OneCLI
Hacker ApprovedThe most recommended of 20 secrets managers
Open-source gateway that keeps real API keys away from AI agents by swapping placeholders at the proxy. Critics warn it may give false security and that the proxy is trusted.
Open-source gateway that keeps real API keys away from AI agents by swapping placeholders at the proxy. Critics warn it may give false security and that the proxy is trusted.
47 people gave an opinion
- recommend it
- 39
- criticize it
- 8
- approval share
- 83%
Recommended in 6 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 39 people recommend itNeeds 10 or more, met.
- 4.9 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 6 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Keeps real credentials out of agent context
“userpsace HTTP proxies are a good start and should make unlikely that a secret gets into the context window”
Comment from 24 Mar 2026 in “NanoClaw Adopts OneCLI Agent Vault” “Keeping the real credential out of model context is a meaningful improvement”
Comment from 19 Aug 2026 in “Launch HN: OneCLI (YC S26) – OSS sandboxed agent harness for teams” “the agent never holds your keys and all its traffic goes to onecli gateway”
Comment from 20 Aug 2026 in “Launch HN: OneCLI (YC S26) – OSS sandboxed agent harness for teams” - Comment from 24 Mar 2026 in “NanoClaw Adopts OneCLI Agent Vault”
- Comment from 24 Mar 2026 in “Show HN: OneCLI – Vault for AI Agents in Rust”
Placeholder swapped for real key at proxy
“the real secrets live in a separate container it has no way to reach”
Comment from 24 Mar 2026 in “NanoClaw Adopts OneCLI Agent Vault” “This is solved by OneCLI and OpenShell via MITM proxies which seems more elegant to me.”
Comment from 20 Jun 2026 in “Hide Secrets from AI Agents and NPM install using Airgap” “The placeholder-to-real-credential swap via proxy is the right abstraction.”
Comment from 13 Mar 2026 in “Show HN: OneCLI – Vault for AI Agents in Rust” - Comment from 12 Mar 2026 in “Show HN: OneCLI – Vault for AI Agents in Rust”
Blocks credential exfiltration via prompt injection
“This seems to prevent your keys from being exfiltrated through prompt injection.”
Comment from 12 Mar 2026 in “Show HN: OneCLI – Vault for AI Agents in Rust” “it does help protect against the agent leaking private credentials”
Comment from 24 Mar 2026 in “NanoClaw Adopts OneCLI Agent Vault” Policy enforced at proxy for all agents
“The "policy in one place, enforced across every agent" part is the piece I would have underrated a year ago.”
Comment from 21 Aug 2026 in “Launch HN: OneCLI (YC S26) – OSS sandboxed agent harness for teams” “the real secrets live in a separate container it has no way to reach”
Comment from 24 Mar 2026 in “NanoClaw Adopts OneCLI Agent Vault”
What people warn about
Each mark is one comment
Does not stop misuse of authorized access
“I mean it's just not solving the problem right? If the model got injected then whatever the wrapper do can not prevent the consequences?”
Comment from 13 Mar 2026 in “Show HN: OneCLI – Vault for AI Agents in Rust” “OneCLI assumes that the proxy is fully trusted by the agent and it still has authorized access to your accounts.”
Comment from 30 Mar 2026 in “Bitwarden Integrates with OneCLI Agent Vault” Black box, not a real vault
“Now I have to share my creds with a black box that I know very little about and it’s not a real vault.”
Comment from 13 Mar 2026 in “Show HN: OneCLI – Vault for AI Agents in Rust” “Don't see any reason to use this over vault.”
Comment from 12 Mar 2026 in “Show HN: OneCLI – Vault for AI Agents in Rust”
Other secrets managers people recommend
The four most recommended other secrets managers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| OneCLIThis page | 39 | 8 | 83% | 6 | — | Approved |
| SOPS | 28 | 5 | 85% | 10 | — | Approved |
| HashiCorp Vault | 26 | 10 | 72% | 10 | — | Approved |
| fnox | 20 | 4 | 83% | 9 | — | Approved |
| Agent Vault | 20 | 3 | 87% | 5 | — | Approved |
What people said
40 of the 53 comments that mention it, newest first. Each links to the original comment.
“I think things like onecli are the direction we will take.”
“The provenance-tracing approach is the right foundation, but there's a nasty edge case worth flagging”
“The "policy in one place, enforced across every agent" part is the piece I would have underrated a year ago.”
“Reach and blast radius are different problems”
“I started using OneCLI when Nanoclaw (came out just after Open Claw) announced them as the way to handle credentials.”
“Looks good , but I don't understand the licensing.”
“the agent never holds your keys and all its traffic goes to onecli gateway”
“was already discoverable and in a usable state before today”
“Keeping the real credential out of model context is a meaningful improvement”
“20 agents for $499/month without API costs included feels steep”
“This is the same old good way from database world.”
“blocking it on the network level is nice”
“It works great for static credentials.”
“Nice! I've built something like this”
“This is solved by OneCLI and OpenShell via MITM proxies which seems more elegant to me.”
“OneCLI is a solid approach for agent credential management.”
“It seems far from vibe coded looking at those stats alone.”
“OneCLI assumes that the proxy is fully trusted by the agent and it still has authorized access to your accounts.”
“it does help protect against the agent leaking private credentials”
“I love the idea of agents not holding the credentials”
“deterministic constraints enforced at the proxy level before a request ever hits the API”
“the real secrets live in a separate container it has no way to reach”
“userpsace HTTP proxies are a good start and should make unlikely that a secret gets into the context window”
“Great tool. Yours is much more sophisticated than mine”
“This is a smart approach, giving agents access without exposing secrets is definitely needed.”
“The placeholder-to-real-credential swap via proxy is the right abstraction.”
“What seems genuinely new to me is the approval layer”
“I mean it's just not solving the problem right? If the model got injected then whatever the wrapper do can not prevent the consequences?”
“Looks like OneCLI combines both into one tool, which is the right call.”
“Now I have to share my creds with a black box that I know very little about and it’s not a real vault.”
“This seems to prevent your keys from being exfiltrated through prompt injection.”
“the proxy key is for your local network, it ain't got no value on the interwebz”
“The last note about configuring hosts to credentials is an excellent idea”
“the only thing it prevents is agents from directly sharing the credentials through git or something”
“The proxy-intercept approach is the right architecture.”
“The proxy fills that gap.”
“Don't see any reason to use this over vault.”
“This is the right approach.”
“I like the idea in general, so it's good too see this pulled out.”
“The fake key for real key thing seems like a problem.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.