YC S26 startup OneCLI launches open-source sandboxed agent harness for teams

According to the launch post by founders Jonathan and Guy, both with backgrounds in cybersecurity, OneCLI started as a credential vault for AI agents. It grew out of work on an open-source database tool called ChartDB, where they saw that agents need credentials to do real work but could be tricked into giving up API keys and secrets through prompt injection. The solution is a gateway that injects real credentials per request without them ever entering the agent's context, memory or logs.

The harness runs on infrastructure controlled by the company, either self-hosted or in the cloud. Each agent is placed in an isolated VM with its own memory, keys and permissions, limiting the blast radius of any single compromise. Policies set by administrators are enforced at the network layer, outside the model, so the agent cannot bypass them. The agent loop is powered by an engine called jcode, written in Rust.

The post describes several capabilities: connecting GitHub, Gmail, Notion or Dropbox from the chat; deterministic human-in-the-loop approvals for sensitive actions such as sending an email or deleting a ticket; centralized team policy management applied across all agents; and shared team-level connections like LLM keys and service accounts. The entire platform is open source under an Apache-2.0 license, with a small enterprise exception, allowing companies to verify the code rather than trust the vendor.

As for real-world use, the founders said some users manage their entire company lifecycle with OneCLI, from sales calls to automatically opening tickets for engineering teams, while others use it for operational tasks like CRM hygiene, lead sourcing and follow-up emails. Some customers also use agents for grocery shopping and online chores.