OneCLI: The Open-Source Credential Gateway Locking Down AI Agent Secrets

#onecli #aiagents #credentialgateway #secretsmanagement

OneCLI is a YC-backed open-source credential gateway that injects API keys into AI agents at the network layer instead of letting them store raw secrets in memory.

AI agents running code-generation, automation, or data-pipeline tasks routinely carry API keys for services like OpenAI, Stripe, and GitHub. A leaked prompt or logged conversation can expose those tokens in plain text, a risk that grows alongside the rapid adoption of agent frameworks like Remote OpenClaw's 13,000-server ecosystem and screen-recording agents such as Screenpipe that give AI persistent memory. Y Combinator lists OneCLI as the defaults credential layer for the 30,000-star NanoClaw framework, built specifically to solve this problem. Founded by Guy Ben Aharon and Jonathan Fishner, the tool intercepts outbound HTTPS traffic through a Rust-based proxy, resolves each destination against a policy engine, and swaps placeholder tokens for real credentials before the request leaves the machine.

Key Takeaways:

OneCLI runs as a single Docker container with no external dependencies and uses AES-256-GCM to encrypt the credential vault.
Agents never see real secrets; they send placeholder tokens that the proxy replaces at request time via host/path rules.
The project has 2,700+ GitHub stars, 320,000+ downloads, and is backed by Y Combinator's Summer 2026 batch.
The MITM TLS interception model introduces its own trust boundary that teams should evaluate before deploying.

How does OneCLI protect AI agent credentials?

OneCLI works as a transparent HTTPS proxy, similar to how tools like mitmproxy operate but purpose-built for the AI agent threat model. When an agent process calls export HTTPS_PROXY=http://localhost:8080, all outbound requests flow through OneCLI before reaching their destination. The proxy maintains an internal certificate authority that signs certificates on the fly, allowing it to inspect and modify traffic that would otherwise be opaque.

The critical piece is what happens inside the proxy. Rather than injecting secrets into the agent's environment variables or configuration files, which live on disk and in memory where prompts, logs, and debug output can read them, OneCLI uses a host-and-path matching system to associate API keys with specific destinations. An agent might be configured with a placeholder like $ONECLI_KEY_OPENAI, and when that request targets api.openai.com, the proxy looks up the matching rule, decrypts the real key from its AES-256-GCM vault, attaches it as a Proxy-Authorization header, and forwards the request. The agent never knows the real value.

This design matters because modern AI agents increasingly run autonomously, sending hundreds or thousands of requests per session. A misconfigured system prompt or an unexpected tool invocation could expose a bearer token that persists in logs, databases, or user-visible outputs. OneCLI removes the attack surface entirely by keeping secrets outside the agent's observable runtime.

Why existing vault tools fall short for AI agents

Teams already using HashiCorp Vault, AWS Secrets Manager, or Doppler have mature secret-management workflows. But these systems require agents to actively fetch and manage credentials, typically through SDK calls, environment variable injection, or file mounts. Neura.markets describes the core gap: traditional PAM tools are designed for human operators and long-lived sessions, not autonomous agents making bursty API calls through unpredictable code paths.

OneCLI sidesteps the SDK problem entirely. Because it operates at the HTTP transport layer, any framework including LangChain, CrewAI, OpenClaw, and custom scripts works without code changes. You set HTTPS_PROXY and define policy rules. That covers OpenAI completions, Stripe webhook verification, GitHub Actions tokens, Slack bot APIs, and essentially every HTTP-callable service without touching application logic. The founder's DEV tutorial walks through this compatibility claim, showing that frameworks ranging from OpenAI's Python SDK to cURL and code-generated agent pipelines all work identically.

The tradeoff is that this convenience comes with a trust assumption: your agent must trust the proxy's local CA. If a compromised agent process gains access to the proxy's socket or the CA private key stored on disk, it could issue requests impersonating any destination the policy allows. Compare this to tools like Meterbility that let you pause and rewind agent runs after the fact. OneCLI prevents the leak before it happens.

Build status and ecosystem traction

OneCLI moved from a Show HN post on March 2026 to Y Combinator's Summer batch within weeks. The company page lists founders Guy Ben Aharon and Jonathan Fishner and reports over 320,000 downloads across six months, positioning it as a top signal in the fast-growing agent security space.

The GitHub repository shows 304 commits, 2,700 stars, 155 forks, and an Apache 2.0 license. Development activity is consistent: as of July 24, 2026, the team released version 1.42.0 and pushed policy and authentication improvements on the same day. The codebase includes a versioned REST API (v1), application-permission mappings, CLI credential management, and a Docker Compose configuration for production deployment.

The project has also become the default credential layer for NanoClaw, another YC-backed agent framework with 30,000 GitHub stars. NanoClaw's agents inherit OneCLI transparently rather than requiring manual integration, which accelerates adoption across the broader agent ecosystem.

What to watch before you deploy

OneCLI's transparent proxy approach solves an actual problem: agent-held secrets are a well-known risk that Agent Wars documented in detail, distinguishing this approach from both HashiCorp-style vaults and human-centric privileged access management tools. However, two considerations deserve attention.

The MITM CA model means OneCLI sits at the edge of your trust boundary. The proxy needs the CA key stored locally so it can sign certificates for arbitrary destinations. On a shared or multi-tenant machine, a privilege escalation vulnerability could expose that key. Teams running agents in untrusted environments should audit the Docker container's isolation carefully and consider running OneCLI in a separate network namespace.

The project is also early-stage. Version 1.42.0 reflects rapid iteration, which is good for fixing bugs quickly but means API surfaces and configuration formats may shift before a 2.0 release. Organizations that need long-term stability guarantees should treat OneCLI as a promising solution to prototype with today and pair it with a fallback plan of direct credential rotation and monitoring until the project matures further.

If you're building or deploying AI agents that make external API calls, the question isn't whether secrets will leak eventually. It's how much exposure you want between now and then. OneCLI removes the needle from the haystack entirely by never putting it there in the first place. The project is free, requires minimal setup, and has earned serious backing from the developer community.

Conclusion

OneCLI addresses a real blind spot in AI agent security by moving credential management out of agent memory and into a transparent proxy. It is early stage, growing fast, and useful to test before any agent handling sensitive data goes into production.

Frequently Asked Questions

What is OneCLI and who made it?

OneCLI is an open-source credential gateway for AI agents, created by Guy Ben Aharon and Jonathan Fishner. It is backed by Y Combinator's Summer 2026 batch.

Does OneCLI require code changes to existing agent frameworks?

No. OneCLI operates as a transparent HTTPS proxy, so any agent that respects the HTTPS_PROXY environment variable works without modification. This includes LangChain, CrewAI, OpenClaw, and custom HTTP clients.

Is OneCLI suitable for production use today?

OneCLI is actively developed with 2,700+ GitHub stars and 320,000+ downloads. While it works well for prototyping and non-critical agents, teams handling high-value credentials should pair it with monitoring and have a credential rotation plan until the project reaches a stable 2.0 release.