OneCLI

What is OneCLI?

OneCLI is an open-source, self-hosted agent harness that acts as a security firewall for AI coding agents. Instead of trusting agents to behave responsibly, OneCLI sits between them and your infrastructure, enforcing policies at the network layer. It gates risky actions, blocks unauthorized API calls, and keeps real credentials locked in a vault—so agents never touch a secret directly. Built for developers who use tools like Claude Code, OpenAI Codex, or Cursor, OneCLI turns "please don't delete the database" from a prompt into a hard rule that cannot be bypassed.

Who it's for

• Security-conscious engineering teams — those who want to adopt AI coding agents without exposing production data or critical infrastructure to unpredictable model behavior.
• Developers tired of babysitting agents — anyone who has watched an agent ignore instructions, run destructive commands, or spiral into runaway loops, and wants deterministic guardrails instead of hopeful prompting.
• Self-hosting advocates — teams that prefer keeping their tooling on their own infrastructure, with full control over policies, credentials, and audit trails, rather than relying on third-party cloud services.

Key features

Network-layer enforcement

OneCLI doesn't rely on the agent's judgment. It enforces policies at the proxy level, outside the LLM entirely. Whether the agent makes MCP tool calls, runs CLI commands, uses curl, or writes code, every request passes through the gateway where rules are applied deterministically.

Scoped credential injection

Agents never hold a real secret. OneCLI injects scoped credentials per request, meaning each call gets exactly the access it needs—and nothing more. If an agent goes rogue, it can't exfiltrate keys because it never had them in the first place.

Policy rules that can't be ignored

You can block specific endpoints like DELETE /repos or POST /payments, rate-limit agents per minute or hour, require human approval for sensitive operations, and scope access per project. These aren't suggestions—they're enforced at the network layer, so even a compromised or misbehaving agent can't break them.

What stands out

Prompts are suggestions. OneCLI policies are enforced at the network layer, outside the agent, outside the LLM.

This is the core insight that sets OneCLI apart. Most agent security tools try to coax models into behaving through better prompts or fine-tuning. OneCLI recognizes that any LLM can be tricked, confused, or simply fail to follow instructions. By moving enforcement to the network layer, it makes safety a property of the infrastructure, not the model. The result is a system where "the agent tried to delete everything" becomes a rejected request, not a headline.