That single sentence also contains the honest problem with reviewing this product in late 2026. The credential boundary it is built around stopped being rare sometime around the middle of the year. Anthropic shipped the same architecture inside Claude Tag, Infisical shipped Agent Vault, and a queue of smaller projects shipped proxy-based lookalikes. OneCLI’s own comparison page says so in writing. So the useful question is not “does it keep the key out of the agent” — several tools now do — but “what does OneCLI do that the others structurally cannot.”

This review answers that question with the parts that hold up, the parts that do not, and the three failure modes the company itself concedes.

What Is OneCLI, and Why Did It Pivot From a Credential Vault to an Agent Harness?

OneCLI is an open-source platform that runs each employee’s AI agent inside its own sandbox and forces every outbound network request through a policy-enforcing Rust gateway that injects credentials on the agent’s behalf. The project began in March 2026 as a Rust credential vault for AI agents and pivoted in August 2026 into a full agent harness for teams.

The pivot is visible in the launch history. The first Show HN on 2026-03-12 was titled “OneCLI – Vault for AI Agents in Rust” and reached 161 points. A second Show HN on 2026-07-23 was still framed as a credential gateway. Only the third launch, on 2026-08-19, was the “OSS sandboxed agent harness for teams” announcement — 88 points and 37 comments, a smaller reception than the original vault launch, which tells you something about how much harder the harness category is to differentiate in.

The company behind it is not a first-time repo owner. ChartDB Inc. previously built ChartDB, an open-source database diagramming tool with more than 20,000 GitHub stars, and the founders bring security-company backgrounds: CEO Jonathan Fishner worked on zero-trust network access at Axis Security (acquired by HPE) and previously in Israeli Military Intelligence.

What OneCLI means by “agent” is worth stating precisely, because it is not a prompt and not a chat session. An agent is a durable object with its own isolated sandbox containing a filesystem and a shell — a micro-VM on OneCLI Cloud since August 2026 — plus a durable workspace volume that survives park and wake cycles, its own persistent memory and skills, and an identity bound to exactly one employee. The only path out of that sandbox is the gateway. That last constraint is the entire architecture in one line.

The Architecture, Component by Component: Dashboard, API Server, Rust Gateway, Runner, Sandbox Supervisor

The repository layout is nine apps and six packages, and the split is more informative than most architecture diagrams because it shows where trust boundaries sit.

Three design decisions in that table are load-bearing.

First, the gateway is the only way out. There is no second egress path, so a policy that blocks api.stripe.com is not a suggestion the agent can route around by using curl instead of a tool call. This is the direct answer to the vendor’s own argument that an MCP gateway sees only a slice of agent traffic: an agent with a shell reaches APIs four ways — MCP tool calls, CLIs like gh/aws/stripe, raw curl, and code it writes itself — and a gate on one of those is a gate with three doors beside it.

Second, the runner is deliberately crippled. It starts, parks and reaps sandboxes but never touches the database. That means the component with the most direct control over sandbox lifecycle holds no secrets and no customer data, which is a meaningful reduction in what a compromise of that service buys an attacker.

Third, the sandbox supervisor speaks a vendor-neutral harness interface. The agent runtime is swappable by design, which is how onecli run -- claude works and why the product is not locked to one model vendor.

There are 40+ managed integrations with OAuth or API-key injection: Gmail, Google Calendar/Drive/Docs/Sheets and the rest of Workspace, Outlook Mail and Calendar, GitHub and GitHub App, Notion, Jira, Confluence, Slack, AWS with automatic SigV4 request signing, Cloudflare, Salesforce, HubSpot, Attio, Apollo.io, Clay, Datadog, Sentry, PostHog, Supabase, MongoDB Atlas, Dropbox, Zoom, LinkedIn, Monday.com, Todoist, Fly.io, Resend, Vertex AI, and the Anthropic and OpenAI APIs. External vaults are supported too: 1Password via service accounts and op:// references, and Bitwarden through its Agent Access SDK. OneCLI was listed on the 1Password Marketplace on 2026-07-20.

How a Single Request Gets Decided: Policy Before Credentials, Approval as a Held Request

The request flow is where this product earns or loses its claim, so it is worth walking through one call end to end.

An agent issues a normal HTTP request — say GET https://www.googleapis.com/calendar/v3/events. The gateway evaluates policy across two layers, top-down, first match wins: organization rules first (a ceiling that no project can loosen), then project-level access compiled automatically from that agent’s grants. Each layer ends in a Default Rule of Allow or Block, and a request is permitted only when both layers permit it. Blocked returns 403 and rate-limited returns 429 immediately.

Approval-gated requests pause for a human decision. A card appears in Slack or the dashboard, and expiry denies rather than allowing. If the request survives policy, the gateway matches the target host and path against the credentials granted to that specific agent, decrypts the match, and injects it as a header or URL query parameter. A credential the agent has no grant for is never considered at all. The request forwards with credentials attached, and the response passes back unchanged.

The critical property is the ordering: policy is evaluated before credential injection, so a blocked request never decrypts or touches a secret. That is a genuinely better failure mode than a system that authenticates first and then checks permissions.

The policy engine has four details that matter in practice.

• Approval is deterministic, not model-mediated. The held request binds to the exact proposed request — method, URL and body — and the parsed payload is rendered in the approval card, so the human approves a specific action rather than a described intention.
• Organization rule edits are staged. Changes go into a draft and enforce only on publish; the gateway keeps enforcing the last published set throughout. Agent grants, by contrast, take effect immediately. That asymmetry is the right way round: broad policy changes are reviewable, narrow ones are fast.
• Per-tool access is tri-state. Connection grants can be full access or custom with Allow, Ask, or Never per tool, and any tool not named is blocked. Secret grants are all-or-nothing with no tool lists, which is a real granularity gap.
• New agents start with nothing. No grants, no injected credentials, and no credential stubs in the container config.

That last point is the strongest quantitative argument in the whole product, and the industry data backs it. The Cloud Security Alliance survey published 2026-04-21 — 418 IT and security professionals, commissioned by Token Security — found that only 11% of organizations automatically block an agent action that exceeds its scope. A further 38% require human approval and 24% require it be logged. “A prompt is a suggestion; a gateway is a guarantee” is a defensible architectural claim rather than marketing, and it is the one claim in this review that survived every counterexample I could construct.

What OneCLI Actually Does Differently: Per-Employee Identity, an Org Policy Ceiling, and Self-Hosting

Strip away the parts of the credential story that are now commodity and three things remain.

1. Access follows the person, not a channel or a bot. Anthropic’s Claude Tag binds service accounts to a Slack channel, and Anthropic is explicit that a channel member without direct repository access can ask Claude to read that repository if the channel’s profile grants it. OneCLI’s unit of access is the employee, scoped to what that person already has. Joining a channel widens nothing, because the agent’s grants are bound to the human identity behind it. That is a meaningfully different security model, not a repackaging of the same one.

2. The organization policy ceiling cannot be loosened from below. Because org rules evaluate before project-level grants and a request needs both layers to allow it, a well-meaning team lead cannot grant an agent access that the security function forbade. Most credential proxies give you per-agent or per-project policy and leave the global ceiling as an operational convention. Making it structural is the difference between a rule and an invariant.

3. It self-hosts, and it self-hosts the important parts. The repository is Apache-2.0 with one carve-out: three paths (apps/web/src/ee/, packages/api/src/ee/, apps/gateway/crates/ee/) fall under the OneCLI Enterprise License, free for development, testing and evaluation, with production use requiring a subscription. The license file states that everything outside those paths is Apache-2.0 and self-hostable in production with no commercial license. The self-hosted Community edition is a single Docker container plus PostgreSQL.

For teams whose objection to a hosted agent platform is data residency or vendor dependency, point three is the deciding factor — and it is the one Claude Tag will never match.

The fourth, weaker advantage is distribution. NanoClaw — 30,863 stars, MIT, and arguably the leading container-isolated agent runtime — adopted OneCLI’s agent vault as its default credential and proxying layer on 2026-03-24, replacing a credential proxy it had written itself. That adoption predates the YC announcement by five months, and it also explains the star count skepticism on launch day. When a commenter asked how the repository could have 3,200 stars when the demo video had 38 views, the honest answer was that the repo dates to March 2026 and had been the default credential layer for a 30K-star project for two quarters. That is distribution earned, not bought.

What Is Not a Differentiator Anymore: Claude Tag, Infisical Agent Vault, and the 2026 Credential Boundary

In 2026 the credential boundary is table stakes. Four direct comparisons make the point, and OneCLI’s own documentation concedes most of it.

Anthropic’s agent identity post describes the credential as stored independently, mapped to the channel’s identity, and injected at the network boundary at request time, with unlisted hosts blocked and egress default-deny. OneCLI’s comparison page concedes in writing that this is the architecture it argues for. Against Claude Tag, credential injection is agreement, not differentiation — the difference is the identity model and the approval timing.

Infisical Agent Vault is the closest architectural twin. It substitutes dummy header values for real ones on outbound requests and is deliberately interface-agnostic, bootstrapping agents to use HTTPS_PROXY so MCP calls, CLIs, SDKs and plain API calls all route through it. It is published by an established secrets vendor with 29,528 stars on its main repository, and it has one capability OneCLI does not match natively: pluggable credential stores, so the vault can be backed by Infisical or HashiCorp Vault, including dynamic secrets, instead of a local encrypted store.

It also has one default worth flagging in the opposite direction. Infisical’s vault defaults to pass-through for unmatched hosts; strict deny mode requires explicitly setting unmatched_host_policy=deny. A fail-open default in a security boundary is the kind of thing that looks fine in a demo and matters in an incident. Infisical’s own README labels the product Preview with an API subject to change, which is honest but relevant.

TrueFoundry TrueForge attacks the harness axis rather than the credential axis: an MIT-licensed, vendor-neutral harness where models, MCP servers and sandbox are all bring-your-own. It overlaps OneCLI v2 substantially — scoped credentials, human-in-the-loop approvals, a versioned SKILL.md skills registry with RBAC mounted into the sandbox on demand, every tool call logged and policy-checked. Its approvals are tool-call scoped, which is exactly the coverage gap OneCLI’s “your MCP gateway cannot see most of what your agent does” argument targets. TrueForge comes from an existing commercial infrastructure vendor, so it brings enterprise go-to-market that a seed-stage team does not.

And OpenClaw — 390,873 stars, the most-starred repository on GitHub — is the incumbent OneCLI defines itself against. OneCLI’s comparison page opens with credit rather than attack, noting that OpenClaw went from weekend project to most-starred repo in under five months and that nearly everything in the category, including OneCLI, exists downstream of it. The substantive critique is about the fortieth install, not the first: forty unmanaged machines, forty copies of credentials in config files, nobody able to answer which agent touched the billing API last Tuesday, and offboarding that means finding a machine and rotating every key on it.

Does Policy Enforcement Solve Prompt Injection? No — Here Is the Provenance Blind Spot

This is the strongest technical criticism of the product, and it deserves its own section because it is not fixed by better engineering.

A gateway matching on method, path and host cannot tell what entered the context window three steps earlier. GET /customers?limit=5000 looks identical whether the operator asked for it or a retrieved document did. The gateway is a confused-deputy boundary that is blind to provenance: it sees a well-formed, correctly authenticated request from an agent that legitimately holds a grant for that endpoint.

OneCLI’s mitigations are real but partial. Approval binds to the exact proposed request, and the parsed payload is rendered in the card so the human sees what will actually be sent. Granularity reaches sub-endpoint level — GET /calendar/v3/* can be allowed freely while POST requires approval. And the design eliminates one entire class of outcome: the agent cannot leak a credential it never holds.

But there is a boundary case nobody in this category has solved. “Summarize this document and email it to Bob” legitimately originates in untrusted content, so pure provenance tracing cannot distinguish the intended task from an injection that emails everything to an attacker. The company says as much in its own writing: not holding the secrets does not make the agent harmless. When I asked whether OneCLI stops prompt injection, the correct answer is no, and the vendor does not claim otherwise.

The evidence supports that framing. Tachyon’s analysis “Sandboxes Won’t Save You From OpenClaw” (2026-02-25, 112 points and 103 comments on HN) found that in every major reported OpenClaw incident, the failure involved a third-party service the user had explicitly connected — not a sandbox escape. The most common real-world damage from a prompt-injected agent is misuse of access that was deliberately granted. A gateway that controls reach is directly relevant to that threat; a sandbox alone is not.

The broader data says most organizations are not even at the starting line. The CSA/Token Security survey found that 65% of organizations experienced at least one AI agent-related security incident in the past 12 months, with consequences including data exposure (61%), operational disruption (43%) and financial cost (35%) — and no respondent reported zero material business impact. 82% discovered at least one agent or autonomous workflow created without the knowledge of their security, IT or governance teams, and 41% said it happened multiple times. The detail that should unsettle anyone relying on self-assessment: 68% of those same organizations believed they had strong visibility into their agents.

Credential Isolation Is Not Blast-Radius Control — Stack It With a Sandbox

A placeholder key stops an agent from carrying a secret out. It does nothing about an agent misusing a service it was legitimately granted, and it does nothing about an agent wrecking its own filesystem. Those are different controls.

The cleanest way to hold the three apart is to name what each one bounds. Sandboxing bounds local damage. A gateway bounds reach. Identity binds action to a person who can be offboarded. NanoClaw’s own framing after adopting OneCLI’s vault draws the line precisely: NanoClaw solves runtime isolation, OneCLI solves credential isolation and policy enforcement. That is the honest answer to “do I need OneCLI if I already containerize my agents.”

The isolation half is not solved either. Sandbox bypasses recur in the agent tooling itself — CVE-2026-39861 was a Claude Code sandbox escape via symlink following that allowed arbitrary file write outside the workspace, reported 2026-05-08 with CVSS v4 severity high, network attack vector and low attack complexity. OSV.dev lists a cluster of related Claude Code symlink and permission-deny-bypass advisories, including CVE-2025-59829 (fixed in 1.0.120) and CVE-2026-25724 (fixed in 2.1.7). The tool you trust to enforce permissions is itself a moving target.

There is also a trust shift that gets under-discussed. Injection only works by terminating TLS, which means installing a CA certificate into the agent’s trust store. Some runtimes ignore HTTP_PROXY — Node historically did, though Node 24+ honours it with NODE_USE_ENV_PROXY=1. And AWS access keys cannot be handled by simple token substitution: the request must be re-signed with SigV4, which OneCLI does explicitly, and which is a real engineering detail rather than a checkbox. If a tool you depend on ignores proxy environment variables and has no CA installed, it escapes the boundary silently. Test that, do not assume it.

The scale of what is being protected puts the boundary question in context. GitGuardian’s State of Secrets Sprawl 2026 counted 28,649,024 new secrets detected in public GitHub commits in 2025, up 34% year over year — the largest single-year jump on record. Secret sprawl is not shrinking; the agent layer is being bolted on top of a problem that was already growing.

Pricing and Editions: What the Free Community Self-Host Does Not Include

Published pricing is unusual in a crowded category: there is a real free tier and it is not a trial.

Two details in that table are more generous than the headline numbers suggest: humans never count as agents, and all integrations are included on every plan with no metering on integration calls. Audit log retention is metered instead, which is a rarer and arguably fairer axis.

The self-hosted editions are where buyers need to read carefully, because the free Community edition omits the features the product’s own marketing treats as the reason to pick it over a coding-agent wrapper.

Teams evaluating the free edition should read the edition matrix before assuming parity, because the two missing features are precisely the ones that make this a teams product rather than a credential proxy. A self-hosted free deployment of OneCLI Community with approvals disabled is closer to Infisical Agent Vault than to the product described on the marketing page. A connector deployment — cloud dashboard plus an in-network gateway and database — is announced as coming, which will be the deployment shape many regulated buyers actually want.

Where OneCLI Fits in a Real Stack, and When To Pick Something Else

The category keeps collapsing three distinct controls into one purchase decision, and that is why evaluations go sideways.

Buy OneCLI if you have more than a handful of people running agents, the credentials are the thing keeping you up at night, you need an org-level ceiling that individual teams cannot weaken, and self-hosting is a requirement rather than a preference. The per-employee identity binding is the part no competitor currently matches at the same depth, and offboarding — revoke the person and the agent stops resolving credentials on the next request — maps directly onto the retirement-debt problem. Only 21% of organizations have a formal AI agent decommissioning process, and only 19% are highly confident that agents are fully retired when no longer needed, per the CSA survey.

Do not buy OneCLI expecting it to make prompt injection harmless, expecting the free Community edition to cover your approvals workflow, or expecting credential isolation to replace a sandbox. Each of those expectations is wrong for a different reason covered above.

Consider the alternatives on these triggers: pick Infisical Agent Vault if you already run Infisical or HashiCorp Vault and want dynamic secrets with a pluggable backend — but set unmatched_host_policy=deny on day one. Pick Claude Tag if your agents live in Slack, your team is too small to run infrastructure, and channel-scoped access is an acceptable model. Pick TrueForge if the harness and skills registry matter more than the credential boundary, or if you want an established vendor’s support contract. Pick plain container isolation with no gateway only if your agents hold no credentials — which, if you have read this far, they probably do.

Frequently Asked Questions

Is OneCLI really open source?

Mostly, with a carve-out worth reading before you plan a deployment. The repository is Apache-2.0 except for three paths — apps/web/src/ee/, packages/api/src/ee/ and apps/gateway/crates/ee/ — which carry the OneCLI Enterprise License: free for development, testing and evaluation, with production use requiring a subscription. The license file states that everything outside those paths is Apache-2.0 and self-hostable in production with no commercial license. The ee/ folder is not visible at the repository root, which is why a commenter on the Launch HN thread asked where it was.

Does OneCLI stop prompt injection?

No, and the company does not claim it does. It removes one consequence — the agent cannot leak a credential it never holds — and it gives you a deterministic place to block or approve individual requests. A prompt-injected agent can still misuse a service you legitimately granted it, and a gateway matching on host, method, path and body cannot tell whether the instruction behind a request came from you or from a retrieved document. Treat OneCLI as blast-radius and reach control, not as injection defense.

Do I still need a sandbox if I use OneCLI?

Yes. OneCLI does run each agent in its own sandbox — a micro-VM on OneCLI Cloud — but the sandbox and the gateway solve different problems. The sandbox bounds what the agent can break locally; the gateway bounds what it can reach externally. NanoClaw’s own framing after adopting OneCLI is exactly this split: NanoClaw solves runtime isolation, OneCLI solves credential isolation and policy enforcement. Run both, and remember that sandbox escapes recur in the tooling itself, as CVE-2026-39861 in Claude Code showed.

What does OneCLI cost?

Cloud pricing is $0 free forever with 3 seats, 3 agents, $5 in AI credits and 500 integration calls per month; Team at $499/mo for 5 users and 10 agents, dropping to $149/mo if you bring your own Anthropic or OpenAI key; Scale at $1,999/mo for 10 users and 20 agents, or $499/mo with your own key. Extra seats run $199/user/mo with hosted models or $49/user/mo bring-your-own. The self-hosted Community edition is free and Enterprise is by contract. Audit log retention is the metered axis: 7 days free, 30 days Team, 90 days Scale.

How is OneCLI different from a secrets manager like Vault or 1Password?

A vault protects the secret at rest but hands the real value to whatever fetches it, so once the agent holds the key the vault is out of the picture entirely. OneCLI keeps the credential out of the agent and injects it into the outbound request only after policy allows it — with policy evaluated before decryption, so a blocked request never touches a secret. It also connects to 1Password and Bitwarden as external vaults, so the two categories complement rather than compete. The structural difference to remember: a vault answers “who can read this secret,” a gateway answers “what can this agent do with it.”

The Verdict

OneCLI is a well-engineered product that arrived at a credential-boundary architecture the market had already converged on, and it is honest about that convergence in its own comparison pages. What survives the comparison is narrower than the launch post suggests but more durable than a feature list: one agent per employee with access bound to the person, an organization policy ceiling that no project grant can loosen, deterministic approval evaluated before any secret is decrypted, and a genuinely self-hostable production deployment. Against Claude Tag, that is a different security model rather than a better implementation of the same one. Against Infisical, it is a stricter default. Against TrueForge, it is a deeper credential story and a shallower harness story.

Three cautions stand. Credential isolation is not blast-radius control, and the provenance blindness of any request-matching gateway is unsolved across the entire category. The free Community self-host omits manual approvals and the org policy console — the two features that make this a teams product — so evaluate the paid tier or Enterprise before concluding it fits. And the market is crowded enough that the top-voted question on the Launch HN thread was literally how the company wins in this space, with a co-founder answer that amounted to “we are not sure yet, we believe it lands with security-minded buyers.” That is a more useful datapoint than any feature grid, and it should sit in your evaluation next to the 3,532 stars.

If the credential boundary is your blocker and you run agents for a team rather than for yourself, OneCLI is worth a self-hosted pilot this quarter. If your agents hold no credentials, or you need the sandbox rather than the gateway, spend the effort elsewhere. For the surrounding layers, see our guides on agent credential brokers, AI agent identity frameworks, agent permission boundaries, unified access for AI agents, and agentic credential management.