Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents

github.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents

#23

Post by osinix »

This is the same old good way from database world. A db client never touches the disk, but sends requests to a server who owns it. Same in your product. Keys are separated from agents and if needed, agents must send request to a proxy who owns them. Old proven design. Good luck.

Re: Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents

#25

Post by aliasxneo »

winterrx wrote: post #2

nice launch. i have started to use a secrets manager (infisical) recently for my different projects and it's been really helpful. are your customers solo hackers, small startups or large enterprises that are looking for this kind of solution? i like to see competition in the space

Curious how you justify their pricing? Last I checked the $/identity extended to machine accounts which absolutely blew my mind.

Re: Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents

#26

Post by mjg59 »

hmokiguess wrote: post #20
mjg59 wrote: post #10

Earlier quoted context omitted.

No they don't - you're still giving the agent a static token that can be exfiltrated and used elsewhere.

doesn't the token has an expiry window though? if you're using oidc/sso with aws for example it is short lived and can be revoked

The refresh token is often going to be good for a week, even if the access token isn't.

Re: Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents

#27

Post by throw1234567891 »

theapiartist wrote: post #12
adithyassekhar wrote: post #8

Holy mother of whatever this is, everyone got the same idea again and there’s a bunch of implementations people are desperate to promote in the comments. You’re just trading one key for another, whatever abstraction you chose to trust, at some point credentials will pass to your llm of the week.

I happen to know a solution where credentials wouldn't get to the agent. It's structurally impossible

I know one, too.

Re: Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents

#28

Post by aiman_alsari »

aliasxneo wrote: post #25
winterrx wrote: post #2

nice launch. i have started to use a secrets manager (infisical) recently for my different projects and it's been really helpful. are your customers solo hackers, small startups or large enterprises that are looking for this kind of solution? i like to see competition in the space

Curious how you justify their pricing? Last I checked the $/identity extended to machine accounts which absolutely blew my mind.

If you want fully free and open source enterprise features you're better off going to OpenBao
Post reply on HN