onecli/onecli

Open-source credential gateway with a built-in vault. give your AI agents access to services without exposing keys.

What it solves

OneCLI 提供了一種安全的方式，讓 AI 代理在不需要自行持有原始 API 金鑰的情況下存取外部 API。這消除了將憑證寫入代理程式碼或設定檔的安全風險，讓開發者能集中管理密鑰並執行金鑰輪替。

How it works

OneCLI 作為 AI 代理與其呼叫的服務之間的開源閘道。您將真正的 API 憑證儲存在加密保險庫（AES-256-GCM），並為代理提供佔位鍵。當代理透過閘道發出 HTTP 請求時，OneCLI 會根據主機與路徑模式匹配正確的憑證，將佔位鍵替換為真實金鑰，並注入到外發請求中。代理永遠不會看到真實的祕密。

Who it’s for

需要安全地與多個第三方 API 互動的 AI 代理開發者。

Highlights

Transparent credential injection: Agents make standard HTTP calls while the gateway handles authentication.
Rust-powered gateway: A fast, memory-safe gateway for intercepting and injecting credentials.
Encrypted storage: Secrets are encrypted at rest and only decrypted at request time.
Multi-agent support: Each agent is assigned its own access token with scoped permissions.
Vault integration: Ability to connect to password managers like Bitwarden for on-demand injection.
Easy deployment: Quick start via a single curl command or Docker Compose.