{"slug": "show-hn-onecli-oss-credential-gateway-that-keeps-secrets-out-of-ai-agents", "title": "Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents", "summary": "Jonathan and Guy launched OneCLI, an open-source credential gateway that intercepts AI agent requests to swap placeholders for real secrets without exposing them to the agent, preventing prompt injection and unauthorized access. The proxy, written in Rust with AES-256-GCM encryption, works with any agent framework and enforces network-layer policies such as human-in-the-loop approval for sensitive actions.", "body_md": "hey HN, Jonathan and Guy here, creators of OneCLI. OneCLI is an open source vault for AI Agents. traditional vaults are used to store your secrets and, on demand, provide them to you all in a secure way, trusting the person to keep them safe. we figured that in the agent's world, this is not the case, as you don't know what happens with the secret after it's delivered to the agent, or where it was saved. or maybe someone even manipulated them to hand them over?\n\nfrom that understanding, we decided to build a network gateway that sits between your AI agents and the services they call. OneCLI matches the request by host/path, verifies the agent should have access, swaps the placeholder for the real credential, and forwards the request. the secrets set inside the OneCLI vault, encrypted on rest, or could fetch in realtime from your bitwarden / 1password wallets.\n\ndemo - [https://youtu.be/5e5pbPEzZfY](https://youtu.be/5e5pbPEzZfY)\n\nthe way we got to build OneCLI started by accident, even though our careers were in the security space. At the time, we actually worked on a devtool called ChartDB, an open-source DB tool. And once OpenClaw took off back in January this year, we started using it to orchestrate agents on top of ChartDB. We quickly understood there is a big issue around auth. Agents need credentials to do real work, but to give them those secrets would not be the best idea. they keep them in their memory and also write them down to local files and their sessions as plain text. From our perspective, agents can easily be fooled into giving up those API keys/secrets. So we needed some way to control the agent and stop prompt injections from tricking it into using its services for an attacker's benefit. Not providing the keys to the agent + adding alerts or human-in-the-loop for sensitive operations, in case someone manipulates the agent, and access logs are being audited.\n\nthe proxy is written in Rust, the dashboard is Next.js, and secrets are AES-256-GCM encrypted at rest. Everything runs in a Docker container. works with any agent framework (Claude Code, Codex, Cursor, OpenClaw, Hermes or anything that can set an HTTPS_PROXY).\n\nwe use it on ourselves daily. My OpenClaw runs my day across Attio, Gmail, and my calendar, with human-in-the-loop approval on sensitive actions. The approval is enforced at the network layer, so it holds whether the agent goes through MCP, CLI, curl, or code it wrote on the fly. for Guy its reviews PRs but can't merge without his approval. companies mostly use it for coding agents currently, which get creative about finding ways to elevate their permissions to reach the goal. With OneCLI, it doesn't matter what the agent finds, if the request isn't in policy, it will not go through.\n\nit won't stop an agent from misusing access it legitimately has, so scope policies tightly.\n\nhappy to answer anything. we believe we can't trust the model to behave and have to set deterministic rules to stay in control.\n\nComments URL: [https://news.ycombinator.com/item?id=49023427](https://news.ycombinator.com/item?id=49023427)\n\nPoints: 2\n\n# Comments: 0", "url": "https://wpnews.pro/news/show-hn-onecli-oss-credential-gateway-that-keeps-secrets-out-of-ai-agents", "canonical_source": "https://onecli.sh", "published_at": "2026-07-23 15:42:40+00:00", "updated_at": "2026-07-23 15:52:27.765024+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["OneCLI", "Jonathan", "Guy", "ChartDB", "OpenClaw", "Claude Code", "Codex", "Cursor"], "alternates": {"html": "https://wpnews.pro/news/show-hn-onecli-oss-credential-gateway-that-keeps-secrets-out-of-ai-agents", "markdown": "https://wpnews.pro/news/show-hn-onecli-oss-credential-gateway-that-keeps-secrets-out-of-ai-agents.md", "text": "https://wpnews.pro/news/show-hn-onecli-oss-credential-gateway-that-keeps-secrets-out-of-ai-agents.txt", "jsonld": "https://wpnews.pro/news/show-hn-onecli-oss-credential-gateway-that-keeps-secrets-out-of-ai-agents.jsonld"}}