telexed ~ c / cf6c2931-0a9radar:50 · agent_toolLIVE
← back
NO.
#cf6c2931
Topic
AGENTS & TOOLS
Source
Hacker News · MCP Server
Published
2026-04-14 13:26:53
Importance
★ 5/10 — radar 50
`Kontext CLI`: Short-lived credential broker for coding agents
FIG-0061:1

`Kontext CLI`: Short-lived credential broker for coding agents

Instead of pasting long-lived secrets into .env, it swaps placeholders for session-scoped creds and streams every tool call for audit. Strong pattern for agent-era auth, but immediate value depends on whether your stack fits its supported integrations.

[ KEY POINTS ]
  1. Projects declare needs in .env.kontext, then kontext start --agent claude resolves GitHub, Stripe, Linear creds at runtime with no disk write.
  2. OAuth services use RFC 8693 token exchange; static keys are injected only into process memory. That removes raw secret sprawl but centralizes trust in the backend.
  3. Each tool call is attributed to user, session, and org, with allow/deny plumbing already wired. Useful if agent actions need audit trails before broader team use.
  4. Built in Go with roughly 5ms hook overhead per tool call, ConnectRPC backend links, and system keyring auth storage. Performance cost looks low enough for daily CLI use.
Originalgithub.com/kontext-dev/kontext-cliRead original →

// related