3,000 endpoints share one credential boundary
Treg lists more than 3,000 endpoints across over 60 providers behind one base URL and one Treg token. The pitch is easy to picture: an agent asks for backlink data, a social action, or company enrichment without signing up for each vendor. Treg resolves the selected endpoint, injects the provider credential on the server, removes its own control headers, and relays the request. The caller sees the result, while the upstream key stays out of the prompt and local environment.
The useful distinction is who pays and who owns the key. A team credential wins when one exists. A verified public route can be free. Otherwise, Treg may use its own account and debit prepaid credit, with an HTTP 402 when the balance cannot cover the estimate. It does not silently swap between different providers unless you opt into a routed treg.<capability> endpoint. That explicit choice is better than an agent quietly changing data sources halfway through a job.
One token can cover HTTP tools, CLIs, skills, and MCP
Treg has 4 credential injector shapes: plain environment values, secret files, OAuth tokens, and material taken from a CLI login. Teams can register HTTP endpoints, run vendor CLIs locally or on the registry server, and distribute SKILL.md bundles. MCP clients have hosted connector routes, while Claude Code users can install the repository as a plugin. The catalog is broad, but the shared credential plane is the part a platform team is really adopting.
Access is scoped to an organization with owner, admin, member, and viewer roles. A token identifies both user and organization, and admins can limit a member to named tools. The README also documents audit histories, health probes, OAuth refresh, customer pins, and an 8 MiB response ceiling for calls that require settlement or ownership evidence. These are concrete controls. You still have to decide which agents may make write calls and who reviews spend.
What happened when we ran it
Our sandbox installed 0 npm packages in 2 seconds, and the checkout occupied 160 MB after that step. The root package exposes plugin metadata and files, but no npm build script or test target. Our harness therefore skipped both build and tests. Npm audit reported 0 known vulnerabilities across the npm dependency set, which contained no installed packages. The result is clean as far as it goes, and very narrow.
The measured commit was 6e667a4, checked in an unprivileged Debian container with 3 CPUs and 8 GB of RAM. We measured 3,439 repository files, about 151,152 source lines, and 88.2 MB checked out. Four CI workflow files and a tests directory were present, but our test method followed the detected npm target and never ran the README's Python command. This review does not turn a skipped suite into a pass.
Python 3.12 is the actual self-hosting path
Python 3.12 or 3.13, uv, and the server extra are the documented route to a registry. The local script starts a hot-reload server in tmux, uses SQLite, and can show email codes in development mode. A direct run can also start with no .env, because Treg creates an ephemeral Fernet key and uses local SQLite defaults. That convenience is useful for evaluation, but the generated key will not preserve encrypted secrets across a restart.
A persistent service needs a stable encryption key and a backed-up database. Depending on the login and provider mix, it may also need session secrets, GitHub or Google OAuth credentials, email delivery, Redis, object storage, Stripe, and upstream provider accounts. The production operator runbook is private, so public documentation explains the components without giving self-hosters the exact hosted topology. Budget time for recovery drills before agents depend on the proxy.
Apache 2.0 is modified by a hosted-service ban
Treg's license reproduces Apache 2.0 and then adds a restriction that takes precedence. Internal commercial use and self-hosting for your own organization are allowed. Offering the code as a hosted, managed, or embedded service to third parties requires written authorization. The package metadata calls the license proprietary, and GitHub reports NOASSERTION, which is more accurate than treating it as ordinary Apache 2.0.
Six open issues sit beside heavy pull request activity
GitHub showed 2,032 stars, 207 forks, and 81 combined open issues and pull requests on September 22, 2026. A separate issue search found 6 open issues, so most of that combined count was pull request traffic. The repository was pushed the same day, and commit 6e667a4 itself tightened customer-pinned history and async result access. Development is fast and security boundaries are receiving direct work.
Speed also means interface drift. Issue 557 reported that an installed skill documented a treg host command missing from its paired CLI; it was closed 2 days later. Two open distribution issues report incomplete or failed DSH plugin installation. There is no GitHub release yet, while pyproject.toml labels version 0.20.0 as beta. Pin a commit or package version and test the exact plugin, CLI, and server combination you plan to deploy.
Treg earns a trial when subscriptions are the current bottleneck
A catalog of 3,000 endpoints is valuable when agents need occasional access to many paid data providers and separate subscriptions sit idle. Treg also makes sense when several teammates need the same CLI or OAuth-backed tool without receiving its raw credential. Composio offers a larger packaged app layer, Arcade MCP is narrower for custom authorized tools, and the MCP Registry handles discovery without becoming your credential and billing proxy.
Our 2-second npm install cannot settle the trust question. A useful evaluation should deploy the Python server with disposable provider keys, disable telemetry if policy requires it, exercise read and write scopes, restore the database and Fernet key from backup, and verify audit records under more than one role. If that drill feels excessive, centralizing the credentials is probably the wrong move. If it feels overdue, Treg is addressing a problem your team already has.