TESIGN
SAVED

EN · KO

  1. TESIGN / RADAR
  2. oauthcli

oauthcli

OAuth server audit for developers

WHO USES ITBackend developer · Security engineer · Agent builder

Install to use

Checks what an OAuth or OIDC server supports and audits it against RFCs.

★ 1▲ 5 HN

1 stars · checked on GitHub GitHub check 30 h late · no 7-day star increase observed (GH Archive) (as of ) · 5 Show HN points observed

NEW 1h OLD WHEN SEEN

GitHub social card for Southclaws/oauthcli: name and 'A command line toolkit for…' description left, avatar right.

TESIGN TAKE

It turns 'does our server follow the standard?' into a verdict per RFC section.

INSTALL

AT A GLANCE

USAGE
Unconfirmed — check before use.
LANGUAGE
Go
PLATFORM
windows · macos · linux · cli
ACTIVITY
last commit 3 days ago () · latest release v1.0.0 () · 1 release
COMMUNITY
1 contributor · 0 open issues (incl. PRs) · made by: an individual
SOURCES
Show HN
FIRST SEEN
CATEGORY
SECURITY · DEV TOOLS

A summary, not legal advice.

WHY IT MATTERS

Wiring up OAuth means finding where docs and real behaviour differ. oauthcli reads what a server publishes, gives a verdict per RFC, gets and decodes tokens with every grant, and runs browser and device flows and dynamic client registration as single commands. Every command has --format json and exit codes carry the verdict, so agents use the same tool as people. Installed with Go; the spec texts ship in the binary, and no license is stated in the README.

BUILD FROM THIS

  • A CI step that audits the authorization server before release
  • An RFC support report for evaluating a new identity provider
  • An agent skill that obtains tokens and exercises an API

WHO IT'S FOR

Backend developer
hunting the mismatch in an OAuth integration
Security engineer
auditing the company IdP against the RFCs
Agent builder
letting an agent obtain tokens

START IN 5 MINUTES

$ go install github.com/Southclaws/oauthcli@latest
$ oauthcli discover https://accounts.google.com     # what does this issuer publish and support?
$ oauthcli check https://accounts.google.com        # is it conformant? one verdict per RFC
# Needs the Go toolchain · the binary is called oauthcli

CAVEATS

  • No license stated in the README
  • Installed through the Go toolchain; no binary downloads in the README
  • Checks that create state, such as --register, are opt-in

RECEIPT

FIRST SEEN
AT SOURCE
KEPT
CREATED → FIRST SEEN
1h
WHEN FIRST SEEN
1 ★
SOURCES
Show HN

The same facts in machine-readable form — View as Markdown · JSON

SIMILAR TOOLS

Up to five from SECURITY by ★ total: edited entries first, then repository cards; this entry is highlighted. Drawn from the same stored snapshot as the rankings — a comparison, not a recommendation.

IMAGENAME★ TOTAL▲ 7dLICENSEPLATFORMLAST PUSH
The repository's own benchmark leaderboard: F1, precision, recall, time and tokens per model and review tool, in a dark table.
open-code-reviewAI code review for developers★ 28.6k▲ +1,064Apache-2.0permissivewindows · macos · linux · cli
GitHub social card for Southclaws/oauthcli: name and 'A command line toolkit for…' description left, avatar right.
oauthcliOAuth server audit for developersTHIS ENTRY★ 1—Licence unconfirmedunconfirmedwindows · macos · linux · cli
ente/enteCARD★ 28.9k▲ +13AGPL-3.0copyleft—
deskflow/deskflowCARD★ 28.8k▲ +5GPL-2.0copyleft—
laramies/theharvesterCARD★ 17.4k▲ +10Licence unconfirmedunconfirmed—

ALSO WORTH SEEING

PodroidLinux container VM for your phonePodroid's homepage: a dark screen reading "Linux containers on Android. No root required," with a Download APK button.Install to use
★ 2.6k▲ +14 / 7d
Boots a real, separately-kernelled Alpine Linux VM on an unrooted Android phone, running Podman, Docker and LXC exactly as they behave on a server.OpenHunterAILocal AI red-team workspaceOpenHunterAI's homepage, labelled "AUTHORIZED EXTERNAL SECURITY TESTING," listing its five-stage process from scope verification to reporting.Self-host
★ 165▲ +15 / 7d
An alpha-stage local workspace that runs attacker-style security assessments — strictly against public targets you own or are authorized to test.MartinLoopExecution-control CLI for coding agentsMartinLoop's homepage headline: "Watch your AI burn $5.20. Then watch MartinLoop close the loop for $2.30."
★ 130▲ +21 / 7d
Wraps a coding agent with a spend cap and a verifier, so "I'm done" comes with an evidence-backed receipt instead of just a claim.Spec KitSpec-first process for coding agentsSpec Kit docs landing page — the headline 'Build with a spec, fix a bug, or assess an idea' and the uv tool install specify-cli commandInstall to use
★ 137k▲ +560 / 7d
Makes your coding agent write the spec first, then plan, build and verify against it.

TIMELINE

  1. Repository created
  2. Show HN post ↗
  3. FIRST SEEN BY TESIGN