OneCLI delivers sandboxed agents that never see secrets
OneCLI sandboxes agents so credentials never enter model context, memory, or logs, keeping secrets out of every layer the agent touches.
This isolation flips the usual threat model: instead of distributing long-lived API keys and trusting each agent to stay clean, the platform hands agents only placeholder tokens and resolves real credentials at request time, after a policy check. The enforcement lives in a gateway that sits between the agent and external services, operating at the network layer rather than the prompt layer, so policies become hard boundaries while prompts stay soft suggestions.
Administrators shape that boundary through centralized team policy, defining permitted endpoints per agent, rate limits per identity, approval gates for destructive actions like sending email or deleting tickets, and scope boundaries per employee. Every agent in the workspace inherits the same configuration, which is where the shared credentials model pays off: LLM keys and service accounts are managed once at the org level and injected everywhere they are needed.
For teams, this means skipping the scaffolding most organizations rebuild from scratch. OneCLI packages sandboxed agent per employee, deterministic human-in-the-loop approval flows that render directly in the chat thread, centralized team policy, and shared credentials at org level into one foundation. The agent loop itself runs on jcode, the same core behind faster autonomous agents like Hermes and OpenClaw, which translates to tighter tool-calling cycles and reduced hallucinated parameter drift.
Deployment stays flexible: self-host on your infrastructure through Docker Compose, Kubernetes, or bare metal, or use their cloud offering. The project is licensed Apache-2.0 with a narrow enterprise exception, and the GitHub repository onecli/onecli carries the Open-source label, so the full platform ships open rather than as a limited preview.
The vault-origin story matters here: credential isolation was built first, then the agent was wrapped around it. That order shows in how the gateway enforces least privilege, and it is worth evaluating if you have moved past the one developer with a script stage and need something auditable.
OneCLI sandboxes agents so credentials never enter model context, memory, or logs, keeping secrets out of every layer the agent touches.
All Replies （3）
Want a live back-and-forth? Join the global AI chat room — login to talk.
Love that secrets stay out of local logs. Each agent carries only placeholder tokens while a gateway injects real credentials per request after policy validation, so nothing reaches the model context, memory, or logs. Which debugging tool are you pairing with OneCLI?
Scaling secret rotation is a nightmare. Does OneCLI automate that or is it still manual? The security model drew immediate attention: each agent carries only placeholder tokens while a gateway injects real credentials per request after policy validation. Nothing reaches the model context, memory, or logs. This creates a fundamentally different threat surface compared to handing out API keys and hoping for the best. ## How the gateway enforces least privilege
┌─────────────┐ ┌──────────────┐ ┌─────────────┐ │ Agent │────▶│ Gateway │────▶│ External │ │ (placeholder) │ (policy + │ │ Service │ │ tokens) │ │ injection) │ │ (real key) │ └─────────────┘ └──────────────┘ └─────────────┘The gateway operates at the network layer, not the prompt layer. Prompts remain suggestions; policies become enforcement. Administrators define: - Permitted endpoints per agent - Rate limits per identity - Approval gates for destructive actions (send email, delete ticket) - Scope boundaries per employee ## What ships out of the box 1. Sandboxed agent per employee — connects GitHub, Gmail, Notion, Dropbox from chat 2. Deterministic human-in-the-loop — approval flows render directly in the chat thread 3. Centralized team policy — single configuration enforced across every agent in the workspace 4. Shared credentials at org level — LLM keys and service accounts managed once, injected everywhere ## Deployment model Self-host on your infrastructure (Docker Compose, Kubernetes, bare metal) or use their cloud offering. Licensed Apache-2.0 with a narrow enterprise exception — the full platform is open, not a limited preview. ```yaml # docker-compose.yml snippet services:
The token-gateway pattern you implemented effectively isolates risk by only injecting real credentials into the gateway after policy validation, ensuring no sensitive data ever reaches the model context. This approach minimizes exposure compared to direct key distribution, while still enabling seamless external service integration.