⚡ Quick Summary
- OneCLI is a new open-source tool built in Rust that acts as an encrypted credential vault and HTTP proxy, preventing AI agents from ever directly accessing real API keys.
- The project targets a critical and growing security gap: autonomous AI agents are routinely given raw credentials to call external APIs, creating significant exposure risk at scale.
- GitHub's Secret Scanning detects millions of exposed credentials annually, and with AI agent adoption accelerating rapidly in 2024–2025, the attack surface has expanded dramatically.
- Existing enterprise secrets tools like HashiCorp Vault and AWS Secrets Manager were not designed for agentic AI workloads and don't provide the HTTP proxy pattern OneCLI offers.
- The tool's architecture aligns with emerging standards like Anthropic's Model Context Protocol and could become a foundational security layer as regulatory scrutiny of AI systems intensifies.
What Happened
A new open-source project called OneCLI has emerged from the Hacker News community, and it addresses one of the most quietly urgent security problems in modern software development: AI agents being handed raw API credentials with effectively no guardrails. Built in Rust — the memory-safe systems programming language increasingly favoured for security-critical infrastructure — OneCLI acts as an encrypted credential vault and HTTP proxy layer that sits between autonomous AI agents and the external services they interact with.
The core mechanic is elegantly simple but architecturally significant. Developers store their actual API keys — think OpenAI tokens, Stripe keys, GitHub Personal Access Tokens, AWS IAM credentials, or any HTTP-based service secret — inside OneCLI's encrypted local vault. AI agents are then issued lightweight placeholder tokens. When an agent initiates an outbound HTTP request through the OneCLI proxy, the gateway intercepts that call, strips the placeholder credential, injects the real secret, and forwards the authenticated request to the target service. The agent itself never touches the genuine credential at any point in the transaction.
The project was announced via a "Show HN" post on Hacker News, the community forum operated by Y Combinator that has historically served as a first-discovery platform for developer tools that go on to achieve significant adoption — HashiCorp Vault, Caddy, and countless other infrastructure projects made early waves there. The OneCLI team explicitly framed the problem in terms that will resonate with anyone who has spent time in enterprise AI deployments: "We built OneCLI because AI agents are being given raw API keys. And it's going about as well as you'd expect."
The project is released as open-source software, with the source code available for inspection, contribution, and self-hosted deployment. The choice of Rust as the implementation language is notable — it signals a serious commitment to performance and memory safety from the outset, characteristics that matter enormously in a proxy handling authentication tokens at scale.
Background and Context
To understand why OneCLI arrives at precisely this moment, you need to trace two converging trajectories: the explosive growth of agentic AI systems and the slow-motion disaster of secrets management in modern software development.
The secrets management problem is not new. GitHub has operated an automated Secret Scanning feature since 2018, and the statistics it produces are sobering. In its 2024 transparency reporting, GitHub disclosed that its automated systems detected and flagged millions of exposed credentials annually across public repositories. Research from the security firm GitGuardian has consistently found that roughly one in ten active developers inadvertently exposes a secret in their commit history at some point. Hardcoded credentials remain one of the OWASP Top Ten vulnerability categories year after year.
Existing solutions like HashiCorp Vault (first released in 2015), AWS Secrets Manager (launched 2018), Azure Key Vault (available since 2015), and Google Cloud Secret Manager (GA in 2020) have addressed this for human-operated infrastructure. But they were designed around a paradigm where a human developer or a well-defined CI/CD pipeline is the consumer of secrets. The authentication flows, audit logging, and access control models all assume relatively predictable, policy-bound actors.
Agentic AI systems broke that assumption entirely. Beginning in earnest with the release of AutoGPT in March 2023 — which became one of the fastest GitHub repositories to reach 100,000 stars in history — developers began building autonomous agents that could chain together dozens of tool calls across multiple external APIs without human intervention between steps. Shortly after, frameworks like LangChain, CrewAI, Microsoft AutoGen (released October 2023), and OpenAI's Assistants API with function calling (November 2023) gave this pattern enterprise legitimacy.
The problem: getting a LangChain agent to call the Stripe API means the agent runtime needs the Stripe API key. Getting it to commit code means it needs a GitHub token. The path of least resistance — and the path most tutorials and quickstart guides implicitly encourage — is to dump those keys directly into environment variables or configuration files accessible to the agent process. This is the credential hygiene equivalent of leaving your house key under the doormat and writing the address on it.
By 2024 and into 2025, with OpenAI's GPT-4o, Anthropic's Claude 3.5 Sonnet, and Google's Gemini 1.5 Pro all demonstrating multi-step agentic capability, the volume of production AI agents handling sensitive credentials reached a scale where the risk moved from theoretical to actively exploited. OneCLI is a direct product of that inflection point.
Why This Matters
OneCLI's arrival matters not primarily because of what the tool does today, but because of what its existence signals about where enterprise AI security is heading — and how unprepared most organisations currently are.
Consider the blast radius of a compromised AI agent credential. A human developer whose laptop is breached might expose the secrets stored locally. An AI agent operating at scale might be making hundreds of API calls per minute across a dozen services simultaneously. If a prompt injection attack — a vector OWASP formally added to its LLM Top Ten in 2023 — successfully exfiltrates the agent's credential store, the attacker doesn't just get one key. They potentially get every key the agent has ever needed. The attack surface scales with agent capability.
For IT security professionals, the architectural pattern OneCLI proposes — credential proxying with placeholder tokens — is conceptually aligned with how service mesh technologies like Istio handle mTLS between microservices, or how PAM (Privileged Access Management) solutions like CyberArk handle just-in-time credential injection for human users. The innovation OneCLI brings is making this pattern accessible to individual developers and small teams without requiring enterprise PAM infrastructure.
The Microsoft ecosystem specifically has a horse in this race. Microsoft Copilot Studio, available since November 2023 and now deeply integrated with Microsoft 365 and Power Platform, allows enterprise users to build custom AI agents that connect to external services via connectors and APIs. Azure AI Agent Service, announced at Microsoft Ignite 2024 and entering broader availability in early 2025, provides the infrastructure layer for running autonomous agents at scale. Neither product solves the fundamental credential exposure problem for custom integrations — organisations building agents that reach outside the Microsoft connector ecosystem must manage their own secrets, and most do so naively.
For businesses running Microsoft 365 environments and deploying Copilot-adjacent agents, understanding how to layer proper secrets management is now a governance requirement, not an optional best practice. Organisations investing in enterprise productivity software and building AI automation on top of it need to treat credential security for agent workloads with the same rigour they'd apply to any privileged access scenario.
There's also a compliance dimension. GDPR, SOC 2, ISO 27001, and the emerging EU AI Act all create frameworks under which uncontrolled credential exposure by AI systems could constitute a reportable security incident. The regulatory clock is ticking.
Industry Impact and Competitive Landscape
OneCLI enters a market that is simultaneously underdeveloped and about to become extremely crowded. The competitive landscape breaks into three tiers.
Enterprise PAM vendors — CyberArk, BeyondTrust, and Delinea — have the deepest credential management capabilities but price points and deployment complexity that make them inaccessible for individual developers or early-stage AI projects. CyberArk's Conjur, for instance, is powerful but carries implementation overhead measured in weeks, not hours. These vendors are beginning to eye the AI agent market; CyberArk's 2024 roadmap explicitly referenced machine identity for AI workloads, but concrete agentic-specific products remain nascent.
Cloud-native secrets services — AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager — provide robust managed vaults but require that your agent workloads run within their respective cloud ecosystems and that developers wire up SDK integrations manually. They're not proxies; they're vaults. The agent still receives the secret and holds it in memory, which means the exposure window exists even if the storage is managed. HashiCorp Vault, now under IBM's ownership following the $6.4 billion acquisition completed in December 2023, has begun exploring agent-specific patterns but hasn't shipped a purpose-built solution.
Emerging developer-focused tools represent OneCLI's most direct competitive tier. Doppler, which raised a $20 million Series A in 2021, offers secrets synchronisation across environments but again stops short of the proxy pattern. Infisical, an open-source HashiCorp Vault alternative that has gained significant traction since 2022, is closer in spirit but isn't specifically architected for AI agent workloads. 1Password's Secrets Automation product serves developers but focuses on developer machines, not agent runtimes.
The proxy-based approach OneCLI takes most closely resembles what some teams have built internally using Envoy or NGINX with custom credential injection middleware — but those are bespoke solutions requiring significant engineering investment. OneCLI's value proposition is packaging that pattern into an opinionated, purpose-built tool with a lightweight operational footprint, enabled by Rust's near-zero overhead.
For Microsoft specifically, OneCLI's open-source model represents both a complement and a quiet challenge. Azure Key Vault is a core Azure revenue component. If the developer community coalesces around a local-first, open-source proxy approach that reduces dependency on managed cloud secrets services, it could slow adoption of Microsoft's premium secrets management tiers, particularly among developers who are already cost-sensitive and building on non-Azure infrastructure. Organisations looking to reduce overall software costs — whether that means sourcing an affordable Microsoft Office licence or evaluating open-source alternatives to cloud services — will pay attention to tools like OneCLI.
Expert Perspective
From a security architecture standpoint, the OneCLI approach represents a pragmatic acknowledgment of developer reality. The conventional wisdom in enterprise security — that developers should integrate with enterprise-grade PAM systems and follow rigorous secrets rotation policies — has demonstrably failed to prevent credential exposure at the scale the industry now faces. The problem isn't that developers don't know better; it's that the friction of doing it right remains too high relative to the friction of shipping features.
OneCLI's design philosophy mirrors what the broader security industry calls "shifting left" — embedding security controls into the development workflow rather than bolting them on after deployment. By making the secure path (placeholder tokens through a proxy) as simple as the insecure path (direct credential injection), it aims to collapse that friction differential.
The Rust implementation deserves specific attention from a risk standpoint. Memory unsafety in credential-handling software is not a theoretical concern — the class of vulnerabilities that buffer overflows and use-after-free bugs enable in C or C++ code have been the root cause of major credential theft incidents historically. Building the proxy layer in Rust provides meaningful structural guarantees that a Python or Node.js implementation would not.
The open-source model cuts both ways. Transparency in security tooling is generally positive — the codebase can be audited, and the community can identify vulnerabilities quickly. But it also means the project's security guarantees are only as strong as its maintenance cadence and the rigour of its cryptographic implementation choices. Organisations considering production deployment should treat an independent security audit as a prerequisite, not an afterthought.
Looking forward, the most interesting strategic question is whether OneCLI's proxy pattern becomes a community standard that larger players absorb — through acquisition, open-source contribution, or simply by shipping competing features — or whether it evolves into a standalone product with enterprise-grade audit logging, RBAC, and SaaS deployment options.
What This Means for Businesses
For business decision-makers and IT leadership, the immediate action isn't necessarily to deploy OneCLI tomorrow — it's to audit your current AI agent deployments and honestly answer the question: where are your secrets right now?
If your engineering teams are building on LangChain, AutoGen, CrewAI, or any similar framework, the default assumption should be that API credentials are being handled less securely than your security policy requires. That's not a criticism of your developers; it reflects the current state of tooling and documentation across the ecosystem.
For organisations already invested in Azure infrastructure, the path of least resistance remains Azure Key Vault integration, particularly for agents running on Azure Container Apps or Azure Kubernetes Service. For teams building outside Azure, or for developer environments and local testing where full cloud PAM is overkill, OneCLI offers a compelling lightweight alternative worth evaluating. Businesses that have standardised on Windows environments and are deploying agent workflows on genuine Windows 11 developer machines should test OneCLI's Windows compatibility and local vault performance as a priority.
The broader message for businesses is structural: AI agent security is not a problem you can defer. As regulatory scrutiny of AI systems intensifies and as agents are given access to increasingly sensitive business systems — ERP connectors, CRM APIs, financial data feeds — the credential exposure surface becomes a board-level risk, not just a developer concern. Tools like OneCLI represent the beginning of a mature security ecosystem for agentic AI, and organisations that build good credential hygiene habits now will be significantly better positioned when compliance requirements inevitably catch up.
Key Takeaways
- OneCLI is a Rust-built, open-source HTTP proxy and encrypted vault that prevents AI agents from ever directly handling real API credentials, replacing them with placeholder tokens that are swapped at the proxy layer.
- The problem it solves is widespread and growing — with millions of credentials exposed annually on platforms like GitHub and AI agent adoption accelerating rapidly, insecure credential handling for agent workloads is one of 2025's most underappreciated enterprise security risks.
- Existing solutions don't fully address the agentic AI use case — enterprise PAM tools are too heavy, cloud secrets managers don't proxy, and developer-focused tools like Doppler and Infisical weren't designed for autonomous agent runtimes.
- Rust as the implementation language is a deliberate security signal, providing memory safety guarantees that are particularly valuable in software handling authentication secrets.
- Microsoft's AI agent ecosystem — Copilot Studio, Azure AI Agent Service, AutoGen — doesn't natively solve this problem for custom integrations, creating a gap that third-party tools like OneCLI can fill.
- The open-source model accelerates adoption but requires diligence — production deployments should await or commission independent security audits of the cryptographic and proxy implementation.
- Businesses should treat this as a forcing function for auditing current AI agent credential practices before regulatory frameworks make that audit mandatory rather than voluntary.
Looking Ahead
The trajectory for OneCLI and the broader credential-security-for-AI-agents space will be shaped by several converging forces over the next 12 to 18 months.
On the standards front, the Model Context Protocol (MCP), open-sourced by Anthropic in November 2024 and rapidly adopted by OpenAI, Google DeepMind, and Microsoft, is establishing itself as the standard interface layer between AI agents and external tools. How MCP's authentication model evolves — and whether it incorporates credential proxying natively — will directly affect how much standalone tooling like OneCLI is needed at the application layer versus handled at the protocol layer.
Regulatory developments in the EU AI Act's enforcement timeline (with high-risk AI systems facing compliance deadlines in 2025 and 2026) will create compliance pressure that could dramatically accelerate enterprise adoption of formalised agent credential management. NIST's ongoing AI Risk Management Framework updates are similarly likely to address agentic credential exposure explicitly.
Watch for HashiCorp/IBM, CyberArk, and potentially Microsoft Azure to announce agent-specific credential management features in 2025 — the market signal from projects like OneCLI will not go unnoticed by their product teams. Whether OneCLI itself pursues a commercial layer, accepts venture backing, or remains a pure open-source project will define whether it becomes infrastructure or inspiration for the products that follow it.
Frequently Asked Questions
What exactly does OneCLI do and how does its proxy model work?
OneCLI sits as an HTTP proxy between your AI agents and the external services they call. You register your real API credentials — Stripe keys, OpenAI tokens, GitHub PATs, and so on — in OneCLI's local encrypted vault. You then issue lightweight placeholder tokens to your agents. When an agent makes an outbound HTTP request through the proxy, OneCLI intercepts the call, replaces the placeholder with the real credential, and forwards the authenticated request to the target service. The agent process itself never holds or sees the genuine secret at any point, eliminating an entire class of credential theft scenarios including prompt injection exfiltration attacks.
Why isn't Azure Key Vault or AWS Secrets Manager sufficient for AI agent credential security?
Cloud-native secrets managers are vaults, not proxies. When an agent retrieves a secret from Azure Key Vault or AWS Secrets Manager, the secret is returned to the agent runtime process, which then holds it in memory for the duration of its API calls. That in-memory exposure window is exactly where prompt injection attacks and memory-scraping techniques can exfiltrate credentials. OneCLI's proxy model means the agent never receives the actual secret — the substitution happens at the network layer, outside the agent process. It's a fundamentally different security boundary than vault-retrieve-and-use patterns, and one that existing cloud secrets services don't currently offer for general HTTP workloads.
Is OneCLI production-ready and what should enterprises evaluate before deploying it?
As a newly announced open-source project, OneCLI should be treated as promising early-stage infrastructure rather than certified enterprise software. Before production deployment, organisations should evaluate: the maturity and completeness of its cryptographic implementation; whether an independent security audit has been conducted or is planned; its support for secrets rotation and audit logging; performance characteristics under high-throughput agent workloads; and Windows/Linux/macOS compatibility for their specific deployment environments. The Rust implementation is a positive indicator for memory safety and performance, but open-source security tooling benefits enormously from community review and third-party audits before handling production credentials at scale.
How does OneCLI relate to the Model Context Protocol (MCP) and emerging AI agent standards?
The Model Context Protocol, open-sourced by Anthropic in November 2024 and now adopted across the major AI labs including OpenAI and Google DeepMind, is establishing a standard interface for how AI agents communicate with external tools and data sources. MCP defines how tools are described and invoked but does not yet prescribe a comprehensive credential security model for the HTTP calls agents make through those tools. OneCLI operates at the transport layer beneath MCP — it would proxy the HTTP calls that MCP tool implementations make to external services. As MCP matures, its authentication specifications may evolve to incorporate proxy-based credential injection natively, which could either complement OneCLI's approach or reduce the need for standalone tooling depending on how the standard develops.