# OneCLI

Aiolum story: https://aiolum.com/story/onecli/ · added 2026-11-07 · updated 2026-11-07

**In short.** OneCLI (Open-source credential gateway for AI agents, now also a sandboxed agent per employee; agents hold placeholder tokens and real secrets are added at the network layer, Israel): 3.6K GitHub stars and paid plans live, November 2026. Evidence grade E: no revenue figure was checked. Team: 2 co-founders (Jonathan Fishner, Guy Ben Aharon) in Tel Aviv; headcount not published. Launched 12 March 2026; still running.

Open-source credential gateway for AI agents, now also a sandboxed agent per employee; agents hold placeholder tokens and real secrets are added at the network layer · Israel · AI-native · team of 2 to 10 · still running · group: Developer tools and coding agents

- Outcome: 3.6K GitHub stars and paid plans live, November 2026 (evidence grade of the headline number: E; no revenue figure)
- Launch: 12 March 2026; months from launch to the outcome: 8
- Team: 2 co-founders (Jonathan Fishner, Guy Ben Aharon) in Tel Aviv; headcount not published
- Outside funding: Y Combinator (Summer 2026); amount not published
- Main factor: Open-source distribution through agent frameworks
- Meters, 1 to 4: evidence strength 1, copyable pattern 1, capital needed 2
- Tags: AI-native, Small team, Funded, Running, B2B, Developer tools

Links:

- Visit onecli.sh: https://onecli.sh/

**The product.** A gateway that sits between AI agents and the services they call. The agent gets only a placeholder token; on each outgoing request the gateway matches the host and path, checks the request against the company's rules (allow, block, rate limit, or wait for a person to approve), puts the real credential into the request and forwards it. Since August 2026 the same open-source code also runs one sandboxed agent per employee, reachable on the web or in Slack, with all of its traffic routed through that gateway. A hosted version has a free plan and paid plans.

**Why it worked.** Agents that read web pages, install packages and write their own code can leak any key they hold, through prompt injection, a malicious tool or a log line. The founders, who worked in network security before, argued that the fix is to keep the key out of the agent entirely, as zero-trust network access does for people. NanoClaw, an open-source agent framework, made the gateway its default credential layer in March 2026, and users then asked for the agent itself.

Evidence grades: A = disclosed by a public company, a filing or a payment processor, or verified by one; B = two or more independent reports agree, or a journalist confirmed it; C = a founder claim that no one else verified; D = reported, not verified: one founder claim or a third-party estimate with no second source; E = no revenue figure found, so the headline is a non-money fact and the other facts carry their own grades; calc = computed on this page from graded facts.

## Summary

OneCLI is a credential gateway for AI agents. A credential is a secret that proves who is calling a service, such as an API key (a password that lets a program use a service on someone's account), and a gateway here is a proxy, a program that receives each outgoing request and forwards it. The agent holds only a placeholder; the proxy swaps in the real key per request, after a policy check, so prompt injection or a bad log line has no key to leak. Since August 2026 the open-source code also runs a sandbox, an isolated computer with its own files and shell, for one agent per employee.

Jonathan Fishner (CEO) and Guy Ben Aharon (CTO) of Tel Aviv built it after ChartDB, an open-source database tool they made together. The first post on the OneCLI blog is dated 12 March 2026, and NanoClaw adopted the gateway on 24 March 2026. In their Y Combinator launch post of 23 July 2026 the founders wrote of "320K+ downloads, 2,500+ GitHub stars"; the GitHub page showed 3.6k stars on 7 November 2026. The pricing page lists a Team plan at US$149 a month with the customer's own model key.

No revenue figure was found, so the evidence grade is E. What is checked: the live site and pricing page, the GitHub repository, the Y Combinator company page and two launch posts, and NanoClaw's own post about the switch.

## Pricing

OneCLI cloud prices on 7 November 2026, from the company's pricing page and its structured data (grade C)

| Plan | Per month, billed yearly (US$) | Per month, billed monthly (US$) | Limit |
|---|---|---|---|
| Free |  | 0 | 3 human seats, 3 agents, 500 integration calls a month, US$5 in model credits |
| Team, own model key |  | 149 | 5 human seats, 10 agents, unlimited integration calls |
| Team, hosted models |  | 499 | 5 human seats, 10 agents, all hosted models |
| Scale, own model key |  | 499 | 10 human seats, 20 agents, SSO and SAML; extra seat US$49 |
| Scale, hosted models |  | 1,999 | 10 human seats, 20 agents; extra seat US$199 |
| Enterprise |  | custom | self-hosted deployment, SLA, unlimited seats |

Each paid plan has two prices: the lower one is BYOC (bring your own Anthropic or OpenAI key, and pay the provider directly); the higher one includes hosted models from OpenAI, Anthropic, Google and open-weight makers, with fair-usage limits per session and per week. The page offers yearly billing with "2 months off" but shows only monthly prices, so the yearly column is empty. Self-hosting the Apache-2.0 core is free; the enterprise features in the code's ee/ folders need a subscription for production use.

## How much revenue does OneCLI make? The numbers, graded

An open-source credential gateway for AI agents from Tel Aviv, 8 months after its first post, with 3.6k GitHub stars, paid plans and no published revenue

| Fact | Value | Grade | Note | Sources |
|---|---|---|---|---|
| Status, November 2026 | live on onecli.sh with a free plan and paid plans; code public on GitHub | C | Home page and pricing page read 7 November 2026. The home page says "Backed by Y Combinator" and "Core code is Apache-2.0". | [1, 2, 6] |
| GitHub repository, 7 November 2026 | 3.6k stars, 267 forks, 385 commits | C | github.com/onecli/onecli, read 7 November 2026. Stars show developer interest, not paying customers. | [6] |
| Downloads and stars, 23 July 2026 | "320K+ downloads, 2,500+ GitHub stars" | C | The founders' Y Combinator launch post. The download count was not checked against a package registry. | [3] |
| Default credential layer of NanoClaw | since 24 March 2026 | C | NanoClaw's post by Gavriel Cohen: NanoClaw "replaced" its own credential proxy "with the @onecli-sh/sdk". NanoClaw's site showed 31.1k+ stars on 7 November 2026. | [7, 9] |
| Founders | Jonathan Fishner (CEO) and Guy Ben Aharon (CTO), Tel Aviv-Yafo | C | Y Combinator company page. The launch post says Fishner worked on zero-trust network access at Axis Security and Ben Aharon was the first hire at Argon. | [5, 3] |
| Earlier project of the founders | ChartDB, an open-source database tool with "20K+ GitHub stars" | C | Founders' launch post: "Before OneCLI we built ChartDB together". ChartDB's changelog starts with version 1.0.0 on 4 November 2024. No downloaded source dates a company of the two founders before that. | [3, 13] |
| First dated public post | 12 March 2026 | C | "Why We Built OneCLI" by Jonathan Fishner, the oldest post on the blog index. A later post says the team "spent five months building the credential layer" before August 2026. | [8, 11, 10] |
| Funding | Y Combinator, Summer 2026 batch; amount not published | C | Y Combinator company page. Team size is not given there. | [5] |
| Paid plans | Team from US$149 a month; Scale from US$499 a month | C | Pricing page, 7 November 2026, with the customer's own model key. With hosted models: US$499 and US$1,999 a month. | [2] |
| Integrations with password managers | Bitwarden (30 March 2026) and the 1Password Marketplace (20 July 2026) | C | Dates and titles from the OneCLI blog index; the companies' own pages were not read. | [11] |
| License | Apache-2.0, except enterprise features under the OneCLI Enterprise License | C | README: the enterprise license is free for development and testing and "requires a subscription for production use". | [6] |
| Time from the first post to the November 2026 star count | 8 months | calc | Calculated: March 2026 to November 2026. | [8, 6] |

How to read this table: a grade C value is what the company's pages, its founders, its GitHub page or a partner's blog report. A "calc" value (grade X) was computed on this page. No value comes from a payment processor or a filing.

## When did OneCLI launch, and how did it grow? Timeline

From the founders' earlier open-source database tool to a gateway adopted by NanoClaw, then an agent per employee, in about two years. Each entry carries its grade.

- **4 November 2024** (grade C [13, 3]): ChartDB, the founders' earlier open-source database tool, records version 1.0.0 in its changelog.
- **12 March 2026** (grade C [8]): First blog post: a single CLI command that adds secrets to any tool an agent calls, "without the agent ever seeing the raw keys".
- **24 March 2026** (grade C [7, 9]): NanoClaw makes OneCLI's Agent Vault its default credential and proxy layer, with one vault identity per agent group.
- **23 July 2026** (grade C [3, 5]): Y Combinator launch post, Summer 2026 batch: the founders report "320K+ downloads, 2,500+ GitHub stars".
- **14 to 20 August 2026** (grade C [10, 4]): Version 2: a sandboxed agent per employee in Slack and on the web, behind the same gateway; second launch post.
- **7 November 2026** (grade C [6, 2]): 3.6k GitHub stars; Team and Scale paid plans on the pricing page.

## Why did OneCLI work?

### The key never enters the agent

The agent sends every request through the gateway with a placeholder. The gateway matches the request by host and path, checks the policy, swaps in the real credential and forwards it. The launch post states the argument: "you can't steal what isn't there". Because it works at the network level, it covers command-line tools, curl and code that the agent writes, not only MCP tool calls.

### Open source inside other people's agents

The gateway is free code that runs in one Docker container. NanoClaw built it into its framework as the default, which put OneCLI in front of that framework's users. Bitwarden added native support in its Agent Access SDK, and OneCLI is listed on the 1Password Marketplace. The paid product is the hosted version and the team features.

### From a security layer to the agent itself

In August 2026 Jonathan Fishner wrote that teams kept asking for an agent for every employee, with onboarding, offboarding and approvals. Version 2 sells that agent, with the gateway still under it. The post says pricing is "per person rather than per agent"; the pricing page sets both seat and agent limits for each plan.

## How it was built

These details come from the GitHub README, the launch posts and NanoClaw's post. They are grade C.

- A gateway written in Rust intercepts outgoing requests, HTTPS included, by acting as a man-in-the-middle proxy; agents authenticate to it with access tokens in Proxy-Authorization headers.
- Secrets are stored encrypted with AES-256-GCM, decrypted only at request time, and added as headers or query parameters.
- A Next.js web dashboard, an API server with PostgreSQL, a runner that starts and stops agent sandboxes, and a Slack adapter with one Slack app per agent.
- Self-hosting with pnpm or a Helm chart on Kubernetes; the first version ran as a single Docker container that works with anything that can set HTTPS_PROXY.
- A TypeScript SDK, @onecli-sh/sdk, which NanoClaw calls to route each container's traffic through the gateway.

Sources: [6, 3, 7]

## Who tried this before OneCLI, and why did they fail?

Three companies in a database of failed startups sold a security or access layer to developers and companies. The values below are from that database and are not independently verified.

The failed startups come from our database of dead startups, retold here in our own words; Its entries are AI-assisted summaries of public sources, so they carry no evidence grade.

### Toopher (2011 to 2018; funding US$3M; cause: Competition)

- Promise: Two-factor login for companies that checked where the user was.
- Why it died: It was acquired and then shut down; broader security suites offered more.
- Record: 

### UnifyID (2015 to 2021; funding US$20M; cause: No Market Need)

- Promise: Login without passwords, from the way a person walks and types.
- Why it died: Privacy concerns, cash-flow problems and the pandemic.
- Record: 

### WunderGraph (2020 to 2024; funding US$3M; cause: Ran Out of Cash)

- Promise: An open-source gateway that joins GraphQL, REST and databases into one typed API.
- Why it died: Open-source use did not turn into enough paid contracts, and large infrastructure vendors added gateway features.
- Record: 

## What changed

Toopher and UnifyID sold a better login for people and lost to larger security suites or to a weak market. WunderGraph had open-source users but too few paying ones. OneCLI faces both risks: it is a security layer that a larger vendor could add, and its traction so far is open-source counts.

What differs is the buyer's new problem. AI agents act on their own and read untrusted text, so a key they hold can leak in ways that a person's login cannot. A gateway that keeps the key outside the agent works for any agent framework, and NanoClaw's adoption brought it to that framework's users.

## Can one person copy OneCLI now?

**Verdict: The idea, yes. The trust, slowly.**

A proxy that adds credentials to agent requests is a well-defined piece of software; OneCLI's first version ran in one Docker container. Selling it is harder: a company must trust the gateway with every secret it has, and OneCLI's founders came with years of network-security work and a Y Combinator place.

1. Pick one risk that agents create and older tools do not cover, such as raw keys in an agent's context.
2. Solve it at a layer every agent passes through, here the network, so it works with any framework.
3. Release it as open source and get one popular framework to make it the default.
4. Charge for the hosted version and the team features: seats, single sign-on, audit retention, approvals.

**What is still open.** Other controls for agents at the network level: spending limits on paid APIs, data-loss checks on outgoing requests, and per-agent audit logs for regulated companies.

## What could go wrong for OneCLI?

- **What is not verified.** No revenue figure for OneCLI was found. What was looked for: a payment-processor profile (the pipeline's list of TrustMRR slugs has no OneCLI entry), revenue or customer figures in the founders' two launch posts and the company blog, and a funding amount on the Y Combinator page. The "320K+ downloads" are the founders' own count in their 23 July 2026 launch post and were not checked against a package registry; the GitHub star count shows developer interest, not paying customers. No paying customer is named in a downloaded source. A reader could look for a funding announcement after Demo Day or a customer case study.
- **Customer names on the home page.** Under "Trusted by", the home page shows 14 company names, among them Docker, MindsDB, Zoho, Coralogix and Kakao Entertainment, filled in by a script. No downloaded page links them to a case study or says whether they are paying customers, free users or partners, and they were not checked with the companies.
- **Competition and model providers.** On this site, Metorial sells a gateway for MCP tool calls and Kyvvu a check of each agent action; OneCLI works one level lower, on every HTTP request. NanoCo, the maintainers of NanoClaw, says on its site that it raised US$12M to give every member of a team a professional assistant, close to OneCLI's version 2. The gateway needs no model, but the version 2 agent does: the pricing page names hosted models from OpenAI, Anthropic and Google, or the customer's own Anthropic or OpenAI key.
- **One place that holds every secret.** The gateway decrypts HTTPS traffic and keeps all of a company's credentials, so a flaw in it would expose everything at once. The company's own posts say that a credential vault "does not solve alignment" and only limits the damage of a wrong action. The enterprise features need a paid licence in production, so the free self-hosted version is not the full product.

## Sources

1. OneCLI home page, read 7 November 2026 — https://onecli.sh/ (grade C). Read in full, including the script that fills the "Trusted by" list. Source for the product, the Y Combinator note, the license note and the customer names.
2. OneCLI pricing page, read 7 November 2026 — https://onecli.sh/pricing (grade C). Read in full, with its schema.org offer data. Source for the plans, prices, limits and model providers.
3. Y Combinator Launch, 23 July 2026: OneCLI - Your AI agents shouldn't be holding raw secrets (Jonathan Fishner and Guy Ben Aharon) — https://www.ycombinator.com/launches/RoJ-onecli-your-ai-agents-shouldn-t-be-holding-raw-secrets (grade C). Read in full. Source for the download and star counts, how the proxy works, the founders' background and ChartDB.
4. Y Combinator Launch, 20 August 2026: OneCLI - Give every employee a secured, sandboxed pro assistant agent — https://www.ycombinator.com/launches/SvJ-onecli-give-every-employee-a-secured-sandboxed-pro-assistant-agent (grade C). Read in full. Source for version 2 and the founders' roles.
5. Y Combinator company page: OneCLI — https://www.ycombinator.com/companies/onecli (grade C). Read the company data. Source for the batch, the location and the two founders; no team size is given.
6. GitHub: onecli/onecli, read 7 November 2026 — https://github.com/onecli/onecli (grade C). Read the repository page and README in full. Source for stars, forks, commits, the architecture and the license.
7. NanoClaw Blog, 24 March 2026: NanoClaw Adopts OneCLI Agent Vault (Gavriel Cohen) — https://nanoclaw.dev/blog/nanoclaw-agent-vault (grade C). Read in full. A partner's own account of the switch to OneCLI; also the site banner about NanoCo's funding.
8. OneCLI Blog, 12 March 2026: Why We Built OneCLI (Jonathan Fishner) — https://onecli.sh/blog/why-we-built-onecli (grade C). Read in full. Source for the first product and the earliest date.
9. OneCLI Blog, 25 March 2026: NanoClaw Now Uses Agent Vault as Its Default Credential Layer (Jonathan Fishner) — https://onecli.sh/blog/nanoclaw-adopts-agent-vault-credential-layer (grade C). Read in full. Source for the rate-limit policy and the limits of a credential vault.
10. OneCLI Blog, 14 August 2026: Every Employee Gets an Agent (Jonathan Fishner) — https://onecli.sh/blog/every-employee-gets-an-agent (grade C). Read in full. Source for the move to version 2 and the five months of work before it.
11. OneCLI Blog index, read 7 November 2026 — https://onecli.sh/blog (grade C). Read in full. Source for the post dates, including the Bitwarden and 1Password posts.
12. OneCLI FAQ page, read 7 November 2026 — https://onecli.sh/faq (grade C). Read in full. Source for the supported agent frameworks and the network-level enforcement.
13. GitHub: chartdb/chartdb CHANGELOG.md — https://github.com/chartdb/chartdb/blob/main/CHANGELOG.md (grade C). Read the dates of the first entries. Source for the start of the founders' earlier project.
14. Database of failed startups, local export — /method/#dead (grade C). Local export. AI-written summaries, not independently verified. Source for the failed predecessors.

Contact: aiolum@livyden.com. Run OneCLI? Send corrections or a verified figure to aiolum@livyden.com (subject: Correction: OneCLI).