Your Agent Doesn't Need to See Your Passwords Bitwarden just launched their Agent Access SDK, letting AI agents access credentials from Bitwarden's vault with human approval. OneCLI is the open-source gateway that puts it to work: it sits between your agent and the APIs it calls, injecting credentials into requests at the network layer. Until now, agents had to hold API keys in memory to make authenticated calls. Now they don't. https://lnkd.in/dmC8kbNX
OneCLI
Technology, Information and Internet
The trust layer for AI agents - credentials, guardrails, and full control.
About us
OneCLI is the security layer between your AI agents and the outside world. A secure HTTPS gateway and credential vault that stores real secrets encrypted and issues placeholder keys to agents, so they never handle raw credentials. OneCLI adds guardrails, access control, and full visibility to every outbound agent request. Open-source and self-hosted, running as a separate Docker container alongside your agent stack. Learn more at onecli.sh
- Website
-
https://www.onecli.sh
External link for OneCLI
- Industry
- Technology, Information and Internet
- Company size
- 2-10 employees
- Type
- Privately Held
Employees at OneCLI
Updates
-
this is exactly the problem we're building OneCLI to solve. agents shouldn't need users to wrestle with oauth flows and raw credentials just to check a calendar. credentials get swapped at the network layer, the agent never sees them. open source, self-hosted, and already shipping as the default credential layer in NanoClaw.
OpenClaw has 250,000+ GitHub stars. NanoClaw does the same thing in 15 source files. Hermes Agent from Nous Research just launched with self-improving memory. The AI agent space is moving incredibly fast right now. I've been building with all three over the past few weeks, and the experience reminded me a lot of installing Linux on a Dell laptop in high school. The technology works. The vision is real. And the gap between the demo and actually getting your agent to stop RSVPing to your own meetings is, well, large. New post covers the whole journey: the Google Cloud OAuth setup nobody warns you about, swapping NanoClaw's backend to run GLM through Fireworks AI for cheaper inference, and why this stuff still requires a pretty technical user to pull off. https://lnkd.in/gimqnRqV
-
-
OneCLI reposted this
tldr, Check your package.json 😩 axios got compromised today. if your ai agent installed it, every secret it has access to is gone. here's what happened: an attacker hijacked a maintainer's npm account, published a poisoned version of axios (300M weekly downloads), and injected a hidden dependency that drops a remote access trojan on macos, windows, and linux. the malware self-deletes all evidence after running. a routine npm install is all it takes. here's what nobody's talking about: ai agents make this exponentially worse. agents run npm install on your behalf. they store credentials in env vars. they operate with broad permissions and zero human review. one compromised dependency and every api key, oauth token, and secret the agent has access to is gone. this is exactly why we built OneCLI. credentials never enter the agent's process, they're injected at the proxy layer. even if a supply chain attack drops malware inside the runtime, there's nothing to exfiltrate. you can't steal what isn't there. github.com/onecli/onecli #supplychain #npm #aiagents #security #opensource
-
-
nanoclaw isolates the agent runtime with docker sandboxes. onecli isolates the credentials the agent uses. together, even if a supply chain attack like today's axios compromise drops a RAT inside an agent's environment, it can't access secrets - because they never enter the sandbox in the first place. proud to be nanoclaw's default credential layer. this is what defense in depth looks like for ai agents.
NanoClaw now runs inside Docker, Inc Sandboxes. 🚀 Couldn't be more proud to be the first claw-based agent platform deployable inside Docker's MicroVM-based sandbox infrastructure with a single command. Most agent platforms run directly on the host machine with no hard boundaries between agents. A single compromised agent can access credentials, session histories, and data belonging to entirely separate agents. Docker Sandboxes provides OS-enforced isolation. Each agent gets its own MicroVM, its own filesystem, and its own session history, invisible to every other agent running alongside it. Combined with NanoClaw's minimal attack surface and fully auditable codebase, this stack is built for enterprise security scrutiny. NanoClaw has 20,000 GitHub stars and 100,000 downloads since launch. Get started today and learn more about the partnership here: https://lnkd.in/euwKWTrD https://lnkd.in/eURH6y6H https://lnkd.in/eitTPHhV #Docker #NanoClaw #AIAgents #Innovation
-
-
“the agent keeps finding creative ways to leak credentials.” that one line is why onecli exists. agents shouldn’t touch real secrets, period.
We built an org-wide AI agent in 4 days. Codex wrote 29,000 lines of TypeScript. Then real users showed up and everything broke. The agent leaked GitHub tokens between sessions. Its own command sanitizer blocked us from writing this blog post (because the post contained the patterns it filters). Our data analyst crashes it weekly and we still don't know why. New post on what actually went wrong https://lnkd.in/d5hnQbtq
-
Team OneCLI here 😎 Whether you’re Team MCP or Team CLI - you should take a look → github.com/onecli/onecli
Actual photo from San Francisco last week. For those not from Silicon Valley, this is about agents. Correct answer is obviously CLI, why below. Props Julia Fedorin, Quinn D. and the Composio team for pulling this off, well done! Ok, so why CLI? First, CLI allows to leverage LLMs all the work we have done already. We have lots of CLIs to talk to programs. There is tons of examples of CLI use which means tons of training data. But we also have a ton of experience how we build good CLIs. And going forward, we can write on set of docs and one set of code for humans and agents. Nice! Second, there is some indication that LLMs are better in reading a CLI style syntax than the complex structured APIs. This isn't surprising, after all LLMs are trained on human language preferences and humans prefer a CLI over a JSON object on most days. But there are also research papers that have shown that for agent tool calling simpler bullet-point style representations have lower error rates. Last, MCP is a pretty terrible protocol. It lacks strong typing and auth is an afterthought. If we want a programmatic way to talk to services, we might as well use a real API. We have an incredible amount of good infra built for that, we know to make it performance and secure. So even if not CLI, my answer wouldn't be MCP.
-
-
1,000 agents and the security answer is still “just don’t give it access to prod.” That’s the gap we’re closing with OneCLI. Agents never see real credentials. We swap them at the network layer and enforce access control deterministically - not with prompt instructions. You can give agents real access without the risk.
Just spoke to a CEO that's deployed 1k agents. I'll repeat: ONE THOUSAND AI agents. He's using OpenClaw aggressively and is mandating every one of his teams do the same. Me: "Has OpenClaw screwed anything up?" Him: "Yes, but it's worth it. Just don't give it access to a prod db." We're going to lean more heavily into more internal agents as well, although I think I'd prefer more pre-built AI agent builder products over just straight OpenClaw. But would love opinions from folks that have tried both for different use cases.
-
Great explainer from NanoClaw on how OneCLI powers the auth layer behind every NanoClaw agent - handling credentials, policies, and safety so your agents can run without risk. → https://onecli.sh
Just a few weeks ago, an exec at Meta gave her OpenClaw agent access to her email and she told it not to take any action without her approval. Can you guess what it did? 🙃 It started mass-deleting emails anyway, and she had to run to her computer to kill the process. This is what happens when agents operate without real boundaries or control. NanoClaw is partnering with OneCLI to bring every agent its own credential vault. NanoClaw agents never hold your real API keys. Rather, the vault intercepts every outbound request, injects the real credential, and enforces policies you set, like rate limits on what the agent can delete, archive, or send. If that rate limit had been in place at Meta, the damage would have been three emails, not an entire inbox. 🫣 NanoClaw already runs every agent in its own Docker container. OneCLI adds credential isolation and policy enforcement on top. Together, your agents can do real work within boundaries that are visible, auditable, and enforceable. Full write up and how to get started in the comments!
-
NanoClaw (25k+ GitHub stars) just adopted OneCLI Agent Vault as their default credential layer for their agent framework. What Agent Vault does: it sits between AI agents and external services. Agents request access, the vault proxies the request and injects real credentials. The agent never holds raw API keys. On top of that, a policy layer (starting with rate limiting) caps what agents can do per time window. Why this matters: an AI alignment director at Meta gave an agent her email access with instructions not to act without approval. The agent mass-deleted her inbox. With a rate limit of 3 deletions/hour, the damage would have been 3 emails, not everything. Each NanoClaw agent group now gets its own vault identity with its own rules. Different agent groups, different risk profiles, different policies. Rate limiting is live. Time-bound access and approval workflows are next. Congrats to Gavriel Cohen and the NanoClaw team on shipping this. Their writeup on the decision is worth reading. OneCLI: github.com/onecli/onecli NanoClaw: https://lnkd.in/euwKWTrD #OpenSource #AIAgents #AgentSecurity #DevTools #OneCLI
-
