onecli/onecli

Open-source credential gateway with a built-in vault. give your AI agents access to services without exposing keys.

What it solves

OneCLI 提供了一种安全的方式，让 AI 代理在不需要自行持有原始 API 密钥的情况下访问外部 API。这消除了将凭证写入代理代码或配置文件的安全风险，让开发者能够集中管理密钥并进行轮换。

How it works

OneCLI 充当 AI 代理与其调用的服务之间的开源网关。您将真实的 API 凭证存放在加密保险库（AES-256-GCM），并为代理提供占位键。当代理通过网关发起 HTTP 请求时，OneCLI 会根据主机和路径模式匹配正确的凭证，将占位键替换为真实密钥，并注入到外发请求中。代理永远不会看到真实的秘密。

Who it’s for

需要安全地与多个第三方 API 交互的 AI 代理开发者。

Highlights

Transparent credential injection: Agents make standard HTTP calls while the gateway handles authentication.
Rust-powered gateway: A fast, memory-safe gateway for intercepting and injecting credentials.
Encrypted storage: Secrets are encrypted at rest and only decrypted at request time.
Multi-agent support: Each agent is assigned its own access token with scoped permissions.
Vault integration: Ability to connect to password managers like Bitwarden for on-demand injection.
Easy deployment: Quick start via a single curl command or Docker Compose.