OneCLI
by OneCLI
Give AI agents access to your APIs without ever giving them the secrets
OneCLI is an open-source credential gateway that sits between AI agents and the services they call. Agents send placeholder tokens; the gateway swaps in the real credential at the network layer before forwarding the request. It adds endpoint blocking, per-agent rate limits and human approval workflows, and is Apache 2.0 with roughly 3,000 GitHub stars.
OneCLI is an open-source credential gateway that sits between AI agents and the services they call, so agents get access without ever holding secrets. The problem it targets is credential sprawl in agentic workflows: a coding agent that needs GitHub, AWS, Stripe and a dozen SaaS APIs conventionally gets raw keys in its environment, where any prompt injection, log line or model-written script can leak them. OneCLI stores the credential once in an encrypted vault and injects it at the network layer - the agent sends a placeholder, the gateway swaps in the real value before forwarding, and the response comes back normally. Architecturally it is three components: a Rust HTTP gateway on port 10255 that matches request host and path patterns and performs the injection, including AWS SigV4 request re-signing; a Next.js dashboard on port 10254 for managing agents, secrets and permissions; and an AES-256-GCM encrypted secret store decrypted only at request time. Because interception happens at the network layer, it covers every path an agent takes - MCP tool calls, shell commands, curl, and code the model wrote itself. On top of injection it layers policy: endpoint blocking, per-agent rate limits, human approval workflows for sensitive operations, and per-project scoping so one agent's credentials are isolated from another's. It is Apache 2.0 on GitHub with roughly 3,000 stars and 173 forks, backed by Y Combinator, installs via a shell script or Docker Compose, and integrates with Bitwarden, 1Password and HashiCorp Vault as upstream credential stores. It works with Claude Code, OpenAI Codex and Cursor Agent out of the box, and names Docker, MindsDB, Zoho, Coralogix and Kakao Entertainment among its users.
Platform and security engineers whose developers are already running Claude Code, Codex or Cursor Agent against production APIs, and who need to stop distributing raw long-lived credentials to those agents.
Agents can call every API they need while the secrets never enter their environment, logs, context window or generated code.
At a Glance
- Category
- Governance & Security
- Pricing
- Freemium, Subscription, Contact for pricing
- Target Market
- CISOs, Platform Engineers, DevOps Leads, Enterprise Developers, Security Architects
- Deployment
- Open-source, Self-hosted, Cloud-first, Hybrid
Key Features
- ✓Network-layer credential injection
The Rust gateway swaps a placeholder for the real secret before forwarding, so the agent process never holds the credential.
- ✓Universal interception path
Covers MCP tool calls, CLI commands, raw curl and model-generated code, because enforcement is at the network rather than the SDK.
- ✓AES-256-GCM encrypted vault
Secrets are stored encrypted and decrypted only at request time, with Bitwarden, 1Password and Vault supported as upstream stores.
- ✓Policy engine with endpoint blocking
Block specific endpoints such as DELETE operations, cap requests per agent per period, and scope credentials per project.
- ✓Human approval workflows
Flag sensitive operations for manual review before the gateway forwards them, adding a checkpoint the agent cannot bypass.
- ✓AWS SigV4 request re-signing
Rewrites and re-signs AWS requests after injection, which naive proxies cannot do because the signature covers the payload.
Capabilities
Use Cases
- •Secretless coding agents
Claude Code or Cursor Agent calls GitHub, AWS and Stripe through the gateway with no real key in its environment or context.
- •Blast-radius limits on autonomous runs
Endpoint blocking and per-agent rate limits cap what an unattended agent can do even if its instructions are compromised.
- •Auditing agent API activity
Every agent gets its own token and identity, so the audit log shows which agent called which service and when.
- •Approval gates on destructive operations
Route deletes, payments or production writes to a human for sign-off while routine reads pass straight through.
- •Fronting an existing secrets manager
Keep Bitwarden, 1Password or HashiCorp Vault as the source of truth and use OneCLI purely as the runtime injection layer for agents.
Ideal For
Best For
- ✓Teams running coding agents such as Claude Code, OpenAI Codex or Cursor Agent against real production APIs
- ✓Eliminating long-lived API keys from agent environment variables, shell history and model context windows
- ✓Enforcing per-agent rate limits and endpoint blocking so an agent cannot call destructive operations at all
- ✓Human-in-the-loop approval on sensitive API calls without rewriting the agent
- ✓Organisations already using Bitwarden, 1Password or HashiCorp Vault that want those stores fronted for agent traffic
Not Ideal For
- ✗Teams expecting it to stop prompt injection - the loudest criticism on its Show HN thread was exactly this, and it went largely unanswered: an agent that can still make legitimate API calls can still spend money, corrupt data or delete production, and hiding the credential does not change that
- ✗Environments that cannot tolerate a TLS-intercepting proxy; containers must trust the gateway certificate, and commenters noted older Node.js versions ignore HTTP_PROXY entirely, so coverage is not automatic
- ✗Regulated buyers who need certification today - SOC 2 Type II is described as in progress rather than achieved
- ✗Small teams whose needs are met by short-lived cloud IAM roles, where an extra network hop and a self-hosted dashboard add operational burden without adding much
Integrations
Deployment
Market Analysis
Pros
- ✓Removes long-lived credentials from the agent process entirely - practitioners on Hacker News reported running it against Anthropic, GitHub, Gemini, AWS and Cloudflare R2 APIs without issues
- ✓Network-layer interception covers every escape route including MCP calls, raw curl and model-generated code, which SDK-based approaches miss
- ✓Apache 2.0 with roughly 3,000 GitHub stars and 173 forks, so the injection and policy logic is auditable and self-hostable at no cost
- ✓Policy layer goes beyond secrets: endpoint blocking, per-agent rate limits, project scoping and human approval gates
- ✓Clear, published pricing metered on agents rather than seats, with a genuinely usable free tier
Cons
- ✗The dominant Show HN criticism was that it creates a false sense of security - hiding the credential does not stop a prompt-injected agent from making legitimate but destructive calls, and one commenter's 'they can still cost money or cause security problems or delete production' went largely unresolved by maintainers
- ✗TLS interception mechanics add real operational friction: containers must trust the proxy certificate, and commenters noted older Node.js versions ignore HTTP_PROXY, so an agent can silently bypass the gateway
- ✗Placeholder credentials trip enterprise secret scanners as false positives, a practical complaint raised on the same thread
- ✗Reviewers questioned the novelty, pointing to Fly.io's tokenizer, BuzzFeed's SSO proxy and HashiCorp Vault as established prior art for the auth-proxy pattern
- ✗SOC 2 Type II is only in progress, and self-hosting in your own VPC is gated behind the $499/mo Scale tier on the commercial plans
Pricing
Free
$0
- ✓3 users and 3 agents
- ✓500 integration calls per user per month
- ✓7-day audit log retention
- ✓Rate limit and block rules only
- ✓No SSO/SAML
Team
From $199/mo
- ✓10 users and 20 agents
- ✓Unlimited integration calls
- ✓30-day audit retention
- ✓All policy rules
- ✓SSO and SAML
Scale
From $499/mo
- ✓25 users and 50 agents
- ✓90-day audit retention
- ✓Self-hosting in your own VPC
- ✓Full feature set
Enterprise
Contact for pricing
- ✓Unlimited users, custom agent count
- ✓Custom audit retention
- ✓Custom VPC or on-premise deployment
Pricing is metered on agents rather than humans - OneCLI states explicitly that there is no per-seat charge for team members, and defines an agent as a unique identity for one AI actor such as Claude Code, Cursor, a CI bot or a custom script. Published tiers run Free at $0 (3 users, 3 agents, 500 integration calls per user per month, 7-day audit retention, no SSO), Team at $199/mo (10 users, 20 agents, unlimited calls, SSO and SAML), and Scale at $499/mo (25 users, 50 agents, 90-day retention) which is the first tier permitting self-hosting in your own VPC; Enterprise is quoted. Note that the code is Apache 2.0 on GitHub, so a self-managed deployment is possible without any subscription - the paid tiers buy the hosted control plane, SSO, longer audit retention and the full policy engine.
Security & Compliance
Connect
Sources
This page was written from 5 sources, 3 on domains other than onecli.sh.
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
OpenAI Daybreak
Vetted-access frontier AI for cyber defenders, with a purpose-built offensive-security model
NVIDIA OpenShell
Open-source, kernel-isolated sandbox runtime for autonomous AI agents
Zenity
Runtime AI agent security that blocks a harmful agent action before it executes
Saviynt Zuma
Identity control plane for AI agents and non-human identities, with runtime authorization