OneCLI Launches Open-Source AI Agent Platform for Teams

OneCLI, an open-source platform for running AI agents as a coordinated team, launched out of stealth as a Y Combinator S26 batch company. The project gives each employee a secured, sandboxed personal agent that runs on the user's own infrastructure, routed through a gateway that injects credentials and enforces team policy on every request. (GitHub)

The architecture is the part worth paying attention to. Each agent is a durable entity, meaning it persists over time rather than disappearing after a single task. It has its own isolated sandbox computer with a filesystem and shell, a conversation page, memory, skills, a schedule, credentials it never sees in plaintext, and its own Slack app. Agents communicate through a gateway layer that handles credential injection on demand by connecting to Bitwarden or 1Password, with nothing stored on the server. The gateway also enforces team policy on every outbound request, which is a meaningfully different trust model from giving an agent a long-lived API key and hoping for the best.

OneCLI integrates with the company identity provider (IdP), the system that manages employee logins and access, to provision an agent on behalf of each employee's identity. That means agent actions are attributable to a named human rather than a shared service account, which matters for audit trails and for any organization operating under access-control frameworks that require per-user attribution.

The runner is designed for environments where opening inbound ports is a non-starter. It holds no inbound ports and operates outbound-only, so agents work on a laptop, a homelab, or a private cloud behind NAT with no ingress and no tunnel. For anyone who has spent time fighting with reverse proxies or Cloudflare tunnels to get an agent reachable from a control plane, this is a practical design decision that removes a category of deployment friction.

Human-in-the-loop approvals are built into the chat interface itself, and they are deterministic rather than advisory. Actions that require full control, such as sending an email, deleting a Linear ticket, or emptying an S3 bucket, trigger an explicit approval step in the conversation before the agent proceeds. The approval is not a notification the agent can ignore; it is a gate the action cannot pass without.

OneCLI includes a web dashboard built as a Next.js app for creating agents, chatting with them, and editing their configuration. The project is open-source, with the repository published on GitHub. Y Combinator listed OneCLI as part of its S26 batch in late July 2026. (LinkedIn)

The project did not start as an agent harness. OneCLI was originally built in Rust as a credential vault for AI agents before pivoting to its current v2 architecture as a full agent platform for teams. The credential-vault origin shows in the current design's emphasis on zero-knowledge credential handling, where the agent never sees the actual password or key, and policy enforcement at the gateway layer.

Looking at what this means for engineering teams evaluating agent infrastructure, the design choices in OneCLI reflect a set of problems that are becoming common. Agent frameworks that treat credentials as configuration rather than as a runtime concern create a security surface area that grows with every integration added. OneCLI's approach of keeping credentials out of the agent process entirely, injecting them through a gateway that also enforces policy, and attributing every action to a human identity via the IdP addresses three failure modes that organizations hit when they move from single-agent experiments to team-wide deployment.

The broader context here is whether the architecture holds up under real operational conditions. The outbound-only runner with no inbound ports is a network-security posture that will appeal to teams in restricted environments, but it also means the control plane must poll or long-poll the runner. How that performs under latency or intermittent connectivity is an operational question the repository documentation does not fully address.

The deterministic approval model is worth noting because it is a stronger guarantee than the advisory checkpoints in many agent frameworks, where the agent can proceed after a timeout or retry. Making the approval a hard gate for destructive actions is a design choice that trades autonomy for safety, and it aligns with how regulated environments expect privileged actions to be authorized.

For teams already standardized on Bitwarden or 1Password, the credential-injection integration is a low-friction on-ramp. For those using other vaults or custom secret management, the gateway's extensibility will determine whether OneCLI fits into their existing infrastructure without creating a parallel credential store.

The open-source release and YC backing give the project visibility at a point when the gap between single-agent demos and multi-agent, team-scale production deployment is the actual bottleneck for most organizations. The credential vault heritage, the gateway-mediated trust model, and the IdP-integrated provisioning together address a coherent set of problems in that gap. Whether the execution matches the architecture's promise is what the coming months will reveal.