# OneCLI

39 Hacker News commenters recommended OneCLI and 8 criticized it, November 2025 to November 2026. It was recommended in 6 of 13 months. It meets the Hacker Approved badge rule.

**Verdict:** Open-source gateway that keeps real API keys away from AI agents by swapping placeholders at the proxy. Critics warn it may give false security and that the proxy is trusted.

## Why people recommend it

- Keeps real credentials out of agent context (5 comments): "userpsace HTTP proxies are a good start and should make unlikely that a secret gets into the context window" ([source](https://news.ycombinator.com/item?id=47502418)) "Keeping the real credential out of model context is a meaningful improvement" ([source](https://news.ycombinator.com/item?id=49366194)) "the agent never holds your keys and all its traffic goes to onecli gateway" ([source](https://news.ycombinator.com/item?id=49370683))
- Placeholder swapped for real key at proxy (4 comments): "the real secrets live in a separate container it has no way to reach" ([source](https://news.ycombinator.com/item?id=47502679)) "This is solved by OneCLI and OpenShell via MITM proxies which seems more elegant to me." ([source](https://news.ycombinator.com/item?id=48605209)) "The placeholder-to-real-credential swap via proxy is the right abstraction." ([source](https://news.ycombinator.com/item?id=47369357))
- Blocks credential exfiltration via prompt injection (2 comments): "This seems to prevent your keys from being exfiltrated through prompt injection." ([source](https://news.ycombinator.com/item?id=47358129)) "it does help protect against the agent leaking private credentials" ([source](https://news.ycombinator.com/item?id=47505879))
- Policy enforced at proxy for all agents (2 comments): "The "policy in one place, enforced across every agent" part is the piece I would have underrated a year ago." ([source](https://news.ycombinator.com/item?id=49394663)) "the real secrets live in a separate container it has no way to reach" ([source](https://news.ycombinator.com/item?id=47502679))

## What people warn about

- Does not stop misuse of authorized access (2 comments): "I mean it's just not solving the problem right? If the model got injected then whatever the wrapper do can not prevent the consequences?" ([source](https://news.ycombinator.com/item?id=47360369)) "OneCLI assumes that the proxy is fully trusted by the agent and it still has authorized access to your accounts." ([source](https://news.ycombinator.com/item?id=47577344))
- Black box, not a real vault (2 comments): "Now I have to share my creds with a black box that I know very little about and it’s not a real vault." ([source](https://news.ycombinator.com/item?id=47359147)) "Don't see any reason to use this over vault." ([source](https://news.ycombinator.com/item?id=47354176))

## Alternatives hackers recommend

- [SOPS](https://hackerapproved.com/p/sops.md): 28 recommend
- [HashiCorp Vault](https://hackerapproved.com/p/hashicorp-vault.md): 26 recommend
- [Agent Vault](https://hackerapproved.com/p/agent-vault.md): 20 recommend
- [Kloak](https://hackerapproved.com/p/kloak.md): 13 recommend
- [AWS Secrets Manager](https://hackerapproved.com/p/aws-secrets-manager.md): 8 recommend

## Cite as

Hacker Approved, "OneCLI", https://hackerapproved.com/p/onecli/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).