OneCLI (YC S26): An Open-Source Sandboxed Agent Harness for Teams

OneCLI provides a robust, open-source framework designed specifically for deploying AI agents within a team environment.

What is OneCLI v2? It is a platform that allows teams to run AI agents securely. By assigning an agent to each team member and routing all activity through a policy-enforcing gateway, OneCLI ensures that agents have the necessary access without compromising security.

---

🚀 Getting Started

Depending on your needs, you can deploy OneCLI in two ways:

Deployment Options

Quick Start Checklist

• Clone the repository
• Install dependencies
• Run the setup script
• Access the dashboard

Self-hosting commands:

git clone https://github.com/onecli/onecli.git
cd onecli
pnpm install
pnpm run setup

---

🛠 The Evolution of OneCLI

OneCLI didn't start as a full harness; it began as a simple credential vault built using Rust. However, the developers noticed a surge in demand from users of autonomous agents (such as NanoClaw, OpenClaw, and Hermes).

The primary pain points identified were:

1. Secret Management: How to give agents keys without exposing them.
2. Permission Control: Defining what an agent can and cannot do.
3. Team Scaling: The difficulty of managing multiple agents, hosting, and identity mapping across an organization.

---

👥 Built for Team Collaboration

OneCLI solves the "messiness" of team-based AI deployment through several core features:

• IdP Integration: Provision agents automatically based on your company's Identity Provider.
• Personalized Agents: Every employee receives their own sandboxed agent, accessible via Slack or the web dashboard.
• Unified Policy: A single, centralized policy is enforced across every agent in the workspace.
• Human-in-the-Loop (HITL): Deterministic approvals are required for high-risk actions.
  • Example: Deleting an S3 bucket or sending a critical email requires a manual "OK" in the chat.
• Global Connections: Shared resources (like LLM API keys) are granted to agents without the agent ever "possessing" the key.

---

🤖 Agent Capabilities

Each agent is equipped with a comprehensive set of tools:

1. The Virtual Computer: An isolated sandbox featuring its own shell and filesystem.
   • Security Note: The only exit point is the gateway.
2. Instant Redirection: If a new message arrives while an agent is processing, it is redirected immediately rather than being queued.
3. Persistent Memory: The platform retains everything the agent learns.
4. Custom Skills: Developers can write helper functions and instructions once and make them globally available.
5. Scheduling: Agents can plan future tasks; the platform handles the "wake-up" call.
6. Invisible Credentials: Agents never see their keys. The gateway injects them on the fly.
   • Integration: Supports on-demand injection via 1Password or Bitwarden.
7. Slack Native: Operates as a dedicated app with its own avatar, supporting DMs, channels, and media.

Network Architecture

The runner is outbound-only. Because it requires no inbound ports, it can be hosted on:

• A local laptop
• A home lab
• A VPC behind NAT (no tunnels required)

---

🏗 Technical Architecture

Component Breakdown

• Control Plane: Manages the database, conversation history, and the work queue polled by the runner.
• Rust Gateway: Acts as a MITM (Man-in-the-Middle) for HTTPS requests, injecting credentials via Proxy-Authorization headers.
• Sandbox Supervisor: A vendor-neutral interface that allows the underlying agent runtime to be swapped easily.
• Secret Store: Utilizes $\text{AES-256-GCM}$ encryption at rest. Secrets are decrypted only at the moment of request and matched by host/path patterns.

---

💻 Local Development

To set up a development environment:

git clone https://github.com/onecli/onecli.git
cd onecli
mise install
pnpm install
pnpm dev

pnpm dev is a comprehensive command that:

1. Generates the .env file.
2. Launches PostgreSQL.
3. Executes database migrations.
4. Starts the entire application stack.

For further details, refer to docs/development.md regarding project structure and command references.

---

⚖️ Licensing & Security

Security

Please refer to the official Security Policy to report any vulnerabilities.

License Model

OneCLI uses a hybrid licensing approach:

The LICENSE-ENTERPRISE file contains the definitive list of all licensed paths.

---

Contributions are welcome! Please review the Contributing Guide, Code of Conduct, and Contributor License Agreement (CLA) before submitting PRs.