OneCLI Open-Source Credential Gateway Secures AI Agent API Access

Introduction of OneCLI

OneCLI is a newly released open-source credential gateway designed to enhance security for AI agents. It functions as an intermediary between AI agents and the services they interact with, managing API keys and other credentials centrally.

Addressing AI Agent Security Risks

The primary motivation behind OneCLI is to mitigate the security risks associated with embedding raw API keys directly into AI agents. As AI agents often need to call numerous APIs, providing each agent with direct access to credentials creates a significant vulnerability. OneCLI centralizes credential management, allowing for easier key rotation, access control, and activity monitoring.

How OneCLI Operates

Users store real API credentials within OneCLI and provide AI agents with placeholder keys. When an agent initiates an HTTP request through the gateway, OneCLI intercepts the request, replaces the placeholder key with the actual, decrypted credential, and injects it into the outbound request. This process ensures that AI agents never directly handle sensitive secrets.

The system comprises a Rust-based HTTP gateway for intercepting and injecting credentials, a Next.js web dashboard for managing agents, secrets, and permissions, and an AES-256-GCM encrypted secret store. Credentials are decrypted only at the time of request and matched based on host and path patterns.

Key Features and Deployment

OneCLI offers transparent credential injection, encrypted secret storage, host and path matching for routing secrets, and multi-agent support with scoped permissions. It can be run locally via a curl install script or by cloning the GitHub repository and using Docker Compose. The quick start mode operates in a single-user, no-login configuration, with options for Google OAuth for multi-user environments.