The Identity Gateway for AI Agents
🏆 TL;DR
OneCLI is an open-source credential gateway for AI agents.
When an agent makes a call, OneCLI swaps in the real credential at the network layer and forwards it. The agent never touches the secret, you can't steal what isn't there.
320K+ downloads, 2,500+ GitHub stars, and the default credential layer in NanoClaw (30K+ stars).
Ask: If your team runs coding agents (Claude Code, Codex, Cursor) or autonomous agents in production. And if you can intro us to Head of DevOps or heads of DevSecOps at companies rolling out AI agents, email us at jonathan@onecli.sh
Sign up for free: https://onecli.sh
The Problem
AI agents are doing real work now, which means they need real credentials: API keys, database passwords, OAuth tokens. And there's no safe way to hand them over.
Today, every team does one of two things: hardcode secrets into .env files the agent can read, or build a one-off proxy hack. Both mean the agent holds the secret. An agent that holds a secret can leak it, through prompt injection, a malicious MCP server, a compromised dependency, or simply by pasting it into a log or a commit.
Secrets management was designed for humans and deterministic software. Autonomous agents that read untrusted webpages, install packages, and write their own code are a fundamentally different threat model. The blast radius of one leaked production key is enormous, and teams are granting agents more access every week.
Our Solution
OneCLI moves the credential out of the agent entirely.
You run one command, and every outbound call from your coding agent (Claude Code, Codex, Cursor, Cline) or autonomous agent (OpenClaw, Hermes, NanoClaw) routes through OneCLI. The agent only ever sees placeholder tokens. On each request, the proxy:
- Matches the request by host/path
- Checks it against policy
- Swaps the placeholder for the real credential
- Forwards the request
The agent never holds the secret, so there's nothing to steal, log, or exfiltrate.
Secrets are AES-256-GCM encrypted at rest. The whole thing runs in a single Docker container with no external dependencies. It works with anything that can set HTTPS_PROXY.
For teams, we already support integration with IdPs and organization-wide policy setup, giving you full control and visibility over every access made by your agents.
Why this and not the PAM/identity vendors?
Because the credential problem for agents is a network problem, not an identity problem. Vault-based tools (1Password, HashiCorp Vault) still hand the secret to the agent to authenticate. The agent holds it, so the agent can leak it. OneCLI injects the credential at the wire: transparent injection, policy enforced on every outbound request, and the secret never enters the agent's context in the first place.
The Team
We've spent our careers in security. Guy (CTO) was the first hire at Argon (acquired by Aqua Security). Jonathan (CEO) worked on ZTNA and network security at Axis Security (acquired by HPE), after serving in Israeli Military Intelligence.
We hit this problem ourselves. Before OneCLI we built ChartDB together, an open-source database tool with 20K+ GitHub stars, and while building an agent orchestration layer on top of it, we kept hitting the same wall: there was no safe way to hand an autonomous agent credentials. Every team we talked to was either hardcoding API keys or duct-taping proxies. So we built the thing we wished existed.
The Ask
If you know a Head of DevOps or DevSecOps lead at a company rolling out AI agents, we'd love an intro.
