SI
Sentinel Integrations
← Back to Research Index

Research & Candidate Evaluation: OneCLI (Agent Credential Gateway)

🎯 Executive Summary

OneCLI is an open-source, Rust-backed credential gateway and secret vault designed specifically for AI agents. Unlike traditional secret managers (like Infisical, Vault, or Bitwarden CLI) that inject real API keys directly into an agent's process environment variables or memory, OneCLI keeps real keys completely invisible to the agent.

Agents are issued dummy/placeholder tokens (e.g. FAKE_KEY). Outbound API calls pass through the local OneCLI Rust proxy, which performs zero-trust host/path pattern matching, decrypts the real key transiently in RAM (AES-256-GCM), swaps the key into the request headers, and proxies the call.

🏗️ Architecture & Component Breakdown

[ AI Agent / Subagent ] 
       │
       │ HTTP Request with FAKE_KEY & Proxy-Auth
       ▼
┌───────────────────────────────────────────────────────────┐
│ OneCLI Rust Gateway (Port 10255)                          │
│                                                           │
│  1. Verifies Agent Access Token                           │
│  2. Matches Target Host / Path Pattern                   │
│  3. Fetches & Decrypts Secret (AES-256-GCM)               │
│  4. Swaps FAKE_KEY → REAL_KEY in Header / Query Params    │
└─────────────────────────────┬─────────────────────────────┘
                              │
                              │ Proxied HTTP Request with REAL_KEY
                              ▼
                     [ Upstream API / Provider ]

1. Rust Gateway (Port 10255): Ultra-fast, low-overhead HTTP proxy intercepting agent outbound requests.

2. Web Dashboard (Next.js - Port 10254): Single-user (local mode) or multi-user (OAuth) dashboard to set up agents, assign granular host/path secret permissions, and view audit trails.

3. Secret Store: AES-256-GCM encrypted vault at rest, decrypting secrets only transiently at proxy execution time.

⚔️ Comparison: Infisical vs. OneCLI

| Feature / Security Vector | Infisical (Current Baseline) | OneCLI (Candidate Evaluation) |

| :--- | :--- | :--- |

| Secret Delivery Model | Environment variables or local file injection prior to process start. | Outbound proxy injection; agent never holds or reads the raw secret. |

| Agentjacking / Prompt Injection Defense | Vulnerable: An agent tricked via prompt injection can print/exfiltrate env secrets. | Resistant: Agent memory holds only FAKE_KEY; real keys never enter prompt context or process memory. |

| Audit Visibility | Tracks secret fetch events (read-time). | Tracks granular outbound request logs per agent (request-time). |

| Integration Overhead | Requires infisical run -- ... CLI wrapper or API client call. | Requires routing agent HTTP traffic through http://localhost:10255. |

| Vault Storage | E2E encrypted local database or cloud sync. | Local SQLite / Docker container with AES-256-GCM encryption. |

📋 Evaluation Checklist for Future Deployment