Auth Your Agent

com.authyouragentv0.3.24更新於 Oct 4, 2026

Act for a person on websites: sandboxed browser, phone approvals, take over at sign-in walls.

已驗證STDIO僅桌面Security & MonitoringBrowser Automation

概覽

AI 產生的概覽

讓助理透過沙箱瀏覽器代替使用者在網站上操作，由本人在手機上核准動作並在登入牆接管。

功能
此伺服器提供約 20 個工具，用來驅動執行在使用者本機的沙箱 Chromium 瀏覽器（vault）：navigate、click、type_text、read_page、check_login_wall、request_takeover、wait_for_takeover、request_approval、notify_owner、list_secrets、fill_secret、end_session、check_agent_status 與 report_site。當網站要求密碼、驗證碼或兩步驟驗證碼時，本人在手機上接管該瀏覽器再交還；助理始終看不到密碼，也不持有 Cookie。工作階段結束時，vault 會登出所有使用過的網站並銷毀瀏覽器設定檔。
適用情境
當助理需要代替使用者在公開網站上執行任務，而本人希望掌握登入並核准敏感操作時使用。適合憑證不能進入模型、且工作階段結束後需要登出並清除的情境。
執行需求
本機程序，以 uvx 從 PyPI 套件 authyouragent 執行，Node 用戶端可用 npx authyouragent-mcp。需要 AYA_AGENT_ID 與 AYA_KEY_FILE（以 authyouragent keygen 產生的 PEM 私鑰），可選 AYA_VAULT_URL 與 AYA_VAULT_TOKEN_FILE。vault 需要 Docker；手機應用程式與核准服務執行於 authyouragent.com。僅限桌面端。
安裝前請注意
需要私鑰檔案（AYA_KEY_FILE）與代理 ID；vault 權杖檔案（AYA_VAULT_TOKEN_FILE）也是憑證。助理可以點擊、輸入與送出表單，送出類或寫著建立、傳送、儲存、刪除、付款等字樣的點擊會先請求本人手機核准。密鑰從本人的 Bitwarden 或 Vaultwarden 填入，助理看不到值。瀏覽器只能連上公開網際網路，工作階段結束時會登出並清除設定檔。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Auth Your Agent，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

Auth Your Agent

An open-source MCP server that lets an AI agent act for a person on websites, with the person's approval on their phone.

The agent drives a sandboxed browser (the vault) that runs on the person's own machine. When a site asks for a password, a CAPTCHA or a 2FA code, the person takes over that browser from their phone, signs in, and hands it back. The agent never sees the password and never holds the cookies. When the task is done, the vault signs out of every site it used, then destroys the browser profile.

Website: authyouragent.com · License: MIT

What is in this repository

The MCP server, the browser vault and the SDKs:

PathWhat it is
sdk/authyouragent/mcp_server.pyThe MCP server (stdio, 20 tools). Entry point authyouragent-mcp.
vault/The browser vault: broker.py (HTTP API the MCP server calls; drives Chromium, detects sign-in, signs out), egress.py (public-internet-only proxy), screen.py (phone screen stream), seccomp.json, chromium-policy.json, Dockerfile. Details: vault/README.md.
sdk/authyouragent/vault_cli.pyauthyouragent vault up/down/status/env: runs the vault with every protection on.
sdk/authyouragent/Python SDK: agent side (agent.py), website side (site.py), take-over helper for your own Playwright browser (takeover.py).
sdk-js/JavaScript SDK, and npm-wrapper/ so Node clients can start the MCP server with npx authyouragent-mcp.
DockerfileContainer for the MCP server alone.

The phone app and the approval service run at authyouragent.com. The agent signs its requests with its own key pair; the service never receives the person's passwords.

MCP tools

ToolWhat it does
navigate, click, type_text, read_pageDrive the vault's browser. Only public websites open. Clicks that submit a form, or whose button says create, send, save, delete, pay and the like, ask the owner's phone first.
list_secrets, fill_secretFill a username, password or authenticator code from the owner's Bitwarden or Vaultwarden into the page. The agent never sees the value; it fills only on the item's own site and only the right kind of field.
check_login_wallIs the page blocked by a password, CAPTCHA, one-time code or sign-in approval? Reads the page's fields and text, so the model needs no vision.
request_takeoverAsk the owner to take over the browser from their phone. Returns done, cancelled, expired, incomplete, or waiting.
wait_for_takeoverKeep waiting after waiting.
request_approvalAsk the owner to approve an action. approved, denied or expired.
notify_ownerA one-way note to the owner's phone: done, stuck, or what failed. Nothing to approve.
end_sessionSign out of every site used, then destroy the browser profile. Reports per site whether sign-out was confirmed. The vault then sends the owner its own summary of the session.
check_agent_statusactive or revoked.
report_siteReport a site where take over did not work.

Run it

From PyPI:

bash
pip install "authyouragent[mcp]"authyouragent vault up --agent-id ag_... --key /path/to/agent-key.pem

From this repository:

bash
git clone https://github.com/kjames2001/authyouragent && cd authyouragentpip install "./sdk[mcp]"docker build -f vault/Dockerfile -t authyouragent/vault:local .authyouragent vault up --agent-id ag_... --key /path/to/agent-key.pem --image authyouragent/vault:local --no-pull

The vault needs Docker. vault up prints the MCP settings to add to your client. (If you skip vault up, the MCP server starts the vault itself the first time the agent needs the browser; AYA_VAULT_AUTOSTART=0 turns that off.)

json
{  "mcpServers": {    "authyouragent": {      "command": "authyouragent-mcp",      "env": {        "AYA_AGENT_ID": "ag_...",        "AYA_KEY_FILE": "/path/to/agent-key.pem",        "AYA_VAULT_URL": "http://127.0.0.1:7801",        "AYA_VAULT_TOKEN_FILE": "~/.authyouragent/vault/token"      }    }  }}

Node clients can use npx authyouragent-mcp as the command. The agent ID and key come from adding the agent in the phone app (Agents > Add an agent). Without them the server still starts and lists its tools; each tool then says what is missing.

Security

  • Chromium's own sandbox is on (custom seccomp profile, all container capabilities dropped); gVisor is used automatically when Docker has the runsc runtime.
  • The browser can reach only the public internet: loopback, private networks, cloud metadata addresses and the vault's own ports are refused, checked on the resolved address.
  • The agent is disconnected while the owner is in control, and cannot read the browser's cookies.
  • Sign out first, wipe second: at the end of a session, when the agent stops sending heartbeats, or when it is revoked. Sites the vault could not sign out of are reported to the owner, also after a crash.

Known limits are listed in vault/README.md.

Scope: what Auth Your Agent does, and does not do

Auth Your Agent answers one question for a website: who is acting, for whom, with what permission, and can it be withdrawn. A feature belongs here if it grants, limits, proves or withdraws an agent's authority on a site. That covers approvals, sign-in for agents, step-ups in the site's own words, take over at a sign-in wall, signing out, and the vault's own record of what was done with the owner's authority.

It does not do:

  • Conversation with the agent. No multiple-choice or free-text questions, chat or task updates beyond a short note. A card from Auth Your Agent is always about permission, so the owner never learns to tap through it like a chat prompt. Use a tool built for talking to agents (for example Paseo) alongside it.
  • Running or orchestrating agents. It works with whichever agent you use; it does not start, schedule or supervise them.
  • Judging intent with AI. Approval rules are fixed rules the owner can read. No model decides what is safe.
  • Getting past sites' defences. No CAPTCHA solving or bot-detection evasion; the owner takes over instead.
  • Turning websites into tools. Learning a site's API calls as MCP tools is a separate project built on top of the vault.

New features are checked against this list first.

Documentation

Android app

Download from authyouragent.com/download/android.

License

MIT

來源：README.md，提交 5a5b237

工具

0
工具後設資料尚未被收錄。

版本歷史

1
  1. v0.3.24最新Oct 4, 2026