The archive · Developer & Business Tools · Product decision · 2026
OneCLI bets agent security belongs outside the model — secrets never reach the agent
A Rust vault for agent secrets became OneCLI (YC S26), an open-source team harness — Show HN 161 points in March, Launch HN 88 points in August.
OneCLI
What the business is
OneCLI is an open-source agent harness that gives each employee a sandboxed assistant connected to GitHub, Gmail, Notion, Dropbox or CRM from chat, under one org-wide policy: per-agent scoping, deterministic human approval for sensitive actions, an identity trail, and real credentials swapped in per request by a gateway the agent never touches.
Starting capital：Y Combinator Summer 2026 standard package (reported ~$500,000 via SAFEs); no separate round disclosed.
How it started
The founders had built ChartDB, an open-source database tool. When OpenClaw took off in January 2026 they started orchestrating agents on top of it and immediately hit an auth problem: agents needed credentials to do real work, but held them in memory and wrote them to local files, where a prompt injection could steal them. They built OneCLI in Rust as a vault for AI agents, launched it on Hacker News on 2026-03-12, and the Show HN drew 161 points and 52 comments.
What happened
Demand came mostly from users of autonomous agents such as OpenClaw, Hermes and NanoClaw, and it exposed two missing pieces: managing secrets and permissions, and managing many agents for a team. So the founders pivoted from vault to harness — a sandboxed agent per employee, org-wide policy enforced at the network layer outside the model, placeholders instead of real secrets, human approval for risky calls, and a full identity trail. They joined YC's Summer 2026 batch, and the Launch HN on 2026-08-19 drew 88 points and 36 comments, mostly security engineers probing granularity, prompt-injection residue and a crowded market; the founders answered that they were still figuring out how to win it.
How it ended up
As of September 2026 OneCLI is open source (Apache-2.0 with an enterprise folder), self-hostable in minutes, and listed as an active YC Summer 2026 company in San Francisco. HN commenters reported NanoClaw announcing OneCLI as its credential layer and 3,200+ GitHub stars within hours of launch; no revenue or customer names are public.
Background
OneCLI's founders had built ChartDB, an open-source database tool. When OpenClaw took off in January 2026 and they started running agents on top of ChartDB, they hit a structural problem: agents need credentials to act, but agents that hold real keys keep them in memory and in local files, where a prompt injection or a careless session can leak them. Their answer, built in Rust, was a gateway — the agent gets a placeholder and the real credential is swapped in at the network layer only after a policy check.
The Show HN on 2026-03-12 drew 161 points and 52 comments. The users who arrived were mostly running OpenClaw, Hermes and NanoClaw, and what they asked for next was not a better vault but team controls: per-employee identity, org-wide policy, and approval for sensitive actions. So OneCLI pivoted from vault to harness — a sandboxed agent per employee, connected to GitHub, Gmail, Notion, Dropbox or CRM from chat, with enforcement outside the model and a full identity trail.
The founders, who came from zero-trust networking at Axis Security and AppSec at Argon, joined YC's Summer 2026 batch and launched the harness on Hacker News on 2026-08-19, drawing 88 points and 36 comments. The thread mixed adoption signals — NanoClaw naming OneCLI its credential layer, 3,200+ GitHub stars within hours — with hard questions from security engineers about policy granularity, confused-deputy risk and a crowded market the founders conceded they had not yet figured out how to win.
What has to be true
- Giving an agent a raw API key is structurally unsafe: the secret lives in model context and local files, where prompt injection can reach it — removing it from the model is the only robust fix.
- Enforcement outside the model mirrors zero-trust networking: the founders had spent years at Axis Security proving you never trust the client and police access at the network layer.
- The pivot was user-driven: vault users running OpenClaw and NanoClaw kept asking for identity, policy and multi-player management, which a single-user tool could not answer.
- Open source was the sales motion: companies that must trust an agent with mail, code and CRMs need to read the code and self-host, not take a vendor's safety promise.
What can be applied
Let your users point at the real product: vault users kept asking for team identity and policy, so the founders made the gateway a feature of a fuller harness instead of staying a nice tool.
Aftermath
As of September 5, 2026 OneCLI is an active YC Summer 2026 company in San Francisco, shipping an open-source, self-hostable agent harness. Public signals from its August launch: 88 points and 36 comments on the Launch HN thread, commenters reporting NanoClaw announcing OneCLI as its credential layer and more than 3,200 GitHub stars within hours, and a live profile on Y Combinator's directory under partner Brad Flora. The company discloses no revenue or customer names, and founders told the HN thread they were still deciding how they win a crowded agent-security market.
Sources
- Show HN: OneCLI – Vault for AI Agents in Rust
- Launch HN: OneCLI (YC S26) – OSS sandboxed agent harness for teams
- OneCLI: The open source AI teammates for your company
spotted an error? The archive wants to know.
Your turn
You just read one. Describe what you are building, and see who is betting on the same thing.
Free account · 3 free questions · no card