OneCLI

OneCLI is an open-source credential gateway for AI agents. It is built around the idea that agents should get access to services without ever seeing the underlying secrets, with credentials injected at the network layer and kept in an encrypted vault. The page presents it as a way to keep API keys out of prompts, logs, and agent-controlled workflows.

Its gateway routes API calls through OneCLI rather than sending them directly from the agent to the service. The stated policy features include blocking specific endpoints, rate limiting per agent, requiring human approval for sensitive operations, and scoping credentials to individual projects. The page also describes a full audit trail that shows which agent made each API call and when, and it says credentials are stored in a local KMS or in OneCLI Cloud and are never written to disk in plain text.

OneCLI is described as framework-agnostic and suitable for coding agents and autonomous workflows. Examples named on the page include OpenClaw, NanoClaw, IronClaw, Dify, n8n, OpenHands, and custom pipelines that make HTTP calls. The delivery model is a single Docker container, with the gateway, vault, and dashboard running from one docker run command. The page also states that it is available through Docs, Pricing, GitHub, Contact Sales, and Get Started links, and shows a Docker image reference.