Is OneCLI profitable or generating revenue in 2026?

No. As of July 2026, OneCLI discloses no revenue or ARR figures. It is a Y Combinator Summer 2026 batch company with a team of 1-10 people, funded only through YC's standard deal, with no confirmed seed or Series A round reported beyond the accelerator investment.

OneCLI is privately held and venture-backed only through Y Combinator's S26 accelerator program as of July 2026. Founders Jonathan Fishner (CEO) and Guy (CTO) retain control; no outside seed or Series A investor has been publicly named beyond the standard YC deal.

Could AI agent platforms like Claude Code or Cursor replace OneCLI?

Potentially. OneCLI's core feature, keeping credentials out of agent context, is exactly the kind of trust and safety capability platforms like Anthropic's Claude Code, OpenAI's Codex, or Cursor could ship natively, which would erase OneCLI's differentiation within an estimated 12 to 18 month window as of 2026.

Who is OneCLI's biggest competitor?

Aembit, a funded non-human identity specialist, already shipped a competing 'MCP Identity Gateway' for agent-to-server authentication as of mid-2026. Larger incumbents CyberArk (via Palo Alto Networks, deal completed February 2026) and Cisco (via Astrix acquisition) are also entering the same space.

How much traction does OneCLI actually have?

OneCLI claims 320,000+ downloads and 2,500+ GitHub stars as of its July 23, 2026 YC launch, a figure independently corroborated by GitHub metadata (2.5K stars, 133 forks) on July 6, 2026. Customer logos like Docker and Zoho are vendor-displayed but unverified as paying customers.

What does OneCLI actually do?

OneCLI is an open-source credential gateway that intercepts AI agents' outbound network traffic, storing real API keys in an AES-256-GCM encrypted vault and injecting them at request time so agents like Claude Code or Cursor never hold raw secrets, per its GitHub documentation as of 2026.

YC Summer 2026 · United States

OneCLI

Open-source proxy that hides API keys and secrets from AI coding agents.

Losing its protection

Assessed 27 July 2026 · Evidence as of 27 July 2026

The structural protection is eroding.

On the recordSince 27 July 2026 · Checkable from Q4 2026 · Every call on the record Checkpoint: Design partners like Docker, Zoho, Coralogix convert (or fail to convert) to paying Cloud customers

The call

OneCLI is an early open-source credential proxy racing established identity vendors and agent platforms that could absorb its core function natively.

OneCLI solves a real problem: keeping passwords and API keys safe when AI agents (like ChatGPT or Claude) need them to do work. Major security companies like Palo Alto and Cisco have bought similar startups, which proves the category is real and valuable. The problem is twofold: first, big security companies like Okta and Microsoft can build this feature themselves and sell it to their existing customers; second, the AI companies making Claude and ChatGPT could simply bake credential protection directly into their platforms as a safety feature, making OneCLI unnecessary. The company is in a race against the clock, with roughly 12-18 months before one of these competitors ships a built-in solution.

Why

AI pressure: Anthropic Claude Code, OpenAI Codex, Cursor. If these agent tools add native secret redaction as a trust feature, OneCLI's proxy layer becomes optional. Could AI do the core job? Yes, likely.

Bigger players: CyberArk (Palo Alto Networks), Cisco Astrix, Okta, Microsoft Entra, HashiCorp. These identity vendors already sell non-human identity tools and can bundle agent credential injection into existing suites. Could a giant copy it? Yes, easily.

What protects it. An active open-source community (stars, forks, downloads) and unverified enterprise logos, but no confirmed paying customers yet.

What would change this call

Anthropic, OpenAI, or Cursor ships a native 'secrets never touch agent context' feature in their agent runtime. Would show OneCLI's core proxy layer is being absorbed by the platforms it sits on top of.
OneCLI announces named, paying Cloud-tier customers converted from its listed design-partner logos within 90 days of its July 2026 launch. Would show real commercial traction rather than a marketing-only logo wall.
Aembit, Astrix, or another funded NHI specialist announces a self-hosted or PLG developer-tier product targeting the same open-source segment. Would show a funded rival is closing OneCLI's early distribution lead before it reaches enterprise lock-in.

Key numbers

2.5K GitHub stars, 133 forks confirmed via repo metadata (2026-07-06)
320K+ downloads claimed by vendor (2026-07-23)
50+ app integrations, 24 API endpoints listed (2026-07-22)

Named risks

Major agent platforms (Claude Code, Codex, Cursor) natively ship credential-out-of-context features, erasing differentiation. Severity: high
Better-funded NHI specialists like Aembit consolidate the market before OneCLI reaches enterprise lock-in. Severity: high
No disclosed revenue or paying customer confirmation as of July 2026, traction may be marketing-only. Severity: medium
HN community criticism that encryption/proxy approach is too weak for real security. Severity: medium
Team of only 1-10 people competing against enterprise incumbents with full sales channels. Severity: medium

Rivals, as read in July 2026

Rival	Direction	Evidence
Aembit	losing to	Already shipped competing MCP Identity Gateway product as of mid-2026, ahead of OneCLI
Cisco (via Astrix acquisition)	losing to	Acquired NHI governance vendor Astrix, giving enterprise scale OneCLI lacks as of 2026
Palo Alto Networks (via CyberArk)	losing to	CyberArk acquisition completed February 2026, adding identity heft to agent-security push
Anthropic Claude Code / OpenAI Codex / Cursor	contesting	Could natively ship credential-out-of-context feature within 12-18 months, per 2026 analysis
Okta, Microsoft Entra, HashiCorp	gaining on	Extending existing human IAM/vault platforms into agent identity as of July 2026

Questions people ask

Is OneCLI profitable or generating revenue in 2026?: No. As of July 2026, OneCLI discloses no revenue or ARR figures. It is a Y Combinator Summer 2026 batch company with a team of 1-10 people, funded only through YC's standard deal, with no confirmed seed or Series A round reported beyond the accelerator investment.
Who owns OneCLI?: OneCLI is privately held and venture-backed only through Y Combinator's S26 accelerator program as of July 2026. Founders Jonathan Fishner (CEO) and Guy (CTO) retain control; no outside seed or Series A investor has been publicly named beyond the standard YC deal.
Could AI agent platforms like Claude Code or Cursor replace OneCLI?: Potentially. OneCLI's core feature, keeping credentials out of agent context, is exactly the kind of trust and safety capability platforms like Anthropic's Claude Code, OpenAI's Codex, or Cursor could ship natively, which would erase OneCLI's differentiation within an estimated 12 to 18 month window as of 2026.
Who is OneCLI's biggest competitor?: Aembit, a funded non-human identity specialist, already shipped a competing 'MCP Identity Gateway' for agent-to-server authentication as of mid-2026. Larger incumbents CyberArk (via Palo Alto Networks, deal completed February 2026) and Cisco (via Astrix acquisition) are also entering the same space.
How much traction does OneCLI actually have?: OneCLI claims 320,000+ downloads and 2,500+ GitHub stars as of its July 23, 2026 YC launch, a figure independently corroborated by GitHub metadata (2.5K stars, 133 forks) on July 6, 2026. Customer logos like Docker and Zoho are vendor-displayed but unverified as paying customers.
What does OneCLI actually do?: OneCLI is an open-source credential gateway that intercepts AI agents' outbound network traffic, storing real API keys in an AES-256-GCM encrypted vault and injecting them at request time so agents like Claude Code or Cursor never hold raw secrets, per its GitHub documentation as of 2026.

Timeline

2026-07-23OneCLI holds formal Launch YC and Hacker News Show HN launch, adds IdP integration and org policies
2026-07-22Third-party listing confirms 50+ app integrations, 24 API endpoints, Apache-2.0 license
2026-07-18YC batch tracker lists OneCLI team size at 1-10 employees
2026-07-07OneCLI GitHub repo latest release v1.41.0, repo at 2.5K stars, 133 forks
2026-05-24OneCLI publishes integration guide pairing with NanoClaw agent runtime
2026-05-20Peer YC AI-agent-infra company NanoClaw turns down $20M buyout, raises $12M seed instead
2026-03OneCLI Show HN post introduces Rust-based credential vault for AI agents
2026-02CyberArk acquisition by Palo Alto Networks completes, consolidating identity-security competition

Revision history

27 July 2026

First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.

In the same band

Cosmic Robotics Pango Atlas Discovery