Finally a solution which focuses on contextual authorization - evaluating the agent's reasoning trace when it requests a credential, only issuing it if the intent matches what the user authorized.. developer-focused and self-serve.Happy Launch day!!
Show HN: Kontext CLI – Credential broker for AI coding agents in Go
11–20 of 33 posts
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#12Yup I needed this bad for my NanoClaw
Nice work
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#13Sounds awfully similar to Tailscale Aperture[1] [1] https://tailscale.com/blog/aperture-self-serve
[flagged]
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#14Really cool and much needed! I was actually just about to get started writing this but in Rust....
[flagged]
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#15What if kontext runs under the same user as Claude? Could it in principle inspect the kontext process and extract the key from memory?
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#16[flagged]
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#17It should be possible to do this w/ eBPF. Monitor network i/o & rewrite the request on the fly to include the proper tokens & signatures. The agent can just be given placeholder tokens. That way all the usual libraries work as expected & the secrets/signatures are handled w/o worrying about another abstraction layer. Here is some prior art: https://riptides.io/blog/when-ebpf-isnt-enough-why-we-went-w...
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#18This is how keychains should be designed. Never return the secret, but mint a new token, or sign a request.
We need this also for normal usage like development environments. Or when invoking a command on a remote server.
Are you going to add support for services that don't support OIDC or this going to be a known limitation?
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#19> for static API keys, the backend injects the credential directly into the agent's runtime environment.
What prevents the agent from presisering or leaking the API key - or reading it from the environment?
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#20Very cool project. Providing credentials agents and standardizing that whole process seems like valuable work. Question though on the OSS/paid boundary... is the OSS cli the client for the paid service? What is the custody model? Does this service store all my credentials?