Show HN: Kontext CLI – Credential broker for AI coding agents in Go

Kontext CLI is an open-source command-line tool that wraps AI coding agents with enterprise-grade identity, credential management, and governance — without changing how developers work.

Why we built it: AI coding agents need access to GitHub, Stripe, databases, and dozens of other services. Today, teams copy-paste long-lived API keys into .env files and hope for the best. Kontext replaces that with short-lived, scoped credentials that are injected at session start and gone when the session ends. Every tool call is logged. Every secret is accounted for.

How it works: You declare what credentials your project needs in a single .env.kontext file. When you run kontext start, the CLI authenticates you, exchanges placeholders for short-lived tokens via RFC 8693 token exchange, launches your agent with those credentials injected, and streams every tool call to the Kontext dashboard for audit and governance. When the session ends, credentials expire automatically.

brew install kontext-security/tap/kontext

If you prefer a direct binary install, download the latest GitHub Release instead:

tmpdir="$(mktemp -d)" \
&& gh release download --repo kontext-security/kontext-cli --pattern 'kontext_*_darwin_arm64.tar.gz' --dir "$tmpdir" \
&& archive="$(find "$tmpdir" -maxdepth 1 -name 'kontext_*_darwin_arm64.tar.gz' -print -quit)" \
&& tar -xzf "$archive" -C "$tmpdir" \
&& sudo install -m 0755 "$tmpdir/kontext" /usr/local/bin/kontext

Then, from any project directory with Claude Code installed:

kontext start --agent claude

That's it. On first run, the CLI handles everything interactively — login, provider connections, credential resolution. Run kontext logout any time to clear the stored OIDC session from your system keyring.

Key Features:

• One command to launch Claude Code: kontext start --agent claude — no config files, no Docker, no setup scripts.
• Ephemeral credentials: short-lived tokens scoped to the session, automatically expired on exit.
• Declarative credential templates: commit .env.kontext to your repo for team-wide setup without sharing secrets.
• Governance telemetry: Claude hook events are streamed to the backend with user, session, and org attribution.
• Secure by default: OIDC authentication, system keyring storage, RFC 8693 token exchange, AES-256-GCM encryption at rest.
• Lean runtime: native Go binary, no local daemon install, no Node/Python runtime required.