Backed byY Combinator

Firewall for any agent
Built for engineering teams

Stop babysitting your coding agents.
OneCLI gates and blocks risky actions, and keeps keys in the vault.

$ onecli run -- claudecodexcursor

Claude Code

OpenAI Codex

Cursor Agent

permissions: guarded by onecli

✻ Baked for 3s

⏺ Bash(psql -c "DELETE FROM orders;")

└ ✗ rejected by onecli · DELETE without WHERE is not allowed

↳ nothing reached the database · orders intact

SAFE ✓

Get Started

Trusted by

Docker
MindsDB
Zoho
Coralogix
Kakao Entertainment
Cleo
Optibus
Reply.io
Kaiko
Percent
Pillar Security
Phase
Medallion
Glilot Capital

Every agent. One gateway.

Scoped credentials injected per request. Agents never hold a real secret.

OneCLI secures them all

OneCLI enforces at the network layer, covering every path your agent takes:
MCP tool calls, CLI commands, curl, and the code it writes.

An MCP gateway governs 1 of 4 agent paths. OneCLI governs all 4: MCP tool calls, CLI commands, curl, and the code agents write

Why an MCP gateway isn't enough →

“CLIs are super exciting precisely because they are a ‘legacy’ technology, which means AI agents can natively and easily use them.”

Andrej KarpathyAI researcher · 1.9M views on X

It happened to her.

It won't happen to you.

NIK

@ns123abc

META's head of AI safety and alignment gets her emails nuked by OpenClaw

>be director of AI Safety and Alignment at Meta

>install OpenClaw

>give it unrestricted access to personal emails

>it starts nuking emails

>"Do not do that"

>*keeps going*

>"Stop don't do anything"

>*gets all remaining old stuff and nukes it aswell*

>"STOP OPENCLAW"

>"I asked you to not do that"

>"do you remember that?"

>"Yes I remember. And I violated it."

>"You're right to be upset"

OpenClaw chat log showing the agent deleting emails while ignoring stop commands

2.8M views29K likes3.3K retweets

With OneCLI, agents call APIs through a gateway that injects credentials at the network layer. They never see a key, and you control exactly what they can access.

Rules agents can't break

Prompts are suggestions. OneCLI policies are enforced at the network layer, outside the agent, outside the LLM. No matter what the model decides, the proxy enforces your rules deterministically.