Launch HN: OneCLI (YC S26) – OSS sandboxed agent harness for teams | AI Paper Digest

TL;DR Highlight

A gateway injects credentials into per-employee sandboxed agents so agents never see the real keys

Who Should Read

A platform or security engineer rolling out AI agents to employees who is worried about API keys and permissions

Core Mechanics

Agents never see the secrets
- Every outbound request goes through a Rust gateway that intercepts HTTPS via MITM and injects credentials.
- Agents authenticate with access tokens in the Proxy-Authorization header.
- The gateway is the only way out of the sandbox, so agents reach only what you granted.
One agent per employee
- Each workspace member gets a sandboxed agent, reachable from the dashboard or Slack.
- Agents are provisioned from the company IdP using each employee's identity.
- Team policy is managed in one place and applies to every agent.
Risky actions get fixed human approval
- Sending email, deleting a Linear ticket, or emptying an S3 bucket can require approval inside the chat.
- The approvals are described as deterministic.
An agent is a durable thing, not a prompt
- It has its own sandbox with a filesystem and shell, a conversation, memory, skills, and a schedule.
- Memory is kept by the platform and you can read and edit it.

Community Reactions

Opinions on policy granularity and prompt injection
- Several commenters asked whether policies go below the endpoint level: method, path, request fields, resource ownership, response volume.
- One said approval must bind to the exact action (recipient, repo, etc.) for APIs where read and write share a host.
Opinions on gateway failure behavior
- One commenter said forced egress through the gateway gives fail-closed behavior by construction.
- They noted that if agents call the gateway explicitly, you must check that no code path bypasses it.
Experience testing injection detection
- One commenter built seven attack corpora and measured 48-54% on broadly sampled sets but 6-13% on sets with no recognizable pattern.
- They concluded deterministic method, path and body matching plus approval bound to the exact call is the more reliable half.
Opinions on central policy, competition and licensing
- One commenter found six inconsistent secret-redaction denylists in their codebase, and the canonical one caught 10 of 17 credential shapes.
- Others felt fatigue at the number of similar products, mentioned Infisical and Nemesis8, and said the ee folder is not visible, making the license confusing.

How to Apply

Audit where your agent exposes secrets
- List every place a real API key enters your agent prompts, tool configs, or env vars.
- Mark which keys the model can see and make those the first candidates to move behind a proxy.
Run OneCLI locally
- Clone the repo, run pnpm install and pnpm run setup, then open localhost:10254.
- Give one test agent a single read-only connection and verify behavior.
List risky actions and pick approval targets
- Write down every write, delete, and send action your agent can take.
- Mark irreversible ones as requiring human approval.
Turn the policy questions into an adoption checklist
- Add method/path/field-level limits, fail-closed behavior, and audit logs as checklist items.
- Confirm the answers in the docs or Discord before deciding.

Try It

copy & run

# Paste into Claude or ChatGPT (a simple prompt version of checking gateway-style credential injection)

Here is my agent system design.
{{List of external APIs the agent calls, where keys are stored, approval process}}

Review it from these angles.
1. Where real credentials are exposed to the model context or sandbox
2. Whether all outbound requests can be forced through one gateway
3. APIs that need method/path-level policy rather than host-level
4. Irreversible actions that must require human approval
5. Whether it fails closed if the gateway is down

Summarize in a table and prioritize.

Next: pick the highest-risk key from item 1 and ask for a plan to switch it to proxy-based injection.

Terminology

Agent harnessThe frame that manages an agent's environment, permissions and tools. Think of it as the office plus the badge system.

Gateway (MITM proxy)A middle point that receives the agent's outbound requests and attaches credentials before forwarding. Like a front desk that holds the key and opens the door for you.

IdPThe identity provider that manages company accounts and logins. Like the HR team issuing employee badges.

Human-in-the-loop approvalA step where a person explicitly approves a risky action. Like needing a signature before a payment goes out.

Fail closedIf the checkpoint breaks, traffic is blocked rather than allowed. Like a security door that locks during a power outage.

Launch HN: OneCLI (YC S26) – OSS sandboxed agent harness for teams