The agent harness built for teams.
A pro assistant for companies. Give every employee a secured, sandboxed personal agent.
Cloud-hosted: onecli.sh
git clone https://github.com/onecli/onecli.git && cd onecli
pnpm install
pnpm run setup
OneCLI is an open-source platform for running AI agents as a team. You create an agent per person, give each agent the access it needs, and it works in a sandbox, routed through a gateway that injects the credentials and enforces your policy.
OneCLI started as a credential vault for AI agents, built in Rust. We found that most of the demand came from individuals and teams running autonomous agents like Hermes, OpenClaw and NanoClaw. People wanted agents that do real work for the person running them, but two parts were missing:
- managing secrets and permissions.
- and for teams - multiplayer management.
Every autonomous agent out there is built for one person. And for one person, they're great. The moment you need to replicate that across a team, it gets messy: spinning up each agent, deciding what each one can and cannot do, hosting them, keeping track of whose agent is whose.
So we shifted, and built OneCLI v2.
Your identity provider, integrated: provision agents on behalf of each employee's identity, straight from the company IdP.** An agent per person**: everyone in the workspace gets their own sandboxed agent, reachable from the dashboard or Slack.** One policy, enforced everywhere**: manage the team policy in one place, that any agent in the workspaces would be enforced by.** Deterministic human-in-the-loop approvals**: in the chat itself, for things you need 100% control over, like sending the email, deleting the Linear ticket, emptying an S3 bucket.Global connections: shared at the team level, like LLM keys or service accounts, granted per agent without ever being handed to one.
An agent is a durable thing, not a single prompt. It has:
A computer: its own isolated sandbox, with a filesystem and a shell. The only way out is the gateway, so it can reach what you granted and nothing else.A conversation: its own page in the dashboard, or Slack. Images and files included. A message sent while the agent is working redirects it right away instead of queueing behind it.Memory: what the agent learns is kept by the platform, so it is never lost. You can read and edit it any time.** Skills**: instructions and helpers you write once, always available to the agent.** A schedule**: the agent can plan future work, and the platform wakes it at the right time.** Credentials it never sees**: each agent gets only the access you granted, and the gateway enforces it on every request. Or connect Bitwarden or 1Password foron-demand injection, with nothing stored on the server.Its own Slack app: connect it once and it answers in channels and DMs under its own name and avatar, with files and images. Delete the agent and its Slack app goes with it.
Agents run on your own infrastructure. The runner is outbound-only and holds no inbound ports, so a laptop, a homelab, or a VPC behind NAT all work with no ingress and no tunnel.
: Next.js app. Create agents, chat with them, edit their memory and skills, manage connections, secrets and grants.Web Dashboard: the control plane. Owns the database, the conversation plane, and the work queue the runner polls.API Server: intercepts outbound requests (HTTPS included, via MITM) and injects credentials. Agents authenticate with access tokens viaRust GatewayProxy-Authorization
headers.: starts, parks and reaps agent sandboxes. Outbound-only, and never touches the database.Runner: runs inside each sandbox, speaking a vendor-neutral harness interface so the agent runtime is swappable.Sandbox Supervisor: the Slack daemon, one app per agent.Channel AdapterSecret Store: AES-256-GCM at rest, decrypted only at request time, matched by host and path pattern, injected as headers or query parameters.
git clone https://github.com/onecli/onecli.git && cd onecli
mise install
pnpm install
pnpm dev
That's the whole setup: pnpm dev
generates .env
with every required secret, starts PostgreSQL, applies migrations, and runs the full stack. Prerequisites, the command reference, project structure, and configuration live in docs/development.md.
Contributions are welcome. Read the Contributing Guide and Code of Conduct before getting started. Contributions are accepted under the terms of the Contributor License Agreement.
To report a vulnerability, please follow our Security Policy. Do not open a public issue for security reports.
Apache-2.0, with one exception: the ee/
directories hold enterprise features under the OneCLI Enterprise License, each carrying a notice that points at it. That license is free for development, testing and evaluation, and requires a subscription for production use. Everything else is Apache-2.0 and can be self-hosted in production with no commercial license. LICENSE-ENTERPRISE carries the authoritative list of licensed paths.