OneCLI

HackerNews discussion (top threads at +161/+146) treats OneCLI as an open-source credential gateway for LLM/CLI agents: it runs in a separate container as an HTTPS proxy, auto-configures agent containers with proxy env vars plus a local CA cert, terminates TLS on intercepted domains, swaps placeholder tokens for real credentials, and forwards upstream. One user reports running it against Anthropic, GitHub, Gemini, AWS and Cloudflare R2 APIs for a while with no issues, and added per-host credential scoping so replacement/resigning only happens on matching hosts — preventing leaks to malicious hosts. Reception is a mix of validation and pushback. Several commenters built near-identical systems: a Kubernetes sidecar with iptables MITM (specifically because Node ignores HTTP_PROXY), mitmproxy-based setups for opencode web, macaroon-based granular grants, and HashiCorp Vault scripts with time-scoped expiration. Critics argue the problem isn't agent-specific — fly.io's tokenizer and BuzzFeed's SSO proxy solved auth-proxying long ago — and that OneCLI reinvents Vault without RBAC, least privilege, or properly scoped NPE credentials, becoming a black box that holds all your real secrets. Security skeptics note a prompt-injected agent can still exfiltrate the honest agent's proxy authorization token (the gateway can't tell requests apart), that replicating AWS SigV4/SigV4A re-signing was painful, and that the tool only prevents credential leakage — an agent making authorized but harmful calls (spending money, deleting production) remains fully possible. A parallel comment cluster debates MCP-vs-CLI tool gateways (InfiniteMCP, mcpc, mcp-cli) and MCP schema quality (97% of 201 graded servers waste tokens), which reflects the surrounding ecosystem debate rather than direct OneCLI experience.

No aggregate ratings were found for this product during the last harvest.