{"slug": "launch-hn-onecli-yc-s26-oss-sandboxed-agent-harness-for-teams", "title": "Launch HN: OneCLI (YC S26) – OSS sandboxed agent harness for teams", "summary": "OneCLI (YC S26) launched an open-source sandboxed agent harness for teams, giving each employee a secured personal AI agent with identity-provider integration, centralized policy enforcement, and deterministic human-in-the-loop approvals. The platform, built in Rust and available at onecli.sh, manages credentials and permissions per agent, supports Slack integration, and runs on outbound-only infrastructure with no inbound ports.", "body_md": "**The agent harness built for teams.**\n\nA pro assistant for companies. Give every employee a secured, sandboxed personal agent.\n\n### Cloud-hosted: [onecli.sh](https://onecli.sh)\n\n```\ngit clone https://github.com/onecli/onecli.git && cd onecli\npnpm install\npnpm run setup\n```\n\nOneCLI is an open-source platform for running AI agents as a team. You create an agent per person, give each agent the access it needs, and it works in a sandbox, routed through a gateway that injects the credentials and enforces your policy.\n\nOneCLI started as a credential vault for AI agents, built in Rust. We found that most of the demand came from individuals and teams running autonomous agents like [Hermes](https://github.com/NousResearch/hermes-agent), [OpenClaw](https://openclaw.ai) and [NanoClaw](https://github.com/nanocoai/nanoclaw). People wanted agents that do real work for the person running them, but two parts were missing:\n\n- managing secrets and permissions.\n- and for teams - multiplayer management.\n\nEvery autonomous agent out there is built for one person. And for one person, they're great. The moment you need to replicate that across a team, it gets messy: spinning up each agent, deciding what each one can and cannot do, hosting them, keeping track of whose agent is whose.\n\nSo we shifted, and built OneCLI v2.\n\n**Your identity provider, integrated**: provision agents on behalf of each employee's identity, straight from the company IdP.** An agent per person**: everyone in the workspace gets their own sandboxed agent, reachable from the dashboard or Slack.** One policy, enforced everywhere**: manage the team policy in one place, that any agent in the workspaces would be enforced by.** Deterministic human-in-the-loop approvals**: in the chat itself, for things you need 100% control over, like sending the email, deleting the Linear ticket, emptying an S3 bucket.**Global connections**: shared at the team level, like LLM keys or service accounts, granted per agent without ever being handed to one.\n\nAn agent is a durable thing, not a single prompt. It has:\n\n**A computer**: its own isolated sandbox, with a filesystem and a shell. The only way out is the gateway, so it can reach what you granted and nothing else.**A conversation**: its own page in the dashboard, or Slack. Images and files included. A message sent while the agent is working redirects it right away instead of queueing behind it.**Memory**: what the agent learns is kept by the platform, so it is never lost. You can read and edit it any time.** Skills**: instructions and helpers you write once, always available to the agent.** A schedule**: the agent can plan future work, and the platform wakes it at the right time.** Credentials it never sees**: each agent gets only the access you granted, and the gateway enforces it on every request. Or connect Bitwarden or 1Password for[on-demand injection](/onecli/onecli/blob/main/docs/vault-integration.md), with nothing stored on the server.**Its own Slack app**: connect it once and it answers in channels and DMs under its own name and avatar, with files and images. Delete the agent and its Slack app goes with it.\n\nAgents run on your own infrastructure. The runner is outbound-only and holds no inbound ports, so a laptop, a homelab, or a VPC behind NAT all work with no ingress and no tunnel.\n\n: Next.js app. Create agents, chat with them, edit their memory and skills, manage connections, secrets and grants.[Web Dashboard](/onecli/onecli/blob/main/apps/web): the control plane. Owns the database, the conversation plane, and the work queue the runner polls.[API Server](/onecli/onecli/blob/main/apps/api-server): intercepts outbound requests (HTTPS included, via MITM) and injects credentials. Agents authenticate with access tokens via[Rust Gateway](/onecli/onecli/blob/main/apps/gateway)`Proxy-Authorization`\n\nheaders.: starts, parks and reaps agent sandboxes. Outbound-only, and never touches the database.[Runner](/onecli/onecli/blob/main/apps/runner): runs inside each sandbox, speaking a vendor-neutral harness interface so the agent runtime is swappable.[Sandbox Supervisor](/onecli/onecli/blob/main/apps/sandbox-supervisor): the Slack daemon, one app per agent.[Channel Adapter](/onecli/onecli/blob/main/apps/channel-adapter)**Secret Store**: AES-256-GCM at rest, decrypted only at request time, matched by host and path pattern, injected as headers or query parameters.\n\n```\ngit clone https://github.com/onecli/onecli.git && cd onecli\nmise install\npnpm install\npnpm dev\n```\n\nThat's the whole setup: `pnpm dev`\n\ngenerates `.env`\n\nwith every required secret, starts PostgreSQL, applies migrations, and runs the full stack. Prerequisites, the command reference, project structure, and configuration live in [docs/development.md](/onecli/onecli/blob/main/docs/development.md).\n\nContributions are welcome. Read the [Contributing Guide](/onecli/onecli/blob/main/CONTRIBUTING.md) and [Code of Conduct](/onecli/onecli/blob/main/CODE_OF_CONDUCT.md) before getting started. Contributions are accepted under the terms of the [Contributor License Agreement](/onecli/onecli/blob/main/CLA.md).\n\nTo report a vulnerability, please follow our [Security Policy](/onecli/onecli/blob/main/SECURITY.md). Do not open a public issue for security reports.\n\n[Apache-2.0](/onecli/onecli/blob/main/LICENSE), with one exception: the `ee/`\n\ndirectories hold\nenterprise features under the [OneCLI Enterprise License](/onecli/onecli/blob/main/LICENSE-ENTERPRISE),\neach carrying a notice that points at it. That license is free for development,\ntesting and evaluation, and requires a subscription for production use.\nEverything else is Apache-2.0 and can be self-hosted in production with no\ncommercial license. [LICENSE-ENTERPRISE](/onecli/onecli/blob/main/LICENSE-ENTERPRISE) carries the\nauthoritative list of licensed paths.", "url": "https://wpnews.pro/news/launch-hn-onecli-yc-s26-oss-sandboxed-agent-harness-for-teams", "canonical_source": "https://github.com/onecli/onecli", "published_at": "2026-08-19 16:29:02+00:00", "updated_at": "2026-08-19 16:42:42.925055+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-infrastructure", "ai-safety", "developer-tools"], "entities": ["OneCLI", "YC S26", "Hermes", "OpenClaw", "NanoClaw", "Bitwarden", "1Password", "Slack"], "alternates": {"html": "https://wpnews.pro/news/launch-hn-onecli-yc-s26-oss-sandboxed-agent-harness-for-teams", "markdown": "https://wpnews.pro/news/launch-hn-onecli-yc-s26-oss-sandboxed-agent-harness-for-teams.md", "text": "https://wpnews.pro/news/launch-hn-onecli-yc-s26-oss-sandboxed-agent-harness-for-teams.txt", "jsonld": "https://wpnews.pro/news/launch-hn-onecli-yc-s26-oss-sandboxed-agent-harness-for-teams.jsonld"}}