hey HN, Jonathan and Guy here, creators of OneCLI ( https://onecli.sh/ ). OneCLI is an open source vault for AI Agents. Traditional vaults are used to store your secrets and, on de…

The secret vault for AI agents. Store once. Inject anywhere. Agents never see the keys. OneCLI is an open-source gateway that sits between your AI agents and the services they call. Instead of baking API keys into every agent, you store credentials once in OneCLI and the gateway injects them transparently. Agents never see the secrets. Why we built it: AI agents need to call dozens of APIs, but giving each agent raw credentials is a security risk. OneCLI solves this with a single gateway that handles auth, so you get one place to manage access, rotate keys, and see what every agent is doing. How it works: You store your real API credentials in OneCLI and give your agents placeholder keys (e.g. FAKE_KEY). When an agent makes an HTTP call through the gateway, the OneCLI gateway matches the request to the right credentials, swaps the FAKE_KEY for the REAL_KEY, decrypts them, and injects them into the outbound request. The agent never touches the real secrets. It just makes normal HTTP calls and the gateway handles the swap. Open http://localhost:10254, create an agent, add your secrets, and point your agent's HTTP gateway to localhost:10255. The Quick Start runs OneCLI in local mode (single-user, no login), so no .env or NEXTAUTH_SECRET is required. To enable Google OAuth for multiple users, set NEXTAUTH_SECRET and the Google credentials (see Configuration). We welcome contributions! Please read our Contributing Guide and Code of Conduct before getting started.