Keep API keys away from coding agents with OneCLI

OneCLI is worth evaluating if your agents need API access but you do not want raw keys sitting in prompts, project files, shell history, or agent memory.

What it is

OneCLI is an open-source credential gateway with a built-in vault. You store real API credentials once, give an agent a placeholder key, and route outbound HTTP calls through OneCLI. The gateway matches the target host and path, decrypts the right secret, and injects it into the request so the agent never sees the real credential.

The repository describes a Rust gateway, a Next.js dashboard, AES-256-GCM encrypted storage, host/path matching, per-agent access tokens, and optional Bitwarden-style vault integration.

Who it helps

Use it when you are experimenting with Codex-style agents, Claude Code, MCP tools, local automations, or internal agent workflows that need to touch multiple APIs. The cleanest fit is a local or small-team setup where credential exposure is the main risk and you want one place to rotate keys, scope agent access, and inspect what each agent is doing.

How to evaluate it

Start in a throwaway local workspace. Read the README, inspect the Docker compose setup, review how secrets are encrypted, and test with a non-critical API token first. Confirm whether the gateway behavior fits your agent stack before connecting production accounts.

Limits and risks

OneCLI reduces direct key exposure, but it does not make an unsafe agent safe. A compromised or prompt-injected agent may still call allowed services through the gateway. You still need scoped API keys, logging, rate limits, approval gates for destructive actions, and a clear rotation plan. The HTTPS interception model also deserves careful review before team or production use.

Access and pricing

The visible repository is open source under Apache-2.0. The project also links to a website and docs; check the current hosted or team offering separately if you need managed deployment.

Sources

• OneCLI GitHub repository
• OneCLI website