OneCLI
Open-source gateway that lets AI agents call APIs without ever seeing your real API keys — real secrets are injected transparently at the network level.
🔗 Visit OneCLI
Description
Giving an AI agent your real API keys so it can use a tool is a bit like handing someone your house keys because they need to water one plant — if the agent misbehaves, leaks a prompt, or gets manipulated, it can do anything that key allows. OneCLI fixes that by giving agents fake, placeholder keys instead: the agent never sees the real secret, and a small gateway swaps in the actual credential only at the moment a request actually goes out to the real service.
OneCLI is an open-source (Apache 2.0) credential gateway built specifically for AI agents. Agents make normal API calls using placeholder tokens; a Rust-based gateway intercepts those calls and injects the real, AES-256-GCM-encrypted credentials as headers or URL parameters, matched by host and path rules, with secrets decrypted only at request time. It enforces access at the network layer — working across MCP servers, CLI tools, curl commands and agent code — and includes endpoint blocking, per-agent rate limiting, and approval workflows for sensitive operations, managed through a Next.js dashboard. Installation is a one-line script (`curl -fsSL https://onecli.sh/install | sh`) that starts the gateway, vault and dashboard together. It's free for up to 2 agents with no credit card required, with paid tiers for more agents and enterprise features.
💬 Our review
The short version: OneCLI addresses a genuinely underserved risk — most teams either give agents raw API keys directly (dangerous) or build ad-hoc credential-scoping themselves (slow) — and doing the injection at the network layer rather than inside the agent's own code is the right architectural choice, since it works even if the agent's code is buggy or compromised.
It sits in a space adjacent to secrets managers like HashiCorp Vault and Infisical, but those weren't built with the specific threat model of an LLM potentially reading or leaking its own credentials — OneCLI's whole design assumes the agent should never see the real secret at all, which those general-purpose vaults don't guarantee by default. LiteLLM overlaps in the sense of gatewaying LLM traffic but focuses on model routing rather than third-party API credential isolation. Being open source and genuinely free for small setups (2 agents, no card) makes it low-risk to try; the honest catch is that it's a young, community-scale project (2,500+ stars) rather than an enterprise-hardened platform, so a team with strict compliance requirements should evaluate it carefully before betting production credential security on it.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Free: up to 2 agents, no credit card. Paid tiers for more agents and enterprise features (pricing not fully public).
Pros
Open source (Apache 2.0), self-hostable, one-line install
Agents never see real credentials — injection happens at the network layer
Works across MCP, CLI, curl and agent code, not tied to one framework
Cons
Young, community-scale project rather than an enterprise-hardened vault
Overlaps with general secrets managers (Vault, Infisical) that already handle credential storage
Paid tier pricing beyond the 2-agent free tier isn't fully public