From 4d89ffce8b860a0771aec2874e0be606064b6288 Mon Sep 17 00:00:00 2001 From: didericis Date: Tue, 14 Jul 2026 01:48:48 -0400 Subject: [PATCH] docs(research): add local/internal-reach edge to the OneCLI comparison MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Self-hosting means the agent runs inside your own network boundary (homelab, corporate LAN, Tailnet), so scoping it to internal resources is just an egress-route line — a reach advantage distinct from the isolation ones, which a cloud-first credential broker / agent product can't match. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01LhiafsABCr46bu3oHUm7wa --- docs/research/landscape-containerized-claude.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/docs/research/landscape-containerized-claude.md b/docs/research/landscape-containerized-claude.md index 6a317ab..f8d773a 100644 --- a/docs/research/landscape-containerized-claude.md +++ b/docs/research/landscape-containerized-claude.md @@ -103,7 +103,19 @@ manifest merge. has no equivalent. (3) *Trust posture:* OneCLI's managed tier reintroduces a third-party credential custodian, whereas bot-bottle's OSS-runtime + paid-control-plane split keeps custody inside the operator's own boundary — - the stronger story for the security-minded self-hoster. **Tactical read:** + the stronger story for the security-minded self-hoster. (4) *Runs inside your + network boundary — local/internal reach.* Because bot-bottle executes the + agent on your own host (homelab, corporate LAN, a Tailnet) and egress is a + manifest field, giving an agent *scoped* access to **internal** resources — a + private Gitea, a LAN database, a Tailscale node — is just another egress-route + line, not a networking project (the same move an operator already makes to + reach their Tailscale services). OneCLI's OSS core can self-host too, but it's + a credential *broker* for outbound API calls, not an agent runtime, and its + managed tier + 50+ integrations are oriented at public SaaS — it doesn't put + the agent behind your firewall for you. This is a reach advantage, distinct + from the isolation ones above, and it's a wedge cloud-first agent products + (Devin, Copilot Workspace, OneCLI Cloud) structurally can't match. **Tactical + read:** adopt OneCLI's OSS core for the credential slice if building is undesirable (it's mature now); don't build atop its managed tier (competitor, not dependency); re-position bot-bottle on isolation + fleet + self-hosted custody