Project ideas from Hacker News discussions.

Show HN: OneCLI – OSS credential gateway that keeps secrets out of AI agents

📝 Discussion Summary (Click to expand)

Three dominant themes

  1. Agent‑level security & secret isolation
    Participants stress that the central gateway must keep real secrets out of the CLI/agent environment.

    “yes the agent controls its environment which is exactly why nothing sensitive should live there. The gateway and the real secrets sit outside the sandbox. that said, not holding the secrets doesn't make the agent harmless. It still acts autonomously, and it can use whatever access those credentials grant.” — doctorpangloss

  2. Pricing concerns around machine‑account secrets
    Several commenters flag the cost model as surprising, especially the charge per machine identity.

    “+1 on infisical. brilliant self‑hosted offering … are your customers solo hackers, small startups or large enterprises … I like to see competition in the space.” — bstsb (highlighting interest but also implying pricing scrutiny)
    “Curious how you justify their pricing? Last I checked the $/identity extended to machine accounts which absolutely blew my mind.” — aliasxneo

  3. Market hype & copy‑cat sentiment
    The discussion notes that many users are converging on similar solutions and promoting their own projects, often recycling the same idea.

    “Holy mother of whatever this is, everyone got the same idea again and there’s a bunch of implementations people are desperate to promote in the comments. You’re just trading one key for another, whatever abstraction you chose to trust, at some point credentials will pass to your llm of the week.” — adithyassekhar


🚀 Project Ideas

Agentless Credential Broker

Summary

  • Provides a secure, decentralized broker that injects short‑lived, scoped credentials into LLM agents without ever storing them in the agent’s environment.
  • Eliminates the need to place secrets inside the agent sandbox, reducing attack surface and simplifying compliance.

Details

Key Value
Target Audience Solo hackers and small startup teams building AI‑augmented tools
Core Feature Transparent credential injection via a lightweight proxy; dynamic OAuth/OIDC token leasing; automatic leak detection and revocation
Tech Stack Rust (proxy), Go (token manager), React (dashboard), Docker Compose, PostgreSQL
Difficulty High
Monetization Revenue-ready: Subscription per active identity (tiered pricing)

Notes

  • HN users repeatedly asked for a way to avoid giving agents direct secret access – this solution answers that directly.
  • Offers practical utility by integrating with existing secret managers (Infisical, Vault, 1Password) and providing audit logs for compliance.

OAuth‑Ready Secrets Manager for CI/CD

Summary

  • A self‑hosted secrets manager that natively supports OAuth client‑credential flows, automatic token rotation, and built‑in request‑retry/breaker logic for robust CI pipelines.
  • Addresses the demand for “no‑static‑token” security while simplifying secret handling across multiple services.

Details

Key Value
Target Audience Developers and DevOps teams (individuals to small startups)
Core Feature OAuth client‑credentials authentication, rotating/refreshing tokens, retry & circuit‑breaker middleware, multi‑vault adapters (Vault, AWS, GCP)
Tech Stack Go (engine), Node.js (CLI), SQLite (local store), Docker, Swagger UI
Difficulty Medium
Monetization Revenue-ready: Tiered SaaS hosting (Free hobby tier, $15/mo per team)

Notes

  • Mirrors the “Infisical‑style” self‑hosted appeal but adds OAuth specifics highlighted in the discussion.
  • Practical for CI pipelines that need reliable retry handling and cost‑saving breaker patterns.

OneCLI Companion Dashboard

Summary

  • A hosted dashboard that manages temporary credential leases generated by OneCLI proxies, offering policy enforcement, expiration tracking, and usage analytics.
  • Provides the convenience layer missing from OneCLI, turning ad‑hoc credential leaks into auditable, controllable resources.

Details

Key Value
Target Audience Solo developers and small teams using OneCLI or similar secret‑proxy tools
Core Feature Credential lease API, scoped token assignment, expiration Dashboard, open‑source plugin system for major vaults
Tech Stack TypeScript (frontend), Node.js (backend), Redis (cache), Next.js, Tailwind CSS
Difficulty Medium
Monetization Revenue-ready: Pay‑per‑active‑identity (e.g., $5 per identity per month)

Notes

  • Directly responds to commenters asking “why not just use 1Password?” by extending OneCLI’s workflow with central management.
  • Enables practical safety nets (leak detection, automatic revocation) that would be valuable to the HN audience.

Read Later