OneCLI Review 2026: The Secret Vault That Keeps API Keys Away From Your AI Agents

Here’s an uncomfortable question for anyone running AI agents in production: how many of your API keys are sitting in plaintext inside an agent’s environment right now? OneCLI’s answer is to stop handing agents keys at all. You store credentials once, give agents fake ones, and a gateway does the swap in flight.

At 2,943 stars and Apache-2.0 licensed, it’s one of the fastest-growing pieces of AI agent security tooling on GitHub.

What is OneCLI?

OneCLI is an open-source gateway that sits between your AI agents and the services they call. Instead of baking API keys into every agent, you store real credentials once in OneCLI and hand agents a placeholder like FAKE_KEY.

When an agent makes an HTTP call through the gateway, OneCLI matches the request against its host and path rules, decrypts the matching real credential, swaps it in, and forwards the request. The agent just makes a normal HTTP call. It never touches the secret.

There are three moving parts:

• A Rust gateway that intercepts outbound requests and injects credentials. Agents authenticate to it with access tokens via Proxy-Authorization headers.
• A Next.js dashboard for managing agents, secrets, and permissions.
• An encrypted secret store using AES-256-GCM, decrypted only at request time.

Getting started is a one-liner (curl -fsSL https://onecli.sh/install | sh) or a docker compose up. Local mode runs single-user with no login required.

Key features

• Transparent credential injection — agents make ordinary HTTP calls; the gateway handles auth invisibly.
• AES-256-GCM at rest — secrets are decrypted only at the moment a request needs them.
• Host and path matching — route the right credential to the right endpoint with pattern rules.
• Per-agent access tokens — each agent gets its own scoped token, so you can revoke one without touching the others.
• Vault integration — connect Bitwarden or another password manager for on-demand injection without storing secrets on the OneCLI server at all.
• Two auth modes — single-user local, or Google OAuth for teams.

Who should use it?

OneCLI makes the most sense once you have more than one agent calling more than a couple of APIs. That’s the point where credential sprawl becomes a real problem: keys copied into .env files, no idea which agent used which key, and a rotation that means touching a dozen configs.

It’s overkill if you’re running a single local agent against one API. The gateway is a component you have to run, and for a one-agent setup that overhead buys you very little.

If you’re already orchestrating fleets of agents — with something like wmux or a swarm of Claude Code instances — centralized credentials stop being a nice-to-have.

How it compares

Traditional secret managers like HashiCorp Vault or Doppler solve storage and distribution: they get the secret to your app securely, but the app still holds it. OneCLI’s difference is that the secret never reaches the agent at all — injection happens at the network hop.

That’s a meaningfully stronger posture when the thing holding the secret is an LLM that might print its environment into a log, a chat window, or a prompt injection payload.

The trade-off is architectural: you’re adding a proxy, and HTTPS interception means trusting the gateway’s MITM certificate.

Pros and cons

Pros: agents never see real secrets, encrypted at rest, per-agent scoped tokens, one place to rotate and audit, optional password-manager backing, Apache-2.0, easy install.

Cons: a new component to run and keep up; HTTPS interception requires trusting a MITM cert; self-hosting means owning Postgres, backups, and encryption keys; young project with a sizable open-issue count.

Pricing

Free and open source under Apache-2.0. You self-host it — the only cost is the infrastructure you run it on.

FAQ

Do my agents need code changes? No. They make normal HTTP calls with placeholder keys and point their HTTP gateway at OneCLI. The swap is transparent.

How are secrets stored? AES-256-GCM encrypted at rest, decrypted only at request time. You can also back it with Bitwarden so nothing is stored on the OneCLI server.

Can I use it with a team? Yes — enable Google OAuth for multi-user mode. Local mode is single-user with no login for quick local runs.

Is it a replacement for HashiCorp Vault? Not quite. Vault is a general-purpose secret manager; OneCLI is specifically an injection gateway for agents. They can coexist — Vault as the source of truth, OneCLI as the agent-facing hop.