OneCLI: Open-Source Gateway Lets AI Agents Use APIs Without Ever Seeing the Keys

Launch HN: OneCLI (YC S26) – OSS sandboxed agent harness for teams

OneCLI is an open-source credential gateway that sits between AI agents and the services they call. Instead of embedding real API keys in every agent, you store them once in OneCLI and give agents placeholder keys. When an agent makes an HTTP call, the gateway swaps the placeholder for the real key, decrypts it, and injects it into the request—so agents never see the secrets. Built with a Rust gateway and a Next.js dashboard, it supports AES-256-GCM encryption, host/path matching, multi-agent access tokens, and optional Google OAuth for teams.