Auth Your Agent

com.authyouragentv0.3.24更新于 Oct 4, 2026

Act for a person on websites: sandboxed browser, phone approvals, take over at sign-in walls.

已验证STDIO仅桌面Security & MonitoringBrowser Automation

概览

AI 生成的概览

让助手通过沙箱浏览器代人在网站上操作，由本人在手机上批准操作并在登录墙处接管。

功能
该服务器提供约 20 个工具，用于驱动运行在用户本机的沙箱 Chromium 浏览器（vault）：navigate、click、type_text、read_page、check_login_wall、request_takeover、wait_for_takeover、request_approval、notify_owner、list_secrets、fill_secret、end_session、check_agent_status 和 report_site。当网站要求密码、验证码或两步验证码时，本人在手机上接管该浏览器并交还；助手始终看不到密码，也不持有 Cookie。会话结束时，vault 会退出所有使用过的网站并销毁浏览器配置文件。
适用场景
当助手需要代人在公开网站上执行任务，而本人希望掌控登录并批准敏感操作时使用。适合凭据不能进入模型、且会话结束后需要退出并清除的工作流。
运行要求
本地进程，通过 uvx 从 PyPI 包 authyouragent 运行，Node 客户端可用 npx authyouragent-mcp。需要 AYA_AGENT_ID 和 AYA_KEY_FILE（用 authyouragent keygen 生成的 PEM 私钥），可选 AYA_VAULT_URL 和 AYA_VAULT_TOKEN_FILE。vault 需要 Docker；手机应用和审批服务运行在 authyouragent.com。仅限桌面端。
安装前请注意
需要私钥文件（AYA_KEY_FILE）和代理 ID；vault 令牌文件（AYA_VAULT_TOKEN_FILE）也是凭据。助手可以点击、输入和提交表单，提交类或写着创建、发送、保存、删除、支付等字样的点击会先请求本人手机批准。密钥从本人的 Bitwarden 或 Vaultwarden 填入，助手看不到值。浏览器只能访问公共互联网，会话结束时会退出并清除配置文件。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Auth Your Agent，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

Auth Your Agent

An open-source MCP server that lets an AI agent act for a person on websites, with the person's approval on their phone.

The agent drives a sandboxed browser (the vault) that runs on the person's own machine. When a site asks for a password, a CAPTCHA or a 2FA code, the person takes over that browser from their phone, signs in, and hands it back. The agent never sees the password and never holds the cookies. When the task is done, the vault signs out of every site it used, then destroys the browser profile.

Website: authyouragent.com · License: MIT

What is in this repository

The MCP server, the browser vault and the SDKs:

PathWhat it is
sdk/authyouragent/mcp_server.pyThe MCP server (stdio, 20 tools). Entry point authyouragent-mcp.
vault/The browser vault: broker.py (HTTP API the MCP server calls; drives Chromium, detects sign-in, signs out), egress.py (public-internet-only proxy), screen.py (phone screen stream), seccomp.json, chromium-policy.json, Dockerfile. Details: vault/README.md.
sdk/authyouragent/vault_cli.pyauthyouragent vault up/down/status/env: runs the vault with every protection on.
sdk/authyouragent/Python SDK: agent side (agent.py), website side (site.py), take-over helper for your own Playwright browser (takeover.py).
sdk-js/JavaScript SDK, and npm-wrapper/ so Node clients can start the MCP server with npx authyouragent-mcp.
DockerfileContainer for the MCP server alone.

The phone app and the approval service run at authyouragent.com. The agent signs its requests with its own key pair; the service never receives the person's passwords.

MCP tools

ToolWhat it does
navigate, click, type_text, read_pageDrive the vault's browser. Only public websites open. Clicks that submit a form, or whose button says create, send, save, delete, pay and the like, ask the owner's phone first.
list_secrets, fill_secretFill a username, password or authenticator code from the owner's Bitwarden or Vaultwarden into the page. The agent never sees the value; it fills only on the item's own site and only the right kind of field.
check_login_wallIs the page blocked by a password, CAPTCHA, one-time code or sign-in approval? Reads the page's fields and text, so the model needs no vision.
request_takeoverAsk the owner to take over the browser from their phone. Returns done, cancelled, expired, incomplete, or waiting.
wait_for_takeoverKeep waiting after waiting.
request_approvalAsk the owner to approve an action. approved, denied or expired.
notify_ownerA one-way note to the owner's phone: done, stuck, or what failed. Nothing to approve.
end_sessionSign out of every site used, then destroy the browser profile. Reports per site whether sign-out was confirmed. The vault then sends the owner its own summary of the session.
check_agent_statusactive or revoked.
report_siteReport a site where take over did not work.

Run it

From PyPI:

bash
pip install "authyouragent[mcp]"authyouragent vault up --agent-id ag_... --key /path/to/agent-key.pem

From this repository:

bash
git clone https://github.com/kjames2001/authyouragent && cd authyouragentpip install "./sdk[mcp]"docker build -f vault/Dockerfile -t authyouragent/vault:local .authyouragent vault up --agent-id ag_... --key /path/to/agent-key.pem --image authyouragent/vault:local --no-pull

The vault needs Docker. vault up prints the MCP settings to add to your client. (If you skip vault up, the MCP server starts the vault itself the first time the agent needs the browser; AYA_VAULT_AUTOSTART=0 turns that off.)

json
{  "mcpServers": {    "authyouragent": {      "command": "authyouragent-mcp",      "env": {        "AYA_AGENT_ID": "ag_...",        "AYA_KEY_FILE": "/path/to/agent-key.pem",        "AYA_VAULT_URL": "http://127.0.0.1:7801",        "AYA_VAULT_TOKEN_FILE": "~/.authyouragent/vault/token"      }    }  }}

Node clients can use npx authyouragent-mcp as the command. The agent ID and key come from adding the agent in the phone app (Agents > Add an agent). Without them the server still starts and lists its tools; each tool then says what is missing.

Security

  • Chromium's own sandbox is on (custom seccomp profile, all container capabilities dropped); gVisor is used automatically when Docker has the runsc runtime.
  • The browser can reach only the public internet: loopback, private networks, cloud metadata addresses and the vault's own ports are refused, checked on the resolved address.
  • The agent is disconnected while the owner is in control, and cannot read the browser's cookies.
  • Sign out first, wipe second: at the end of a session, when the agent stops sending heartbeats, or when it is revoked. Sites the vault could not sign out of are reported to the owner, also after a crash.

Known limits are listed in vault/README.md.

Scope: what Auth Your Agent does, and does not do

Auth Your Agent answers one question for a website: who is acting, for whom, with what permission, and can it be withdrawn. A feature belongs here if it grants, limits, proves or withdraws an agent's authority on a site. That covers approvals, sign-in for agents, step-ups in the site's own words, take over at a sign-in wall, signing out, and the vault's own record of what was done with the owner's authority.

It does not do:

  • Conversation with the agent. No multiple-choice or free-text questions, chat or task updates beyond a short note. A card from Auth Your Agent is always about permission, so the owner never learns to tap through it like a chat prompt. Use a tool built for talking to agents (for example Paseo) alongside it.
  • Running or orchestrating agents. It works with whichever agent you use; it does not start, schedule or supervise them.
  • Judging intent with AI. Approval rules are fixed rules the owner can read. No model decides what is safe.
  • Getting past sites' defences. No CAPTCHA solving or bot-detection evasion; the owner takes over instead.
  • Turning websites into tools. Learning a site's API calls as MCP tools is a separate project built on top of the vault.

New features are checked against this list first.

Documentation

Android app

Download from authyouragent.com/download/android.

License

MIT

来源：README.md，提交 5a5b237

工具

0
工具元数据尚未被收录。

版本历史

1
  1. v0.3.24最新Oct 4, 2026