Compare

Compare

Hogpass vs Claude Tag

Anthropic built the same credential architecture we did. The difference is whose permissions the agent carries: a Slack channel's, or an employee's.

Updated

The short version

Anthropic built the same credential architecture we did, and we are not going to pretend otherwise: Claude Tag's sandbox holds no keys, its Agent Proxy injects them at the network boundary, and egress is default-deny. The difference is whose permissions the agent carries. In Claude Tag access belongs to the Slack channel, and Anthropic states that a channel member can therefore reach things they personally cannot. In OneCLI it belongs to the employee. If your work lives in Slack channels and you are an Anthropic shop, Claude Tag is excellent. If an agent's reach has to match a person's, or the whole system has to run on your own infrastructure, that is us.

Start with the part least convenient for us. Anthropic's agent identity post says the credential is "stored independently and mapped to that channel's identity, then injected at the network boundary at request time," and unlisted hosts are "blocked outright." That is the architecture this entire site argues for. Against Claude Tag it is not a differentiator, it is agreement: when the frontier lab shipped a team agent, they put the credentials outside the box too.

OneCLI compared with Claude Tag

The real difference: whose permissions?

Claude Tag's unit of access is the channel. An admin provisions service accounts, attaches them to a channel, and everyone in that channel shares them. Anthropic is direct about the consequence, in their words: "a channel member without direct access to the repo can ask Claude to read that repo, if the channel's profile grants Claude that permission."

OneCLI's unit of access is the employee. Each person's agent is scoped to what that person already has, so support cannot reach payroll by asking nicely. Nothing widens when someone joins a channel.

Neither answer is careless. Theirs solves a real problem: with four people steering one agent, whose permissions should apply? "The channel's" is defensible and it makes multiplayer work. It also means a public channel with a bundle attached grants that access to anyone who joins. Anthropic lists the fix as future work, an "identity-aware overlay." Until it ships, the compartment is the boundary.

Approvals: shipping versus planned

Claude Tag has spend limits, per-channel scoping, host allowlists, and a full audit trail. What it does not have yet is a hold on an individual action. Anthropic names it under what's next: "just-in-time credential grants, so that a user can approve a single sensitive action in the moment." That describes what OneCLI approvals do today. The agent works up to the sensitive step, the gateway holds that request, and a named person releases it. The refund waits; the check that led to it does not. Both products can say no to a whole capability. Only one can say "not this one, not yet."

How they differ

Where they agree

Credentials in the sandbox

onecli

None. Placeholders inside, real keys injected at the wire, model key included

Claude Tag

None. Credentials live in a separate store and are injected by Agent Proxy at the network boundary
Same architecture, independently arrived at.
Egress

onecli

Default-deny at the container network: the gateway and its runner are the only reachable destinations

Claude Tag

Default-deny: unlisted hosts are blocked outright rather than merely unauthenticated
Both make bypassing the checkpoint impossible rather than discouraged.

Whose access the agent carries

Unit of access

onecli

The employee. Each agent is scoped to what its person can already reach

Claude Tag

The Slack channel. Service accounts are attached per channel and shared by everyone in it
The largest difference, and the one that decides most evaluations.
Can the agent exceed its human?

onecli

No. An agent is a scoped extension of one person and cannot outrank them

Claude Tag

Yes, by design: "a channel member without direct access to the repo can ask Claude to read that repo"
Anthropic calls this necessary for multiplayer. It is also an escalation path in a public channel.
Per-request approval

onecli

Ships today. The gateway holds one request for a named human while the rest of the work proceeds

Claude Tag

On the roadmap: "just-in-time credential grants" are listed under what is next
Until then the choice is granting a capability or withholding it, nothing between.
Memory boundaries

onecli

Per-employee memory in a sealed personal layer; the shared layer is what the company publishes deliberately

Claude Tag

Public-channel memory is workspace-wide, and Claude can keyword-search public channels it was never added to
Their docs put it plainly: "isolating a credential doesn't isolate what Claude knows."

Where it runs and what it costs

Surfaces

onecli

Web, Slack, and the terminal, with one identity and one audit trail across all three

Claude Tag

Slack today, with Microsoft Teams on a waitlist
They are deeper in Slack. We are the only one an engineer can reach from a shell.
Models

onecli

Model-agnostic across 25+ providers, or bring your own keys, with the key still never entering the sandbox

Claude Tag

Claude only, on Anthropic's first-party service
Reasonable from a model company, and still a single-vendor dependency.
Deployment

onecli

Cloud, or run the whole system on your own infrastructure. Apache-2.0 outside the ee/ directories, so the code is yours to read, audit, and fork

Claude Tag

Anthropic-hosted only. Not available for third-party deployments, and unavailable to organizations with Zero Data Retention enabled
For a regulated org this decides it before any feature does. The ZDR exclusion is worth checking early: retention is required for channel memory, so the strictest orgs are out.
Pricing shape

onecli

Per user and per agent, with models included or BYO keys

Claude Tag

No per-seat charge. Channel work draws from a usage balance with an admin-set spend cap; DMs bill to the sender's own seat
Usage billing is friendly for a pilot and harder to forecast for a fleet. Different risk, not a better deal.

Running both

These are less mutually exclusive than the table suggests. Anthropic runs their own product team on Claude Tag and reports 65% of that team's code coming out of it. Split by whether the work belongs to a room or to a person. Collaborative triage in a channel, where everyone should see it and any of them could pick it up, is Claude Tag's shape. Work scoped to one employee's accounts, or touching a step somebody has to approve, is ours. A OneCLI agent can also call the Anthropic API through the gateway like any other service, so using Claude as the model does not require adopting the access model.

When to use which

Use Claude Tag when

  • ·Your team's work genuinely happens in Slack channels and should stay visible to the room
  • ·You are already a Claude Enterprise or Team customer and want the deepest Claude integration available
  • ·Multiplayer is the point: several people steering one agent on one thread
  • ·Channel-scoped service accounts match how you already think about access
  • ·You want Anthropic to host and operate the whole thing

Use OneCLI when

  • ·An agent must never reach something its human could not reach directly
  • ·You need to hold one sensitive action for approval without switching off the capability behind it
  • ·People need their agent from a terminal or the web, not only from Slack
  • ·You want to choose the model, or change it later, without changing platforms
  • ·Zero Data Retention, self-hosting, or reading the source is a requirement rather than a preference

Common questions

Anthropic built the same credential model. Doesn't that undercut your pitch?

It confirms the pitch and removes it as a differentiator against this one product, which are different things. The frontier lab shipping exactly what we argued for is the strongest validation the model could get. It just means the argument here has to be about identity rather than keys.

Is the channel access model actually a problem?

It is a deliberate trade, and Anthropic documents it rather than hiding it. In a private channel scoped to its least-privileged member it works well. The risk is a public channel with a bundle attached, where the access belongs to anyone who joins. If your compliance story is written in terms of people, a compartment-based model is hard to map onto it.

Can I use Claude models with OneCLI?

Yes, and it is a common setup. The Anthropic key lives in OneCLI and gets injected at the gateway per request, so the sandbox runs on a placeholder. Model spend is metered per employee as a side effect, and you can switch models later without changing how access works.

Does OneCLI work in Slack too?

Yes. Each employee's agent is reachable in Slack with the same identity, permissions, and audit trail it has on the web and in the terminal. The difference is that Slack is a way to reach a person's agent, not where its permissions come from.

What does Claude Tag do better?

Multiplayer, and depth in Slack. One agent per channel that everyone can watch and redirect mid-task is a good design for collaborative work, and we have no equivalent. Their ambient behaviour, surfacing a stalled thread without being asked, is also ahead of us.

Can we run this entirely on our own infrastructure?

Yes, and this is the clearest split between the two. OneCLI is open source and self-hostable, so the agents, the gateway, and the audit log can all sit inside your own network with no data leaving it. Claude Tag is Anthropic-hosted only and is not available for third-party deployments. If on-prem is a requirement, the comparison ends here.

The longer version of the enforcement argument is in why an MCP gateway cannot see most of what your agent does, and the shape of the product is on the product page.

Also compared

OneCLI vs HermesHermes is a single-tenant personal agent that holds your credentials. OneCLI is one agent per employee, and the sandbox holds none.OneCLI vs OpenClawOpenClaw gives one person an agent with the run of their machine. OneCLI gives a company one per employee, with nothing it can steal.

Try it

Be greedy about AI. Never about access.

$ curl -fsSL hogpass.com/install | sh