July 23, 2026
Fake keys, real drama
Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents
This new AI keykeeper wowed coders, but the comments turned into a secrets-manager showdown
TLDR: OneCLI wants to keep real passwords away from AI tools by swapping in the real ones behind the scenes. Commenters loved the idea but instantly turned the launch into a rivalry thread, with competitors popping up and one blunt critic questioning whether it helps if the AI already controls the computer.
A new open-source tool called OneCLI is pitching itself as the bouncer between AI bots and your private keys. The promise is simple: your automated helper can call apps and services without ever actually seeing the real passwords or access codes. For anyone worried their shiny new AI agent might accidentally leak the family jewels, that sounds like a dream. But on Hacker News, the real action wasn’t just the product — it was the instant comment-section cage match over who already built something similar, who does it better, and whether this whole setup actually solves the trust problem.
The strongest vibe? “Cool idea, but welcome to the battlefield.” One commenter cheered the launch and immediately asked who this is really for — solo coders, startups, or giant companies — while also name-dropping rival Infisical like a contestant entering the villa late. Others piled on with classic open-source energy: “Nice! I built something like this too,” followed by links to their own projects. That turned the thread into a low-key credential-broker flex-off, with competitors casually sliding into the replies.
And then came the sharpest hot take of all: if the AI controls the machine running OneCLI, does any of this really protect you? That brutally short comment landed like a mic drop. Meanwhile, one of the funniest reactions boiled the pitch down to pure survival logic: if the fake token leaks, the attacker gets absolutely nothing. So yes, OneCLI launched a product — but the community launched a whole debate about trust, copycats, and whether fake keys are genius or just security theater with better branding.
Key Points
- •OneCLI is an open-source credential gateway designed to keep API secrets out of AI agents by storing credentials centrally and injecting them into outbound requests.
- •The article describes a workflow where agents use placeholder keys and the gateway replaces them with real credentials at request time based on request matching.
- •Its architecture includes a Rust HTTP gateway, a Next.js dashboard and API, and an AES-256-GCM encrypted secret store.
- •OneCLI supports host and path-based credential matching, per-agent access tokens with scoped permissions, and local single-user or Google OAuth-based multi-user modes.
- •The project provides quick-start installation, Docker-based manual setup, and local development tooling built around PostgreSQL, Prisma ORM, pnpm, and Rust.