GitHub - onecli/onecli: Open-source credential vault, give your AI agents access to services without exposing keys.

OneCLI is an open-source credential vault and HTTP gateway designed to give AI agents access to external APIs without exposing real API keys. Agents use placeholder keys and make normal HTTP calls through the OneCLI proxy, which transparently swaps in the real credentials at request time. The gateway is built in Rust for performance and memory safety, while a Next.js dashboard handles secret management and permissions. Secrets are stored with AES-256-GCM encryption and decrypted only at request time. It supports multi-agent setups with scoped access tokens, runs with an embedded PGlite database (no external dependencies), and can be deployed via a single Docker command.