OneCLI: Product, team and how it was built
OneCLI (Open-source credential gateway for AI agents, now also a sandboxed agent per employee; agents hold placeholder tokens and real secrets are added at the network layer, Israel): 3.6K GitHub stars and paid plans live, November 2026. Evidence grade E: no revenue figure was checked. Team: 2 co-founders (Jonathan Fishner, Guy Ben Aharon) in Tel Aviv; headcount not published. Launched 12 March 2026; still running.Added 7 November 2026
- Outcome
- 3.6K GitHub stars and paid plans live, November 2026
- Evidence
- E no revenue figure was checked
- Launch
- 12 March 2026
- Status
- Still running
- Team
- 2 co-founders (Jonathan Fishner, Guy Ben Aharon) in Tel Aviv; headcount not published
- Outside funding
- Y Combinator (Summer 2026); amount not published
- Main channel
- Open source
What is not verified
No revenue figure for OneCLI was found. What was looked for: a payment-processor profile (the pipeline's list of TrustMRR slugs has no OneCLI entry), revenue or customer figures in the founders' two launch posts and the company blog, and a funding amount on the Y Combinator page. The "320K+ downloads" are the founders' own count in their 23 July 2026 launch post and were not checked against a package registry; the GitHub star count shows developer interest, not paying customers. No paying customer is named in a downloaded source. A reader could look for a funding announcement after Demo Day or a customer case study. This story is grade E: the business is real and its product, price and customers are described from public pages, but no revenue figure was checked. Aiolum shows it as an idea worth studying, not as proof that it makes money.
OneCLI is a credential gateway for AI agents. A credential is a secret that proves who is calling a service, such as an API key (a password that lets a program use a service on someone's account), and a gateway here is a proxy, a program that receives each outgoing request and forwards it. The agent holds only a placeholder; the proxy swaps in the real key per request, after a policy check, so prompt injection or a bad log line has no key to leak. Since August 2026 the open-source code also runs a sandbox, an isolated computer with its own files and shell, for one agent per employee.
Jonathan Fishner (CEO) and Guy Ben Aharon (CTO) of Tel Aviv built it after ChartDB, an open-source database tool they made together. The first post on the OneCLI blog is dated 12 March 2026, and NanoClaw adopted the gateway on 24 March 2026. In their Y Combinator launch post of 23 July 2026 the founders wrote of "320K+ downloads, 2,500+ GitHub stars"; the GitHub page showed 3.6k stars on 7 November 2026. The pricing page lists a Team plan at US$149 a month with the customer's own model key.
No revenue figure was found, so the evidence grade is E. What is checked: the live site and pricing page, the GitHub repository, the Y Combinator company page and two launch posts, and NanoClaw's own post about the switch.

How much revenue does OneCLI make?
Each row shows the evidence grade and the source numbers from the list at the end of this page. The grades are explained in How Aiolum verifies.
| Fact | Value | Grade | How we know | Sources |
|---|---|---|---|---|
| Status, November 2026 | live on onecli.sh with a free plan and paid plans; code public on GitHub | C | Home page and pricing page read 7 November 2026. The home page says "Backed by Y Combinator" and "Core code is Apache-2.0". | [1, 2, 6] |
| GitHub repository, 7 November 2026 | 3.6k stars, 267 forks, 385 commits | C | github.com/onecli/onecli, read 7 November 2026. Stars show developer interest, not paying customers. | [6] |
| Downloads and stars, 23 July 2026 | "320K+ downloads, 2,500+ GitHub stars" | C | The founders' Y Combinator launch post. The download count was not checked against a package registry. | [3] |
| Default credential layer of NanoClaw | since 24 March 2026 | C | NanoClaw's post by Gavriel Cohen: NanoClaw "replaced" its own credential proxy "with the @onecli-sh/sdk". NanoClaw's site showed 31.1k+ stars on 7 November 2026. | [7, 9] |
| Founders | Jonathan Fishner (CEO) and Guy Ben Aharon (CTO), Tel Aviv-Yafo | C | Y Combinator company page. The launch post says Fishner worked on zero-trust network access at Axis Security and Ben Aharon was the first hire at Argon. | [5, 3] |
| Earlier project of the founders | ChartDB, an open-source database tool with "20K+ GitHub stars" | C | Founders' launch post: "Before OneCLI we built ChartDB together". ChartDB's changelog starts with version 1.0.0 on 4 November 2024. No downloaded source dates a company of the two founders before that. | [3, 13] |
| First dated public post | 12 March 2026 | C | "Why We Built OneCLI" by Jonathan Fishner, the oldest post on the blog index. A later post says the team "spent five months building the credential layer" before August 2026. | [8, 11, 10] |
| Funding | Y Combinator, Summer 2026 batch; amount not published | C | Y Combinator company page. Team size is not given there. | [5] |
| Paid plans | Team from US$149 a month; Scale from US$499 a month | C | Pricing page, 7 November 2026, with the customer's own model key. With hosted models: US$499 and US$1,999 a month. | [2] |
| Integrations with password managers | Bitwarden (30 March 2026) and the 1Password Marketplace (20 July 2026) | C | Dates and titles from the OneCLI blog index; the companies' own pages were not read. | [11] |
| License | Apache-2.0, except enterprise features under the OneCLI Enterprise License | C | README: the enterprise license is free for development and testing and "requires a subscription for production use". | [6] |
| Time from the first post to the November 2026 star count | 8 months | calc | Calculated: March 2026 to November 2026. | [8, 6] |
How to read this table: a grade C value is what the company's pages, its founders, its GitHub page or a partner's blog report. A "calc" value (grade X) was computed on this page. No value comes from a payment processor or a filing.
| Plan | Per month, billed yearly (US$) | Per month, billed monthly (US$) | Limit |
|---|---|---|---|
| Free | 0 | 3 human seats, 3 agents, 500 integration calls a month, US$5 in model credits | |
| Team, own model key | 149 | 5 human seats, 10 agents, unlimited integration calls | |
| Team, hosted models | 499 | 5 human seats, 10 agents, all hosted models | |
| Scale, own model key | 499 | 10 human seats, 20 agents, SSO and SAML; extra seat US$49 | |
| Scale, hosted models | 1,999 | 10 human seats, 20 agents; extra seat US$199 | |
| Enterprise | custom | self-hosted deployment, SLA, unlimited seats |
Each paid plan has two prices: the lower one is BYOC (bring your own Anthropic or OpenAI key, and pay the provider directly); the higher one includes hosted models from OpenAI, Anthropic, Google and open-weight makers, with fair-usage limits per session and per week. The page offers yearly billing with "2 months off" but shows only monthly prices, so the yearly column is empty. Self-hosting the Apache-2.0 core is free; the enterprise features in the code's ee/ folders need a subscription for production use.
When did OneCLI launch, and how did it grow?
From the founders' earlier open-source database tool to a gateway adopted by NanoClaw, then an agent per employee, in about two years. Each entry carries its grade.
- 4 November 2024CChartDB, the founders' earlier open-source database tool, records version 1.0.0 in its changelog. [13, 3]
- 12 March 2026CFirst blog post: a single CLI command that adds secrets to any tool an agent calls, "without the agent ever seeing the raw keys". [8]
- 24 March 2026CNanoClaw makes OneCLI's Agent Vault its default credential and proxy layer, with one vault identity per agent group. [7, 9]
- 23 July 2026CY Combinator launch post, Summer 2026 batch: the founders report "320K+ downloads, 2,500+ GitHub stars". [3, 5]
- 14 to 20 August 2026CVersion 2: a sandboxed agent per employee in Slack and on the web, behind the same gateway; second launch post. [10, 4]
- 7 November 2026C3.6k GitHub stars; Team and Scale paid plans on the pricing page. [6, 2]
Why did OneCLI work?
Four causes, in the order they mattered. Each one is a reusable lesson.
The key never enters the agent
The agent sends every request through the gateway with a placeholder. The gateway matches the request by host and path, checks the policy, swaps in the real credential and forwards it. The launch post states the argument: "you can't steal what isn't there". Because it works at the network level, it covers command-line tools, curl and code that the agent writes, not only MCP tool calls.
Open source inside other people's agents
The gateway is free code that runs in one Docker container. NanoClaw built it into its framework as the default, which put OneCLI in front of that framework's users. Bitwarden added native support in its Agent Access SDK, and OneCLI is listed on the 1Password Marketplace. The paid product is the hosted version and the team features.
From a security layer to the agent itself
In August 2026 Jonathan Fishner wrote that teams kept asking for an agent for every employee, with onboarding, offboarding and approvals. Version 2 sells that agent, with the gateway still under it. The post says pricing is "per person rather than per agent"; the pricing page sets both seat and agent limits for each plan.
How it was built
These details come from the GitHub README, the launch posts and NanoClaw's post. They are grade C. [6, 3, 7]
- A gateway written in Rust intercepts outgoing requests, HTTPS included, by acting as a man-in-the-middle proxy; agents authenticate to it with access tokens in Proxy-Authorization headers.
- Secrets are stored encrypted with AES-256-GCM, decrypted only at request time, and added as headers or query parameters.
- A Next.js web dashboard, an API server with PostgreSQL, a runner that starts and stops agent sandboxes, and a Slack adapter with one Slack app per agent.
- Self-hosting with pnpm or a Helm chart on Kubernetes; the first version ran as a single Docker container that works with anything that can set HTTPS_PROXY.
- A TypeScript SDK, @onecli-sh/sdk, which NanoClaw calls to route each container's traffic through the gateway.
Tools named in the sources
Each one opens its page in the Tools tab, with every story that uses it.
Who tried this before OneCLI, and why did they fail?
Three companies in a database of failed startups sold a security or access layer to developers and companies. The values below are from that database and are not independently verified.
Toopher
The promiseTwo-factor login for companies that checked where the user was.
Why it diedIt was acquired and then shut down; broader security suites offered more.
UnifyID
The promiseLogin without passwords, from the way a person walks and types.
Why it diedPrivacy concerns, cash-flow problems and the pandemic.
WunderGraph
The promiseAn open-source gateway that joins GraphQL, REST and databases into one typed API.
Why it diedOpen-source use did not turn into enough paid contracts, and large infrastructure vendors added gateway features.
The failed startups come from our database of 1,749 dead startups, retold here in our own words. Its entries are AI-assisted summaries of public sources, so these cards carry no evidence grade.
What changed
Toopher and UnifyID sold a better login for people and lost to larger security suites or to a weak market. WunderGraph had open-source users but too few paying ones. OneCLI faces both risks: it is a security layer that a larger vendor could add, and its traction so far is open-source counts.
What differs is the buyer's new problem. AI agents act on their own and read untrusted text, so a key they hold can leak in ways that a person's login cannot. A gateway that keeps the key outside the agent works for any agent framework, and NanoClaw's adoption brought it to that framework's users.
Can one person copy OneCLI now?
The idea, yes. The trust, slowly.
A proxy that adds credentials to agent requests is a well-defined piece of software; OneCLI's first version ran in one Docker container. Selling it is harder: a company must trust the gateway with every secret it has, and OneCLI's founders came with years of network-security work and a Y Combinator place.
Where it is still open: Other controls for agents at the network level: spending limits on paid APIs, data-loss checks on outgoing requests, and per-agent audit logs for regulated companies.
- 1Pick one risk that agents create and older tools do not cover, such as raw keys in an agent's context.
- 2Solve it at a layer every agent passes through, here the network, so it works with any framework.
- 3Release it as open source and get one popular framework to make it the default.
- 4Charge for the hosted version and the team features: seats, single sign-on, audit retention, approvals.
What could go wrong for OneCLI?
The risks are the mirror image of the causes above.
What is not verified
No revenue figure for OneCLI was found. What was looked for: a payment-processor profile (the pipeline's list of TrustMRR slugs has no OneCLI entry), revenue or customer figures in the founders' two launch posts and the company blog, and a funding amount on the Y Combinator page. The "320K+ downloads" are the founders' own count in their 23 July 2026 launch post and were not checked against a package registry; the GitHub star count shows developer interest, not paying customers. No paying customer is named in a downloaded source. A reader could look for a funding announcement after Demo Day or a customer case study.
Customer names on the home page
Under "Trusted by", the home page shows 14 company names, among them Docker, MindsDB, Zoho, Coralogix and Kakao Entertainment, filled in by a script. No downloaded page links them to a case study or says whether they are paying customers, free users or partners, and they were not checked with the companies.
Competition and model providers
On this site, Metorial sells a gateway for MCP tool calls and Kyvvu a check of each agent action; OneCLI works one level lower, on every HTTP request. NanoCo, the maintainers of NanoClaw, says on its site that it raised US$12M to give every member of a team a professional assistant, close to OneCLI's version 2. The gateway needs no model, but the version 2 agent does: the pricing page names hosted models from OpenAI, Anthropic and Google, or the customer's own Anthropic or OpenAI key.
One place that holds every secret
The gateway decrypts HTTPS traffic and keeps all of a company's credentials, so a flaw in it would expose everything at once. The company's own posts say that a credential vault "does not solve alignment" and only limits the damage of a wrong action. The enterprise features need a paid licence in production, so the free self-hosted version is not the full product.
Sources
The grade next to each source is the best grade that the source can support. "Read in full" means that the text of the page was downloaded and the numbers were checked in it.
- C OneCLI home page, read 7 November 2026Read in full, including the script that fills the "Trusted by" list. Source for the product, the Y Combinator note, the license note and the customer names.
- C OneCLI pricing page, read 7 November 2026Read in full, with its schema.org offer data. Source for the plans, prices, limits and model providers.
- C Y Combinator Launch, 23 July 2026: OneCLI - Your AI agents shouldn't be holding raw secrets (Jonathan Fishner and Guy Ben Aharon)Read in full. Source for the download and star counts, how the proxy works, the founders' background and ChartDB.
- C Y Combinator Launch, 20 August 2026: OneCLI - Give every employee a secured, sandboxed pro assistant agentRead in full. Source for version 2 and the founders' roles.
- C Y Combinator company page: OneCLIRead the company data. Source for the batch, the location and the two founders; no team size is given.
- C GitHub: onecli/onecli, read 7 November 2026Read the repository page and README in full. Source for stars, forks, commits, the architecture and the license.
- C NanoClaw Blog, 24 March 2026: NanoClaw Adopts OneCLI Agent Vault (Gavriel Cohen)Read in full. A partner's own account of the switch to OneCLI; also the site banner about NanoCo's funding.
- C OneCLI Blog, 12 March 2026: Why We Built OneCLI (Jonathan Fishner)Read in full. Source for the first product and the earliest date.
- C OneCLI Blog, 25 March 2026: NanoClaw Now Uses Agent Vault as Its Default Credential Layer (Jonathan Fishner)Read in full. Source for the rate-limit policy and the limits of a credential vault.
- C OneCLI Blog, 14 August 2026: Every Employee Gets an Agent (Jonathan Fishner)Read in full. Source for the move to version 2 and the five months of work before it.
- C OneCLI Blog index, read 7 November 2026Read in full. Source for the post dates, including the Bitwarden and 1Password posts.
- C OneCLI FAQ page, read 7 November 2026Read in full. Source for the supported agent frameworks and the network-level enforcement.
- C GitHub: chartdb/chartdb CHANGELOG.mdRead the dates of the first entries. Source for the start of the founders' earlier project.
- C Database of failed startups, local exportLocal export. AI-written summaries, not independently verified. Source for the failed predecessors.
Run this company? Send corrections or a verified figure to aiolum@livyden.com