OneCLI

OneCLI is a self-hosted gateway that sits between agents and the APIs they call, so no agent process ever holds a real credential. You store the real keys once in OneCLI and hand each agent a placeholder — the README's example is literally FAKE_KEY. When the agent makes an ordinary HTTP call through the gateway, the gateway matches the request against a stored credential by host and path pattern, decrypts the real value, swaps it in as a header or a URL query parameter, and forwards the request.

Parts

Three pieces. A Rust gateway on port 10255 intercepts outbound requests and injects credentials, with agents authenticating to it by access token in a Proxy-Authorization header. A Next.js dashboard on port 10254 manages agents, secrets and permissions, and serves the API the gateway queries to resolve which credential belongs to a given request. The secret store holds credentials under AES-256-GCM at rest and decrypts only at request time. Persistence is PostgreSQL through Prisma. Each agent gets its own token with scoped permissions, so revocation and per-agent access review happen in one place rather than across a fleet of .env files.

There is also a vault integration that connects Bitwarden or another password manager for on-demand injection, which avoids storing the secret on the OneCLI server at all — the more interesting mode, since it leaves OneCLI holding routing rules rather than the secrets themselves.

curl -fsSL https://onecli.sh/install | sh

Or clone and docker compose -f docker/docker-compose.yml up -d --wait. The quick start runs in local mode: single user, no login, no .env or NEXTAUTH_SECRET needed. Multi-user means setting NEXTAUTH_SECRET and Google OAuth credentials, and Google is the only identity provider the README documents.

What it protects and what it doesn't

The gateway does MITM interception for HTTPS, which is the fact to read carefully. To swap a header on an outbound TLS request it must terminate the connection, so the agent has to trust the gateway's CA and the gateway sees every request and response body in plaintext. That makes it a high-value target holding both the credentials and the traffic, and the README does not discuss the CA distribution, pinning failures, or what happens to the intercepted bodies.

The more basic limit is scope. Hiding the key does not reduce what the key can do: an agent that can reach the gateway has the full authority of every credential mapped to it, for as long as it can send requests. That is genuinely useful against a leaked transcript, a logged environment variable, or a prompt-injected exfiltration of env — and it does nothing against an agent that is simply told to call the API destructively. Compare ephemeral-credentials, where rotation is structural because the credential expires on its own, and credential-compartmentalization, where the blast radius is bounded by splitting credentials across purpose-fit stores. OneCLI is neither; it is centralization plus concealment, with per-agent scoping as the only bound. It fits the HTTP-interception category in sandboxing-ai-agents, applied to credentials rather than to network reachability, and it inherits that category's usual weakness: everything depends on the agent not having another path out. pigeon is the complement: it narrows authority per delegation instead of hiding the key.

On watchlist despite the star count — the gate here is security posture, not traction: it terminates TLS and holds every secret with no published threat model or audit.

Repo: https://github.com/onecli/onecli — 2,924 stars, Apache-2.0, first commit March 2026. The README is a feature list with no published threat model or audit, which is a gap worth noting for a component whose whole job is holding secrets and terminating TLS.