Rendered at 18:06:38 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
sandeepkd 11 minutes ago [-]
It works great for static credentials. As a product I think about adding couple more things that might be helpful here (Btw I am not the client for this, I just happen to know them as practical problems)
1. Support for OAuth Client credentials - Gateway does the OAuth dance to get the access token, this is quite practical and even useful in case of regular services running across clusters and sharing the same clientId-secretId
2. Support for request retries on certain failures and short circuiting in other cases
winterrx 1 hours ago [-]
nice launch. i have started to use a secrets manager (infisical) recently for my different projects and it's been really helpful. are your customers solo hackers, small startups or large enterprises that are looking for this kind of solution? i like to see competition in the space
bstsb 1 hours ago [-]
+1 on infisical. brilliant self-hosted offering, i love their CLI and it works well with CI pipelines
theozero 47 minutes ago [-]
Looks great. The "credential broker" pattern (inject placeholders, replace in proxy) is something we just added to https://varlock.dev (totally free and open source).
Rather than using a dashboard, ours is configured within a .env.schema file, and rather than our own vault, we can pull secrets using our plugins (16 and counting) including Infisical, 1Password, Bitwarden, AWS, GCP, Azure, more. Also very useful for coding tasks in general, as we have integrations for most frameworks, and add built in validation, type safety, leak detection, etc.
Will definitely be keeping an eye on OneCLI to compare notes.
oauth, saml, oidc accomplish the same thing in a way more mature way, so if you’re already using SSO just do that instead of adding another point of failure..
mjg59 36 minutes ago [-]
No they don't - you're still giving the agent a static token that can be exfiltrated and used elsewhere.
doctorpangloss 54 minutes ago [-]
does the agent control the environment that onecli is running in? (yes)
Jonathanfishner 8 minutes ago [-]
[dead]
adithyassekhar 44 minutes ago [-]
Holy mother of whatever this is, everyone got the same idea again and there’s a bunch of implementations people are desperate to promote in the comments.
You’re just trading one key for another, whatever abstraction you chose to trust, at some point credentials will pass to your llm of the week.
mjg59 35 minutes ago [-]
> at some point credentials will pass to your llm of the week.
How?
theapiartist 33 minutes ago [-]
I happen to know a solution where credentials wouldn't get to the agent. It's structurally impossible
1. Support for OAuth Client credentials - Gateway does the OAuth dance to get the access token, this is quite practical and even useful in case of regular services running across clusters and sharing the same clientId-secretId
2. Support for request retries on certain failures and short circuiting in other cases
Rather than using a dashboard, ours is configured within a .env.schema file, and rather than our own vault, we can pull secrets using our plugins (16 and counting) including Infisical, 1Password, Bitwarden, AWS, GCP, Azure, more. Also very useful for coding tasks in general, as we have integrations for most frameworks, and add built in validation, type safety, leak detection, etc.
Will definitely be keeping an eye on OneCLI to compare notes.
The idea being that if the fake token leaks from my sandbox - it would be completely useless for an attacker
We added Hashicorp Vault support here: https://github.com/Infisical/agent-vault/pull/256
You’re just trading one key for another, whatever abstraction you chose to trust, at some point credentials will pass to your llm of the week.
How?