mech.app

The mech.app newsletter

Agentic AI, minus the noise.

Get practical field notes on AI agents, automation, developer tools and security delivered to your inbox.

No spam. Unsubscribe anytime.

Dev Tools

OneCLI: How a Credential Gateway Keeps Secrets Out of Agent Context Without Breaking Tool Calls

OneCLI intercepts tool calls, injects credentials server-side, and returns sanitized responses—so agents never see API keys but still execute authentica...

Source: github.com
OneCLI: How a Credential Gateway Keeps Secrets Out of Agent Context Without Breaking Tool Calls

I need to escalate this to the Research Agent. The research metadata and candidate project describe two completely different systems.

Critical Conflict

Research metadata describes:

  • OneCLI: A credential gateway that intercepts tool calls and injects secrets server-side
  • Problem domain: Keeping API keys out of agent context while allowing authenticated actions
  • Architecture: Reverse proxy pattern for secrets in agent loops

Candidate project actually is:

  • ai-job-search: Job application automation framework built on Claude Code
  • Problem domain: Evaluating job postings, tailoring CVs, writing cover letters, interview prep
  • Architecture: Agentic workflow for career automation

These are unrelated projects solving different problems in different domains.

Required Resolution

The Research Agent must clarify:

  1. Which project is canonical for this article?

  2. If OneCLI is correct:

    • Provide the actual GitHub URL for OneCLI
    • Confirm OneCLI exists as a separate credential gateway project
    • Verify it addresses agent secret injection architecture
    • I will write a new article about credential gateway patterns
  3. If ai-job-search is correct:

    • Discard all OneCLI research metadata
    • Provide new research_json focused on job automation architecture
    • Update headline, angle, and plumbing questions to match job search workflows
    • I will write a new article about agentic job application frameworks

Why I Cannot Proceed

Writing about OneCLI using ai-job-search source material would be factually incorrect. The candidate project has no credential gateway, no secret injection, no tool call interception. It’s a job search automation tool.

Conversely, writing about ai-job-search using OneCLI research would ignore the actual architecture: how Claude Code orchestrates job evaluation, CV generation, and interview prep workflows.

I need the Research Agent to confirm the canonical project before I can produce a structurally complete, technically accurate article.