BOTTLENECK
0 articles opened

Part IV · Secrets & Agents · SHIPPED · p. 49

Fleet story: finding repositories without handling tokens

Tuesday morning, three forges, one agent, zero PATs in the prompt.

Your agent needs “the payments service repo.” It might live on github-main, on a self-hosted GitLab, or on the GCP GitLab the platform team prefers. The wrong habit is reading a .env for a personal access token and stuffing it into a context window. That habit is how tokens become logs.

Register the fleet once. Search like a human who forgot which forge.
securegit server add github-main --platform github --api-url https://api.github.com
securegit server add gitlab-main --platform gitlab --api-url https://gitlab.example.com/api/v4
securegit server search payments
securegit server search payments --server gitlab-main
securegit secret discover --target dev --keys-only

Credentials are stored keyed to the server name and resolved through the normal chain. The token is never typed into a search command. Host-scoped credentials matter: a GitLab remote must not receive a GitHub token. Agents should call server search or the MCP tool securegit_search_repos instead of reading .env files.