OneCLI
Open-source gateway that lets AI agents call APIs without ever seeing your real API keys — real secrets are injected transparently at the network level.
🔗 Visit OneCLI
Description
Giving an AI agent your real API keys so it can use a tool is a bit like handing someone your house keys because they need to water one plant — if the agent misbehaves, leaks a prompt, or gets manipulated, it can do anything that key allows. OneCLI fixes that by giving agents fake, placeholder keys instead: the agent never sees the real secret, and a small gateway swaps in the actual credential only at the moment a request actually goes out to the real service. OneCLI is an open-source (Apache 2.0) credential gateway built specifically for AI agents. Agents make normal API calls using placeholder tokens; a Rust-based gateway intercepts those calls and injects the real, AES-256-GCM-encrypted credentials as headers or URL parameters, matched by host and path rules, with secrets decrypted only at request time. It enforces access at the network layer — working across MCP servers, CLI tools, curl commands and agent code — and includes endpoint blocking, per-agent rate limiting, and approval workflows for sensitive operations, managed through a Next.js dashboard. Installation is a one-line script (`curl -fsSL https://onecli.sh/install | sh`) that starts the gateway, vault and dashboard together. It's free for up to 2 agents with no credit card required, with paid tiers for more agents and enterprise features.
💬 Our review
The short version: OneCLI addresses a genuinely underserved risk — most teams either give agents raw API keys directly (dangerous) or build ad-hoc credential-scoping themselves (slow) — and doing the injection at the network layer rather than inside the agent's own code is the right architectural choice, since it works even if the agent's code is buggy or compromised.
It sits in a space adjacent to secrets managers like HashiCorp Vault and Infisical, but those weren't built with the specific threat model of an LLM potentially reading or leaking its own credentials — OneCLI's whole design assumes the agent should never see the real secret at all, which those general-purpose vaults don't guarantee by default. LiteLLM overlaps in the sense of gatewaying LLM traffic but focuses on model routing rather than third-party API credential isolation. Being open source and genuinely free for small setups (2 agents, no card) makes it low-risk to try; the honest catch is that it's a young, community-scale project (2,500+ stars) rather than an enterprise-hardened platform, so a team with strict compliance requirements should evaluate it carefully before betting production credential security on it.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Pros
Open source (Apache 2.0), self-hostable, one-line install
Agents never see real credentials — injection happens at the network layer
Works across MCP, CLI, curl and agent code, not tied to one framework
Cons
Young, community-scale project rather than an enterprise-hardened vault
Overlaps with general secrets managers (Vault, Infisical) that already handle credential storage
Paid tier pricing beyond the 2-agent free tier isn't fully public
❓ Frequently asked questions
- How does OneCLI keep API keys away from the AI agent?
- The agent uses a placeholder token in its requests. A gateway intercepts the call and swaps in the real, encrypted credential only at the moment the request actually leaves — so the agent's code, logs or memory never contain the real secret.
- Do I need to change my agent's code to use OneCLI?
- Generally no — it works at the network layer across MCP servers, CLI tools, curl commands and existing agent code, so requests just get routed through the gateway.
- Is OneCLI actually open source?
- Yes, it's Apache 2.0 licensed and developed publicly on GitHub, with over 2,500 stars as of mid-2026.
- How are credentials stored?
- In an AES-256-GCM encrypted vault, decrypted only at request time and matched to specific host/path rules — not kept in plaintext anywhere the agent can read.
- Is it worth the money compared to alternatives?
- It's free for small setups (up to 2 agents), which makes it essentially risk-free to try. Compared to running HashiCorp Vault or Infisical alone, OneCLI adds the specific agent-facing placeholder-token layer those tools don't provide by default — worth adding on top if you're specifically worried about agents leaking real credentials.
- Which tool should you pick for your case?
- Specifically isolating AI agents from real API credentials: OneCLI. Already have a mature secrets manager and just need general secret storage: HashiCorp Vault or Infisical. Need to manage and route LLM API traffic itself, not third-party credentials: LiteLLM.