Keep secrets out of AI agents with an OSS credential gateway
Built OneCLI, an open-source credential gateway that keeps secrets out of AI agent context.
Source
Jonathanfishner on Hacker News · 2026-07-23 · Project link
Written in our own words. Credit to the original author. Link checked 2026-10-15.
What they did
Built OneCLI, an open-source credential gateway that keeps secrets out of AI agent context.
Result (as claimed)
Open-sourced on Show HN.
Tools they used
Cost: Claude Code: free plan, paid from $17/mo; OpenAI Codex: free plan, paid from $8/mo; Cursor: free plan, paid from $8/mo. Checked 2026-10-14.
Set it up
Pick a contained repo or task
Start on a branch or side project where mistakes are cheap.
Install and configure
Set up Claude Code, OpenAI Codex, Cursor. Read what it can run on your machine and limit permissions where possible.
Run it on a real task
Give it a well-scoped issue and let it work. Review the diff like any pull request.
Add guardrails
Keep tests and CI in the loop, and never let an agent push to main or touch production secrets unattended.
Copy the full setup prompt
Paste into your agent and it will walk you through the setup, asking before anything that sends, posts or spends.
You are helping me set up this AI use case end to end in Claude Code. Goal: Keep secrets out of AI agents with an OSS credential gateway What the original author did: Built OneCLI, an open-source credential gateway that keeps secrets out of AI agent context. Reported result (as claimed by the author): Open-sourced on Show HN. Source: https://news.ycombinator.com/item?id=49023427 Tools they used: Claude Code, OpenAI Codex, Cursor Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Codex. Goal: Keep secrets out of AI agents with an OSS credential gateway What the original author did: Built OneCLI, an open-source credential gateway that keeps secrets out of AI agent context. Reported result (as claimed by the author): Open-sourced on Show HN. Source: https://news.ycombinator.com/item?id=49023427 Tools they used: Claude Code, OpenAI Codex, Cursor Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Grok Bot. Goal: Keep secrets out of AI agents with an OSS credential gateway What the original author did: Built OneCLI, an open-source credential gateway that keeps secrets out of AI agent context. Reported result (as claimed by the author): Open-sourced on Show HN. Source: https://news.ycombinator.com/item?id=49023427 Tools they used: Claude Code, OpenAI Codex, Cursor Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
The Daily 5
Get five new use cases tomorrow morning
Free. Real sources. Unsubscribe any time.
Related use cases
Keep agent secrets behind an open-source credential vault
Built Agent Vault, an open-source credential proxy and vault so agents never see raw secrets.
Run up to 16 coding agents side by side
Built SwarmPane to run Claude Code, Codex, Gemini, Grok and Cursor in parallel panes with attention cues.
Put coding agents in Discord-style team rooms
Shared Alook, an open-source Discord-style workspace where Claude Code, Codex, Cursor and other agents join team rooms.
Give coding agents a disposable Linux VM instead of your laptop
Built Clawk so coding agents run in a disposable Linux VM rather than directly on your machine.