateway internals and several dashboard features were not inspected, so those links are limited to documented relationships.

Main entry points: [`apps/gateway/src/gateway.rs`](https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/gateway.rs) (HTTP gateway), [`packages/api/src/routes/apps.ts`](https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/routes/apps.ts) (App connection routes), [`packages/api/src/app.ts`](https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/app.ts) (API application), [`packages/api/src/services/policy-service.ts`](https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/services/policy-service.ts) (Policy service)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_gateway["Gateway runtime"]
  node_gateway_entry["HTTP gateway<br/>[gateway.rs]"]
  node_provider_rules["Provider matching<br/>[apps.rs]"]
  node_credential_injection["Credential injection<br/>[inject.rs]"]
  node_policy_engine["Policy engine<br/>[policy_engine.rs]"]
  node_mitm_ca["HTTPS interception CA<br/>[ca.rs]"]
end

subgraph group_management["Management API"]
  node_api_app["API application<br/>[app.ts]"]
  node_app_routes["App connection routes<br/>[apps.ts]"]
  node_connection_service["Connection service"]
  node_policy_service["Policy service<br/>[policy-service.ts]"]
  node_blocklist_service["Host blocklists"]
end

subgraph group_web["Dashboard"]
  node_web_dashboard["Web dashboard"]
  node_web_api_binding["Web API binding<br/>[app.ts]"]
  node_connect_flow["App connection flow"]
end

subgraph group_storage["Credential storage"]
  node_secret_store[("Encrypted secrets<br/>[db.rs]")]
  node_api_database[("Application database<br/>[index.ts]")]
end

node_agent(("AI agent"))
node_external_apis["Target APIs"]
node_postgres[("PostgreSQL")]

node_agent -->|"sends requests"| node_gateway_entry
node_gateway_entry -->|"matches provider"| node_provider_rules
node_gateway_entry -->|"injects credentials"| node_credential_injection
node_gateway_entry -.->|"enforces access"| node_policy_engine
node_gateway_entry -->|"intercepts HTTPS"| node_mitm_ca
node_gateway_entry -->|"resolves secrets"| node_secret_store
node_gateway_entry -->|"resolves credentials"| node_api_app
node_gateway_entry -->|"forwards requests"| node_external_apis
node_api_app -->|"mounts routes"| node_app_routes
node_app_routes -->|"lists connections"| node_connection_service
node_app_routes -->|"reads blocklist"| node_blocklist_service
node_policy_service -.->|"persists rules"| node_api_database
node_blocklist_service -->|"uses policy scope"| node_policy_service
node_web_dashboard -.->|"uses API client"| node_web_api_binding
node_web_api_binding -->|"creates API app"| node_api_app
node_connect_flow -.->|"configures connections"| node_app_routes
node_api_database -.->|"stores records"| node_postgres
node_secret_store -.->|"stores credentials"| node_postgres

click node_gateway_entry "https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/gateway.rs"
click node_provider_rules "https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/apps.rs"
click node_credential_injection "https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/inject.rs"
click node_policy_engine "https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/policy_engine.rs"
click node_mitm_ca "https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/ca.rs"
click node_api_app "https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/app.ts"
click node_app_routes "https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/routes/apps.ts"
click node_connection_service "https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/services/connection-service.ts"
click node_policy_service "https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/services/policy-service.ts"
click node_blocklist_service "https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/services/app-blocklist-service.ts"
click node_web_dashboard "https://github.com/manishpatel00/onecli-agentvault/tree/main/apps/web/src/app/(dashboard)"
click node_web_api_binding "https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/web/src/lib/api/app.ts"
click node_connect_flow "https://github.com/manishpatel00/onecli-agentvault/tree/main/apps/web/src/app/(connect)/app-connect"
click node_secret_store "https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/db.rs"
click node_api_database "https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/db/src/index.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_gateway_entry,node_provider_rules,node_credential_injection,node_policy_engine,node_mitm_ca toneBlue
class node_api_app,node_app_routes,node_connection_service,node_policy_service,node_blocklist_service,node_postgres toneAmber
class node_web_dashboard,node_web_api_binding,node_connect_flow,node_external_apis toneMint
class node_secret_store,node_api_database toneRose
class node_agent toneIndigo
```

## Components

### Gateway runtime

- [HTTP gateway](https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/gateway.rs): `apps/gateway/src/gateway.rs`
- [Provider matching](https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/apps.rs): `apps/gateway/src/apps.rs`
- [Credential injection](https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/inject.rs): `apps/gateway/src/inject.rs`
- [Policy engine](https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/policy_engine.rs): `apps/gateway/src/policy_engine.rs`
- [HTTPS interception CA](https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/ca.rs): `apps/gateway/src/ca.rs`

### Management API

- [API application](https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/app.ts): `packages/api/src/app.ts`
- [App connection routes](https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/routes/apps.ts): `packages/api/src/routes/apps.ts`
- [Connection service](https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/services/connection-service.ts): `packages/api/src/services/connection-service.ts`
- [Policy service](https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/services/policy-service.ts): `packages/api/src/services/policy-service.ts`
- [Host blocklists](https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/api/src/services/app-blocklist-service.ts): `packages/api/src/services/app-blocklist-service.ts`

### Dashboard

- [Web dashboard](https://github.com/manishpatel00/onecli-agentvault/tree/main/apps/web/src/app/(dashboard)): `apps/web/src/app/(dashboard)`
- [Web API binding](https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/web/src/lib/api/app.ts): `apps/web/src/lib/api/app.ts`
- [App connection flow](https://github.com/manishpatel00/onecli-agentvault/tree/main/apps/web/src/app/(connect)/app-connect): `apps/web/src/app/(connect)/app-connect`

### Credential storage

- [Encrypted secrets](https://github.com/manishpatel00/onecli-agentvault/blob/main/apps/gateway/src/db.rs): `apps/gateway/src/db.rs`
- [Application database](https://github.com/manishpatel00/onecli-agentvault/blob/main/packages/db/src/index.ts): `packages/db/src/index.ts`

### Other components

- **AI agent**
- **Target APIs**
- **PostgreSQL**

## Connections

- AI agent → HTTP gateway: sends requests
- HTTP gateway → Provider matching: matches provider (evidence: `apps/gateway/src/apps.rs`)
- HTTP gateway → Credential injection: injects credentials
- HTTP gateway → Policy engine: enforces access
- HTTP gateway → HTTPS interception CA: intercepts HTTPS
- HTTP gateway → Encrypted secrets: resolves secrets
- HTTP gateway → API application: resolves credentials
- HTTP gateway → Target APIs: forwards requests
- API application → App connection routes: mounts routes (evidence: `packages/api/src/app.ts`)
- App connection routes → Connection service: lists connections (evidence: `packages/api/src/routes/apps.ts`)
- App connection routes → Host blocklists: reads blocklist (evidence: `packages/api/src/routes/apps.ts`)
- Policy service → Application database: persists rules
- Host blocklists → Policy service: uses policy scope (evidence: `packages/api/src/services/app-blocklist-service.ts`)
- Web dashboard → Web API binding: uses API client
- Web API binding → API application: creates API app (evidence: `apps/web/src/lib/api/app.ts`)
- App connection flow → App connection routes: configures connections
- Application database → PostgreSQL: stores records
- Encrypted secrets → PostgreSQL: stores credentials