OneCLI is an open-source credential vault and HTTP gateway designed to give AI agents access to external APIs without exposing real API keys. Agents use placeholder keys and make normal HTTP calls through the OneCLI proxy, which transparently swaps in the real credentials at request time. The gateway is built in Rust for performance and memory safety, while a Next.js dashboard handles secret management and permissions. Secrets are stored with AES-256-GCM encryption and decrypted only at request time. It supports multi-agent setups with scoped access tokens, runs with an embedded PGlite database (no external dependencies), and can be deployed via a single Docker command.
Table of contents
What is OneCLI?ArchitectureQuick StartFeaturesProject StructureLocal DevelopmentConfigurationContributingLicenseCommunity take
Updated
150
comments
The community broadly agrees that keeping credentials out of agent hands is the right idea, but is split on whether OneCLI adds meaningful value over existing tools (Vault, AWS Secrets Manager, auth-proxying) and skeptical that it truly solves the deeper problem of prompt-injection-driven misuse of legitimate API access.
30% positive
45% mixed
25% skeptical
Deep diveShare this post