Aiolum Browse stories
All stories
Open-source credential gateway for AI agents, now also a sandboxed agent per employee; agents hold placeholder tokens and real secrets are added at the network layer · Israel

OneCLI: Product, team and how it was built

Small teamFundedB2BDeveloper tools

OneCLI (Open-source credential gateway for AI agents, now also a sandboxed agent per employee; agents hold placeholder tokens and real secrets are added at the network layer, Israel): 3.6K GitHub stars and paid plans live, November 2026. Evidence grade E: no revenue figure was checked. Team: 2 co-founders (Jonathan Fishner, Guy Ben Aharon) in Tel Aviv; headcount not published. Launched 12 March 2026; still running.Added 7 November 2026

Outcome
3.6K GitHub stars and paid plans live, November 2026
Evidence
E no revenue figure was checked
Launch
12 March 2026
Status
Still running
Team
2 co-founders (Jonathan Fishner, Guy Ben Aharon) in Tel Aviv; headcount not published
Outside funding
Y Combinator (Summer 2026); amount not published
Main channel
Open source
No revenue figure

What is not verified

No revenue figure for OneCLI was found. What was looked for: a payment-processor profile (the pipeline's list of TrustMRR slugs has no OneCLI entry), revenue or customer figures in the founders' two launch posts and the company blog, and a funding amount on the Y Combinator page. The "320K+ downloads" are the founders' own count in their 23 July 2026 launch post and were not checked against a package registry; the GitHub star count shows developer interest, not paying customers. No paying customer is named in a downloaded source. A reader could look for a funding announcement after Demo Day or a customer case study. This story is grade E: the business is real and its product, price and customers are described from public pages, but no revenue figure was checked. Aiolum shows it as an idea worth studying, not as proof that it makes money.

OneCLI is a credential gateway for AI agents. A credential is a secret that proves who is calling a service, such as an API key (a password that lets a program use a service on someone's account), and a gateway here is a proxy, a program that receives each outgoing request and forwards it. The agent holds only a placeholder; the proxy swaps in the real key per request, after a policy check, so prompt injection or a bad log line has no key to leak. Since August 2026 the open-source code also runs a sandbox, an isolated computer with its own files and shell, for one agent per employee.

Jonathan Fishner (CEO) and Guy Ben Aharon (CTO) of Tel Aviv built it after ChartDB, an open-source database tool they made together. The first post on the OneCLI blog is dated 12 March 2026, and NanoClaw adopted the gateway on 24 March 2026. In their Y Combinator launch post of 23 July 2026 the founders wrote of "320K+ downloads, 2,500+ GitHub stars"; the GitHub page showed 3.6k stars on 7 November 2026. The pricing page lists a Team plan at US$149 a month with the customer's own model key.

No revenue figure was found, so the evidence grade is E. What is checked: the live site and pricing page, the GitHub repository, the Y Combinator company page and two launch posts, and NanoClaw's own post about the switch.

OneCLI: 3.6K GitHub stars and paid plans live, November 2026. Open-source credential gateway for AI agents, now also a sandboxed agent per employee; agents hold placeholder tokens and real secrets are added at the network layer, Israel, team of 2 to 10, evidence grade E.
The story in one card. Share it with the address of this page.
01

How much revenue does OneCLI make?

Each row shows the evidence grade and the source numbers from the list at the end of this page. The grades are explained in How Aiolum verifies.

An open-source credential gateway for AI agents from Tel Aviv, 8 months after its first post, with 3.6k GitHub stars, paid plans and no published revenue
FactValueGradeHow we knowSources
Status, November 2026live on onecli.sh with a free plan and paid plans; code public on GitHubCHome page and pricing page read 7 November 2026. The home page says "Backed by Y Combinator" and "Core code is Apache-2.0".[1, 2, 6]
GitHub repository, 7 November 20263.6k stars, 267 forks, 385 commitsCgithub.com/onecli/onecli, read 7 November 2026. Stars show developer interest, not paying customers.[6]
Downloads and stars, 23 July 2026"320K+ downloads, 2,500+ GitHub stars"CThe founders' Y Combinator launch post. The download count was not checked against a package registry.[3]
Default credential layer of NanoClawsince 24 March 2026CNanoClaw's post by Gavriel Cohen: NanoClaw "replaced" its own credential proxy "with the @onecli-sh/sdk". NanoClaw's site showed 31.1k+ stars on 7 November 2026.[7, 9]
FoundersJonathan Fishner (CEO) and Guy Ben Aharon (CTO), Tel Aviv-YafoCY Combinator company page. The launch post says Fishner worked on zero-trust network access at Axis Security and Ben Aharon was the first hire at Argon.[5, 3]
Earlier project of the foundersChartDB, an open-source database tool with "20K+ GitHub stars"CFounders' launch post: "Before OneCLI we built ChartDB together". ChartDB's changelog starts with version 1.0.0 on 4 November 2024. No downloaded source dates a company of the two founders before that.[3, 13]
First dated public post12 March 2026C"Why We Built OneCLI" by Jonathan Fishner, the oldest post on the blog index. A later post says the team "spent five months building the credential layer" before August 2026.[8, 11, 10]
FundingY Combinator, Summer 2026 batch; amount not publishedCY Combinator company page. Team size is not given there.[5]
Paid plansTeam from US$149 a month; Scale from US$499 a monthCPricing page, 7 November 2026, with the customer's own model key. With hosted models: US$499 and US$1,999 a month.[2]
Integrations with password managersBitwarden (30 March 2026) and the 1Password Marketplace (20 July 2026)CDates and titles from the OneCLI blog index; the companies' own pages were not read.[11]
LicenseApache-2.0, except enterprise features under the OneCLI Enterprise LicenseCREADME: the enterprise license is free for development and testing and "requires a subscription for production use".[6]
Time from the first post to the November 2026 star count8 monthscalcCalculated: March 2026 to November 2026.[8, 6]

How to read this table: a grade C value is what the company's pages, its founders, its GitHub page or a partner's blog report. A "calc" value (grade X) was computed on this page. No value comes from a payment processor or a filing.

OneCLI cloud prices on 7 November 2026, from the company's pricing page and its structured data (grade C)
PlanPer month, billed yearly (US$)Per month, billed monthly (US$)Limit
Free03 human seats, 3 agents, 500 integration calls a month, US$5 in model credits
Team, own model key1495 human seats, 10 agents, unlimited integration calls
Team, hosted models4995 human seats, 10 agents, all hosted models
Scale, own model key49910 human seats, 20 agents, SSO and SAML; extra seat US$49
Scale, hosted models1,99910 human seats, 20 agents; extra seat US$199
Enterprisecustomself-hosted deployment, SLA, unlimited seats

Each paid plan has two prices: the lower one is BYOC (bring your own Anthropic or OpenAI key, and pay the provider directly); the higher one includes hosted models from OpenAI, Anthropic, Google and open-weight makers, with fair-usage limits per session and per week. The page offers yearly billing with "2 months off" but shows only monthly prices, so the yearly column is empty. Self-hosting the Apache-2.0 core is free; the enterprise features in the code's ee/ folders need a subscription for production use.

02

When did OneCLI launch, and how did it grow?

From the founders' earlier open-source database tool to a gateway adopted by NanoClaw, then an agent per employee, in about two years. Each entry carries its grade.

  1. 4 November 2024CChartDB, the founders' earlier open-source database tool, records version 1.0.0 in its changelog. [13, 3]
  2. 12 March 2026CFirst blog post: a single CLI command that adds secrets to any tool an agent calls, "without the agent ever seeing the raw keys". [8]
  3. 24 March 2026CNanoClaw makes OneCLI's Agent Vault its default credential and proxy layer, with one vault identity per agent group. [7, 9]
  4. 23 July 2026CY Combinator launch post, Summer 2026 batch: the founders report "320K+ downloads, 2,500+ GitHub stars". [3, 5]
  5. 14 to 20 August 2026CVersion 2: a sandboxed agent per employee in Slack and on the web, behind the same gateway; second launch post. [10, 4]
  6. 7 November 2026C3.6k GitHub stars; Team and Scale paid plans on the pricing page. [6, 2]
03

Why did OneCLI work?

Four causes, in the order they mattered. Each one is a reusable lesson.

01

The key never enters the agent

The agent sends every request through the gateway with a placeholder. The gateway matches the request by host and path, checks the policy, swaps in the real credential and forwards it. The launch post states the argument: "you can't steal what isn't there". Because it works at the network level, it covers command-line tools, curl and code that the agent writes, not only MCP tool calls.

02

Open source inside other people's agents

The gateway is free code that runs in one Docker container. NanoClaw built it into its framework as the default, which put OneCLI in front of that framework's users. Bitwarden added native support in its Agent Access SDK, and OneCLI is listed on the 1Password Marketplace. The paid product is the hosted version and the team features.

03

From a security layer to the agent itself

In August 2026 Jonathan Fishner wrote that teams kept asking for an agent for every employee, with onboarding, offboarding and approvals. Version 2 sells that agent, with the gateway still under it. The post says pricing is "per person rather than per agent"; the pricing page sets both seat and agent limits for each plan.

How it was built

These details come from the GitHub README, the launch posts and NanoClaw's post. They are grade C. [6, 3, 7]

  • A gateway written in Rust intercepts outgoing requests, HTTPS included, by acting as a man-in-the-middle proxy; agents authenticate to it with access tokens in Proxy-Authorization headers.
  • Secrets are stored encrypted with AES-256-GCM, decrypted only at request time, and added as headers or query parameters.
  • A Next.js web dashboard, an API server with PostgreSQL, a runner that starts and stops agent sandboxes, and a Slack adapter with one Slack app per agent.
  • Self-hosting with pnpm or a Helm chart on Kubernetes; the first version ran as a single Docker container that works with anything that can set HTTPS_PROXY.
  • A TypeScript SDK, @onecli-sh/sdk, which NanoClaw calls to route each container's traffic through the gateway.

Tools named in the sources

Each one opens its page in the Tools tab, with every story that uses it.

04

Who tried this before OneCLI, and why did they fail?

Three companies in a database of failed startups sold a security or access layer to developers and companies. The values below are from that database and are not independently verified.

Died 2011 to 2018Burned US$3M

Toopher

The promise

Two-factor login for companies that checked where the user was.

Why it died

It was acquired and then shut down; broader security suites offered more.

Competition
Died 2015 to 2021Burned US$20M

UnifyID

The promise

Login without passwords, from the way a person walks and types.

Why it died

Privacy concerns, cash-flow problems and the pandemic.

No Market Need
Died 2020 to 2024Burned US$3M

WunderGraph

The promise

An open-source gateway that joins GraphQL, REST and databases into one typed API.

Why it died

Open-source use did not turn into enough paid contracts, and large infrastructure vendors added gateway features.

Ran Out of Cash

The failed startups come from our database of 1,749 dead startups, retold here in our own words. Its entries are AI-assisted summaries of public sources, so these cards carry no evidence grade.

What changed

Toopher and UnifyID sold a better login for people and lost to larger security suites or to a weak market. WunderGraph had open-source users but too few paying ones. OneCLI faces both risks: it is a security layer that a larger vendor could add, and its traction so far is open-source counts.

What differs is the buyer's new problem. AI agents act on their own and read untrusted text, so a key they hold can leak in ways that a person's login cannot. A gateway that keeps the key outside the agent works for any agent framework, and NanoClaw's adoption brought it to that framework's users.

05

Can one person copy OneCLI now?

The idea, yes. The trust, slowly.

A proxy that adds credentials to agent requests is a well-defined piece of software; OneCLI's first version ran in one Docker container. Selling it is harder: a company must trust the gateway with every secret it has, and OneCLI's founders came with years of network-security work and a Y Combinator place.

Where it is still open: Other controls for agents at the network level: spending limits on paid APIs, data-loss checks on outgoing requests, and per-agent audit logs for regulated companies.

  1. 1Pick one risk that agents create and older tools do not cover, such as raw keys in an agent's context.
  2. 2Solve it at a layer every agent passes through, here the network, so it works with any framework.
  3. 3Release it as open source and get one popular framework to make it the default.
  4. 4Charge for the hosted version and the team features: seats, single sign-on, audit retention, approvals.

What could go wrong for OneCLI?

The risks are the mirror image of the causes above.

What is not verified

No revenue figure for OneCLI was found. What was looked for: a payment-processor profile (the pipeline's list of TrustMRR slugs has no OneCLI entry), revenue or customer figures in the founders' two launch posts and the company blog, and a funding amount on the Y Combinator page. The "320K+ downloads" are the founders' own count in their 23 July 2026 launch post and were not checked against a package registry; the GitHub star count shows developer interest, not paying customers. No paying customer is named in a downloaded source. A reader could look for a funding announcement after Demo Day or a customer case study.

Customer names on the home page

Under "Trusted by", the home page shows 14 company names, among them Docker, MindsDB, Zoho, Coralogix and Kakao Entertainment, filled in by a script. No downloaded page links them to a case study or says whether they are paying customers, free users or partners, and they were not checked with the companies.

Competition and model providers

On this site, Metorial sells a gateway for MCP tool calls and Kyvvu a check of each agent action; OneCLI works one level lower, on every HTTP request. NanoCo, the maintainers of NanoClaw, says on its site that it raised US$12M to give every member of a team a professional assistant, close to OneCLI's version 2. The gateway needs no model, but the version 2 agent does: the pricing page names hosted models from OpenAI, Anthropic and Google, or the customer's own Anthropic or OpenAI key.

One place that holds every secret

The gateway decrypts HTTPS traffic and keeps all of a company's credentials, so a flaw in it would expose everything at once. The company's own posts say that a credential vault "does not solve alignment" and only limits the damage of a wrong action. The enterprise features need a paid licence in production, so the free self-hosted version is not the full product.

Sources

The grade next to each source is the best grade that the source can support. "Read in full" means that the text of the page was downloaded and the numbers were checked in it.

  1. C OneCLI home page, read 7 November 2026
    Read in full, including the script that fills the "Trusted by" list. Source for the product, the Y Combinator note, the license note and the customer names.
  2. C OneCLI pricing page, read 7 November 2026
    Read in full, with its schema.org offer data. Source for the plans, prices, limits and model providers.
  3. C Y Combinator Launch, 23 July 2026: OneCLI - Your AI agents shouldn't be holding raw secrets (Jonathan Fishner and Guy Ben Aharon)
    Read in full. Source for the download and star counts, how the proxy works, the founders' background and ChartDB.
  4. C Y Combinator Launch, 20 August 2026: OneCLI - Give every employee a secured, sandboxed pro assistant agent
    Read in full. Source for version 2 and the founders' roles.
  5. C Y Combinator company page: OneCLI
    Read the company data. Source for the batch, the location and the two founders; no team size is given.
  6. C GitHub: onecli/onecli, read 7 November 2026
    Read the repository page and README in full. Source for stars, forks, commits, the architecture and the license.
  7. C NanoClaw Blog, 24 March 2026: NanoClaw Adopts OneCLI Agent Vault (Gavriel Cohen)
    Read in full. A partner's own account of the switch to OneCLI; also the site banner about NanoCo's funding.
  8. C OneCLI Blog, 12 March 2026: Why We Built OneCLI (Jonathan Fishner)
    Read in full. Source for the first product and the earliest date.
  9. C OneCLI Blog, 25 March 2026: NanoClaw Now Uses Agent Vault as Its Default Credential Layer (Jonathan Fishner)
    Read in full. Source for the rate-limit policy and the limits of a credential vault.
  10. C OneCLI Blog, 14 August 2026: Every Employee Gets an Agent (Jonathan Fishner)
    Read in full. Source for the move to version 2 and the five months of work before it.
  11. C OneCLI Blog index, read 7 November 2026
    Read in full. Source for the post dates, including the Bitwarden and 1Password posts.
  12. C OneCLI FAQ page, read 7 November 2026
    Read in full. Source for the supported agent frameworks and the network-level enforcement.
  13. C GitHub: chartdb/chartdb CHANGELOG.md
    Read the dates of the first entries. Source for the start of the founders' earlier project.
  14. C Database of failed startups, local export
    Local export. AI-written summaries, not independently verified. Source for the failed predecessors.

Run this company? Send corrections or a verified figure to aiolum@livyden.com

Back to all stories