OneCLI – Secure Your AI Agents with an Open Source Credential Gateway

A new open-source project called OneCLI is addressing a critical security challenge in the rapidly evolving landscape of AI agents. Created by Jonathan and Guy, OneCLI acts as a secure network gateway that sits between AI agents and the services they need to access.

The problem it solves: Traditional security vaults provide credentials on demand, trusting users to keep them safe. However, with AI agents, this trust model breaks down because we can’t guarantee how agents will handle sensitive information – whether they store it insecurely or risk being manipulated through prompt injections.

OneCLI works by matching requests based on host/path, verifying the agent’s authorization, and then securely providing credentials without ever giving the agent permanent access. Secrets are either stored encrypted in the OneCLI vault or fetched in real-time from existing password managers like Bitwarden or 1Password. ## Key Features:

  • Network-level security: Enforces access controls before requests even reach services
  • Credentialless agents: Agents never store secrets locally, reducing attack surfaces
  • Human-in-the-loop approval: Requires manual verification for sensitive operations
  • Comprehensive audit logs: Tracks all access attempts and approvals
  • Works with any agent framework: Compatible with OpenClaw, Claude Code, Codex, Cursor, and more

The project began as a side effort while the creators were developing ChartDB, an open-source database tool. When they started using agents to automate tasks on top of ChartDB, they realized existing security approaches wouldn’t work.

“We needed some way to control the agent and stop prompt injections from tricking it into using its services for an attacker’s benefit,” Jonathan explained in a recent Hacker News post. “Not providing the keys to the agent + adding alerts or human-in-the-loop for sensitive operations, in case someone manipulates the agent.”

The creators use OneCLI themselves daily to manage access across various applications – from financial tools to email and calendars – with manual approval required for critical actions.