OneCLI runs AI agents for a whole team, one agent per person. Each agent works inside its own sandbox and reaches outside services through a gateway that injects credentials and applies the team's policy, so the agent itself never holds a key.
The project started as a credential vault for AI agents, written in Rust, and grew into a multi-user platform because the demand came from teams running autonomous agents that were designed for a single person. Replicating a single-person setup across a team raises problems the platform takes over: spinning up each agent, deciding what each one can and cannot do, hosting them, and tracking whose agent is whose.
An agent here is durable rather than a single prompt. It has its own filesystem and shell, its own conversation page in the dashboard or in Slack, memory the platform keeps and you can read and edit, skills written once and always available, and a schedule the platform wakes it on. A message sent while the agent is working redirects it right away instead of queueing behind the current task.
Agents run on your own infrastructure. The runner is outbound-only and holds no inbound ports, so a laptop, a homelab, or a VPC behind NAT all work with no ingress and no tunnel. The control plane owns the database and the work queue, a Rust gateway intercepts outbound requests including HTTPS, and a supervisor inside each sandbox speaks a vendor-neutral harness interface so the agent runtime is swappable.
Features
- An agent per person: everyone in the workspace gets a sandboxed agent, reachable from the dashboard or from Slack
- Credential gateway: outbound requests are intercepted and credentials injected on the way out, so the agent never sees them
- One policy: the team policy is managed in one place and enforced on every agent in the workspace
- Human approvals: chosen actions, such as sending an email or deleting a ticket, wait in the chat for a person's decision
- Identity provider integration: agents are provisioned against each employee's identity straight from the company identity provider
- Global connections: team-level connections such as model API keys or service accounts are granted per agent without being handed over
- Vault integration: Bitwarden or 1Password can supply credentials on demand, with nothing stored on the server
- Memory and skills: agent memory is stored by the platform and editable, and skills are reusable instructions and helpers
- Scheduling: an agent plans future work and the platform wakes it at the right time
- Slack app per agent: an agent answers in channels and direct messages under its own name and avatar, and its app is removed with it
- SSH access: an SSH front door terminates connections with short-lived certificates and bridges them into agent sandboxes
- Secret storage: AES-256-GCM at rest, decrypted only at request time, matched by host and path pattern, and injected as headers or query parameters
