HN

Comments (29)

• anon
  undefined
• Menu

  sandeepkd
  It works great for static credentials. As a product I think about adding couple more things that might be helpful here (Btw I am not the client for this, I just happen to know them as practical problems)1. Support for OAuth Client credentials - Gateway does the OAuth dance to get the access token, this is quite practical and even useful in case of regular services running across clusters and sharing the same clientId-secretId2. Support for request retries on certain failures and short circuiting in other cases
• emilsoman
  How does it compare to agent-vault and clawpatrol?
• vayup
  MITM is a feature now.
• redbridgerock
  Oo this is interesting, blocking it on the network level is nice
• osinix
  This is the same old good way from database world. A db client never touches the disk, but sends requests to a server who owns it. Same in your product. Keys are separated from agents and if needed, agents must send request to a proxy who owns them. Old proven design. Good luck.
• Menu

  doctorpangloss
  does the agent control the environment that onecli is running in? (yes)
• Menu

  stephantul
  It is hilarious to see most comments are people peddling their own products more or less directly.
• Menu

  adithyassekhar
  Holy mother of whatever this is, everyone got the same idea again and there’s a bunch of implementations people are desperate to promote in the comments.You’re just trading one key for another, whatever abstraction you chose to trust, at some point credentials will pass to your llm of the week.
• Menu

  notaharvardmba
  oauth, saml, oidc accomplish the same thing in a way more mature way, so if you’re already using SSO just do that instead of adding another point of failure..
• Menu

  winterrx
  nice launch. i have started to use a secrets manager (infisical) recently for my different projects and it's been really helpful. are your customers solo hackers, small startups or large enterprises that are looking for this kind of solution? i like to see competition in the space
• frank-bee
  [flagged]
• rahulr0609
  +1 to Infisical.We added Hashicorp Vault support here: https://github.com/Infisical/agent-vault/pull/256
• denysvitali
  Nice! I've built something like this, although specific to GitHub: https://github.com/denysvitali/gh-proxyThe idea being that if the fake token leaks from my sandbox - it would be completely useless for an attacker
• theozero
  Looks great. The "credential broker" pattern (inject placeholders, replace in proxy) is something we just added to https://varlock.dev (totally free and open source).Rather than using a dashboard, ours is configured within a .env.schema file, and rather than our own vault, we can pull secrets using our plugins (16 and counting) including Infisical, 1Password, Bitwarden, AWS, GCP, Azure, more. Also very useful for coding tasks in general, as we have integrations for most frameworks, and add built in validation, type safety, leak detection, etc.Will definitely be keeping an eye on OneCLI to compare notes.
• oliver236
  why not just use 1password