Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents
TL;DR Highlight
A gateway injects credentials into requests so AI agents never see the secrets.
Who Should Read
Backend or platform developers worried about internal AI agents holding raw API keys that could leak
Core Mechanics
- Agents never see the keys
- Each agent gets only the access you granted.
- The gateway enforces it on every request.
- A Rust gateway injects keys into requests
- It intercepts outbound HTTPS via MITM.
- Agents authenticate with access tokens in Proxy-Authorization headers.
- Secrets are encrypted and decrypted only on use
- Stored with AES-256-GCM and decrypted at request time only.
- Matched by host and path pattern, injected as headers or query parameters.
- The gateway is the sandbox's only exit
- Each agent has an isolated sandbox with a filesystem and shell.
- It can reach only what you granted.
- v1 vault grew into a team agent platform (v2)
- It started as a Rust credential vault for agents.
Community Reactions
- Great for static keys, but OAuth is missing, one commenter said
- They suggested the gateway handle OAuth client credentials flows.
- Retries on certain failures and short-circuiting were also proposed.
- Seen as an old, proven design that makes leaked fake keys useless
- One comment compared it to DB clients that never hold data and ask a server instead.
- The author of a GitHub-only proxy (gh-proxy) said a leaked fake token is useless to attackers.
- Skeptics say it just swaps one key for another
- One said credentials eventually reach the LLM whatever the abstraction.
- Another said existing SSO (OAuth, SAML, OIDC) is the more mature option.
- Comparisons with alternatives came up
- Someone asked how it compares to agent-vault and clawpatrol.
- varlock.dev was shared: configured via .env.schema, pulling secrets via plugins like Infisical and 1Password.
How to Apply
- Remove real keys from agent environments
- Grep your agent's .env and prompts today for real API keys.
- Swap in fake tokens and design a proxy that replaces them with the real values.
- Run OneCLI locally
- Clone the repo, then run pnpm install and pnpm run setup.
- In the dashboard at localhost:10254, create an agent and a secret and check host-based injection.
- Put human approval on risky actions
- List actions like sending email, deleting tickets, emptying buckets.
- Add an approval step to those requests in the gateway policy.
- Funnel agent egress through one exit
- Allow sandbox outbound traffic only to the gateway.
- Write per-host and path allowlists and apply them.
Try It
# Paste in a terminal: run OneCLI self-hosted locally (from the README Quick Start)
git clone https://github.com/onecli/onecli.git && cd onecli
pnpm install
pnpm run setup
# Then open http://localhost:10254 in a browser to create agents and secrets
# On Kubernetes, use the Helm chart instead
helm install onecli oci://ghcr.io/onecli/charts/onecliTerminology
Related Papers
Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy
Saving long tool output to files cut GPT-5.1 accuracy by 11.3 points; naming the authoritative file restored it.
Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents
Fake headlines hijacked LLM trading agents 62% of the time versus 14% for prompt injection.
Harness Engineering 101: The LLM is the brain, the harness is the body
An agent is a loop managing a JSON array; 16 chapters build one from scratch
Harness2 by Google Research – Recursive Agent Harnessing
Recursively refining the harness with fixed model weights raised benchmark scores by up to 11.8 points.
Ousted Savannah police officer gave ICE agent husband access to Flock system
A police officer shared her Flock login with her ICE-agent husband; an audit found 983 searches and she was fired
Tmux and Claude Code: Sessions, Send-Keys, and the Ceiling
Running Claude Code agents in tmux works well, but limits appear around four agents.