OneCLI
Infrastructure · tested 2026-08-18 · re-test due 2026-11-16 · by the Hlido desk, not the vendor
In short: A network-layer firewall that treats coding-agent policy as something enforced outside the model, not requested politely inside it — and that architectural choice is the whole pitch.
Quick answer
OneCLI scores 76/100 (STEADY) on Hlido’s independent, hands-on test (reviewed 2026-08-18). STEADY (76) because the security model is architecturally sound (enforcement at the network layer, credentials never in the agent, deterministic policy independent of the LLM), the trust surface is strong for the stage ( Pricing: Open source · Usage-based · Free tier (free entry point documented).
OneCLI sells one clear idea: an agent's permissions should live at the network boundary, not in a prompt the model can talk itself out of. You wrap an agent — Claude Code, Codex, Cursor — with `onecli run` and every path it takes (MCP tool calls, shell commands, curl, and the code it writes) passes through a gateway that blocks endpoints, rate-limits, requires human approval on sensitive operations, and injects scoped credentials so the agent never holds a real secret. The framing is deliberate and, on the surface we captured, honest: 'prompts are suggestions, OneCLI policies are enforced at the network layer, outside the agent, outside the LLM.' That is the correct threat model for autonomous agents, and OneCLI states it more crisply than most. The trust signals are unusually strong for an early tool — Y Combinator backing, a wall of named users (Docker, MindsDB, Zoho, Coralogix, Kakao Entertainment), an open-source core, a free-forever tier for up to two agents, and published comparison pages against HashiCorp Vault, Infisical and LiteLLM. What the public surface cannot tell us is depth: the logos are presented without context on whether they are paying customers or evaluations, there is no independent security audit or bypass-testing evidence on the page, and the credential-vault and network-enforcement claims are exactly the kind that need behavioural verification we could not perform from the marketing surface. The category itself is heating up fast (Phinq, hotcell and others occupy adjacent ground), so positioning clarity alone will not hold the lead. But as a statement of the right architecture with real backing and a usable free tier, OneCLI is a credible pick to actually try.
Why STEADY
STEADY (76) because the security model is architecturally sound (enforcement at the network layer, credentials never in the agent, deterministic policy independent of the LLM), the trust surface is strong for the stage (YC backing, named user wall, open-source core, transparent comparison pages, free tier), and it is directly usable by agents today. Not VITAL because none of the enforcement or credential-isolation claims are independently verified on the captured surface — no audit, no published bypass testing — the user logos carry no engagement context, and the agent-security category is crowded enough that durability is unproven.
What it does well
- Enforces agent policy at the network layer, outside the model, where a prompt-injection cannot argue its way past it
- Injects scoped, per-request credentials so agents never hold a real secret — a leaked log or malicious dependency finds nothing
- Wraps existing agents (Claude Code, Codex, Cursor) without requiring you to change how you run them
- Covers every egress path — MCP tool calls, CLI commands, curl, and code the agent writes — not just one surface
- Free forever for up to two agents with no credit card, and an open-source core that can be inspected
What it fails at
- No independent security audit or published bypass-testing evidence on the captured surface — the core claims are unverified
- The named-customer wall carries no context on whether logos are paying users or evaluations
- Policy expressiveness and false-positive/false-negative rates are undocumented on the public page
- Operates in a fast-filling category (Phinq, hotcell, gateway proxies) where architectural clarity alone is not a moat
- Self-hosting, latency overhead and failure modes (what happens when the gateway is down) are not described on the surface
Best for
- Teams running autonomous coding agents that need a hard stop on destructive actions (DROP, DELETE, payments)
- Organisations that must keep provider and service credentials out of agent processes entirely
- Developers who want deterministic, human-in-the-loop approval on sensitive operations rather than prompt-based guardrails
- Anyone wanting a free way to gate one or two agents before committing to a paid control plane
Not recommended for
- Buyers who require a completed third-party security audit before trusting an enforcement boundary
- Teams needing documented SLAs, gateway-failure behaviour and latency guarantees up front
- Single-prompt, non-autonomous LLM usage where there is no agent to gate
- Environments that cannot route agent egress through an external gateway
Pricing & access
- ModelOpen source · Usage-based · Free tier
- Free entry pointYes — a free tier or open-source edition is documented
Derived from Hlido-held evidence only (engine checklist + editorial text); quotes are verbatim from the scorecard; not vendor-supplied; re-derived daily. Verify current prices on the vendor's pricing page. Last verified 2026-08-18.
Compared to
-
Phinq
network-and-credential-enforcement
Both put a deterministic boundary between an agent and dangerous actions, but at different layers: OneCLI is a network gateway that also owns credentials and endpoint policy, while Phinq intercepts individual tool calls and holds risky ones for human approval with a tamper-evident audit log. OneCLI is the broader infrastructure play (creds + network + rate limits); Phinq is the lighter, MIT-licensed approval layer you install in two minutes.
Agent relevance
API CLI Behavioral-testable
Agentic-Commerce Readiness 51/100 · INTEGRABLE
Independent readiness for agent delegation & transaction. How it’s scored · check live
OneCLI is infrastructure FOR agents rather than an agent itself: you wrap an existing agent with `onecli run -- <agent>` and it gates that agent's MCP calls, shell commands and network egress through a gateway. Direct fit for any autonomous coding-agent stack; the value is enforcement and credential isolation around the agent, not a callable tool surface the agent drives.
Agent-friendly score: 8/10
Score over time
The longitudinal record — every point is the score as published on that date. Raw series.
Evidence
- Enforces policy at the network layer, outside the agent and the LLM — source (2026-08-18) verified
- Scoped credentials injected per request; agents never hold a real secret — source (2026-08-18) verified
- Y Combinator backing and named users (Docker, MindsDB, Zoho, Coralogix) — source (2026-08-18) verified
- Free forever for up to two agents; open-source trust layer — source (2026-08-18) verified
- Independent security audit or bypass testing — source (2026-08-18)
scorecard.json · registry · methodology
Embed this trust badge
Markdown
[](https://hlido.eu/check/?agent=onecli-onecli)HTML
<a href="https://hlido.eu/check/?agent=onecli-onecli"><img src="https://hlido.eu/badge/onecli-onecli.svg" alt="Hlido trust score"></a>