[flagged]
Show HN: Kontext CLI – Credential broker for AI coding agents in Go
21–30 of 33 posts
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#22Very cool project. Providing credentials agents and standardizing that whole process seems like valuable work. Question though on the OSS/paid boundary... is the OSS cli the client for the paid service? What is the custody model? Does this service store all my credentials?
From another comment:
> Kontext holds secrets server-side and mints short-lived tokens per session.
That probably makes this thing DOA for most people (certainly for me and everyone I know).
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#23Very cool project. Providing credentials agents and standardizing that whole process seems like valuable work. Question though on the OSS/paid boundary... is the OSS cli the client for the paid service? What is the custody model? Does this service store all my credentials?
[flagged]
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#24What if kontext runs under the same user as Claude? Could it in principle inspect the kontext process and extract the key from memory?
If they use the system keyring, it depends on the OS and other details - MacOS, Linux, and Windows all have different implementation tradeoffs.
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#25> for static API keys, the backend injects the credential directly into the agent's runtime environment. What prevents the agent from presisering or leaking the API key - or reading it from the environment?
[flagged]
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#26This is how keychains should be designed. Never return the secret, but mint a new token, or sign a request. We need this also for normal usage like development environments. Or when invoking a command on a remote server. Are you going to add support for services that don't support OIDC or this going to be a known limitation?
[flagged]
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#27Yup I needed this bad for my NanoClaw Nice work
[flagged]
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#28It should be possible to do this w/ eBPF. Monitor network i/o & rewrite the request on the fly to include the proper tokens & signatures. The agent can just be given placeholder tokens. That way all the usual libraries work as expected & the secrets/signatures are handled w/o worrying about another abstraction layer. Here is some prior art: https://riptides.io/blog/when-ebpf-isnt-enough-why-we-went-w...
[flagged]
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#29Very cool project. Providing credentials agents and standardizing that whole process seems like valuable work. Question though on the OSS/paid boundary... is the OSS cli the client for the paid service? What is the custody model? Does this service store all my credentials?
From another comment: > Kontext holds secrets server-side and mints short-lived tokens per session. That probably makes this thing DOA for most people (certainly for me and everyone I know).
Thanks. Yes, I would have to put myself in that category. Typical play here is to offer the self-hosted option. Not sure if that is in the pipeline for the creators of this. Then you are into that trust/operational overhead tradeoff conversation.
Re: Show HN: Kontext CLI – Credential broker for AI coding agents in Go
#30Earlier quoted context omitted.
From another comment: > Kontext holds secrets server-side and mints short-lived tokens per session. That probably makes this thing DOA for most people (certainly for me and everyone I know).
Thanks. Yes, I would have to put myself in that category. Typical play here is to offer the self-hosted option. Not sure if that is in the pipeline for the creators of this. Then you are into that trust/operational overhead tradeoff conversation.
[flagged]