Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents
OneCLI: The Open-Source Secret Vault for AI Agents
OneCLI is an open-source credential gateway designed to act as a secure intermediary between your AI agents and the external services they interact with.
Instead of hardcoding sensitive API keys directly into every agent's configuration, you centralize your credentials within OneCLI. The gateway then handles the injection of these secrets transparently during runtime.
The Motivation: AI agents frequently require access to a vast array of APIs. However, distributing raw credentials to every agent creates a massive security vulnerability. OneCLI mitigates this by providing a single point of management for authentication, key rotation, and activity monitoring.
🛠 How It Works
The core mechanism involves replacing sensitive data with non-functional placeholders.
- Storage: You save your actual API keys in the OneCLI vault.
- Assignment: You provide your agents with a placeholder (e.g.,
FAKE_KEY). - Interception: When an agent initiates an HTTP request through the gateway, OneCLI identifies the request.
- Injection: The gateway swaps the placeholder for the actual secret.
Mathematically, the transformation looks like this:
Request Flow
🏗 System Architecture
| Component | Technology | Purpose |
|---|---|---|
| Rust Gateway | Rust | A high-performance HTTP proxy that intercepts requests and injects credentials. Uses Proxy-Authorization headers for agent auth. |
| Web Dashboard | Next.js | The management interface for configuring agents, secrets, and permissions. It serves as the API for the gateway. |
| Secret Handling | AES-256-GCM | Secrets are encrypted at rest and only decrypted at the exact moment of the request. |
🚀 Quick Start Guide
Option A: Automated Installation
Run the following command to get started immediately:
curl -fsSL https://onecli.sh/install | sh
Option B: Manual Deployment
- Clone the repository:
git clone https://github.com/onecli/onecli.git - Enter directory:
cd onecli - Launch via Docker:
docker compose -f docker/docker-compose.yml up -d --wait
Post-Installation:
- Navigate to
http://localhost:10254to access the dashboard. - Create your agent and input your secrets.
- Configure your agent to use
http://localhost:10255as its HTTP gateway.
Note: The Quick Start defaults to local mode (single-user, no login), meaning .env or NEXTAUTH_SECRET are not required. For team use, configure Google OAuth in the settings.
✨ Key Features
- Transparent Injection: Agents perform standard HTTP calls; the gateway manages the authentication layer.
- Secure Storage: Utilizes AES-256-GCM encryption for data at rest.
- Granular Routing: Supports host and path pattern matching to ensure the right secret goes to the right endpoint.
- Agent Isolation: Each agent is assigned a unique access token with specific scoped permissions.
- Rapid Deployment: One-line install script for the full stack (App + PostgreSQL).
- Flexible Auth: Choose between simple single-user mode or Google OAuth for organizational needs.
- High Performance: The gateway is written in Rust for memory safety and speed, supporting MITM interception for HTTPS.
- External Vaults: Integration with Bitwarden and other managers allows for on-demand injection without storing secrets on the OneCLI server.
📁 Project Organization
onecli/
├── apps/
│ ├── web/ # Next.js Dashboard & API (Port 10254)
│ └── gateway/ # Rust Credential Injector (Port 10255)
├── packages/
│ ├── db/ # Prisma ORM & Database Migrations
│ └── ui/ # Shared shadcn/ui components
├── docker/ # Dockerfile & Compose configurations
└── docs/ # Documentation
💻 Local Development
Prerequisites:
mise(for Node.js and pnpm management)- Rust toolchain
- Docker (for the PostgreSQL instance)
Setup Sequence:
mise install
pnpm install
cp .env.example .env
pnpm db:generate
pnpm db:up # Spin up PostgreSQL
pnpm db:migrate # Apply schema changes
pnpm dev # Launch web and gateway
Available Commands
| Command | Action |
|---|---|
pnpm dev | Starts the web app and gateway in development mode |
pnpm build | Creates a production-ready build |
pnpm check | Runs linting, type checks, and formatting |
pnpm db:up | Starts the PostgreSQL Docker container |
pnpm db:down | Stops the PostgreSQL container |
pnpm db:generate | Updates the Prisma client |
pnpm db:migrate | Executes database migrations |
pnpm db:studio | Launches the Prisma Studio GUI |
⚙️ Configuration
All environment variables are optional for local development.
| Variable | Description | Default |
|---|---|---|
DATABASE_URL | Connection string for PostgreSQL | See .env.example |
NEXTAUTH_SECRET | Required for Google OAuth / Multi-user | Single-user mode |
GOOGLE_CLIENT_ID | OAuth Client ID | — |
GOOGLE_CLIENT_SECRET | OAuth Client Secret | — |
SECRET_ENCRYPTION_KEY | Key for AES-256-GCM encryption | Auto-generated |
Contributing: We love community input! Please refer to our Code of Conduct and Contributing Guide.
License: Distributed under the Apache-2.0 license.
(Placeholder for project logo)