Authyouragent MCP Server

Auth Your Agent

An open-source MCP server that lets an AI agent act for a person on websites, with the person's approval on their phone.

The agent drives a sandboxed browser (the vault) that runs on the person's own machine. When a site asks for a password, a CAPTCHA or a 2FA code, the person takes over that browser from their phone, signs in, and hands it back. The agent never sees the password and never holds the cookies. When the task is done, the vault signs out of every site it used, then destroys the browser profile.

Website: authyouragent.com · License: MIT

What is in this repository

The MCP server, the browser vault and the SDKs:

The phone app and the approval service run at authyouragent.com. The agent signs its requests with its own key pair; the service never receives the person's passwords.

MCP tools

Run it

From PyPI:

pip install "authyouragent[mcp]"
authyouragent vault up --agent-id ag_... --key /path/to/agent-key.pem

From this repository:

git clone https://github.com/kjames2001/authyouragent && cd authyouragent
pip install "./sdk[mcp]"
docker build -f vault/Dockerfile -t authyouragent/vault:local .
authyouragent vault up --agent-id ag_... --key /path/to/agent-key.pem --image authyouragent/vault:local --no-pull

The vault needs Docker. vault up prints the MCP settings to add to your client. (If you skip vault up, the MCP server starts the vault itself the first time the agent needs the browser; AYA_VAULT_AUTOSTART=0 turns that off.)

{
  "mcpServers": {
    "authyouragent": {
      "command": "authyouragent-mcp",
      "env": {
        "AYA_AGENT_ID": "ag_...",
        "AYA_KEY_FILE": "/path/to/agent-key.pem",
        "AYA_VAULT_URL": "http://127.0.0.1:7801",
        "AYA_VAULT_TOKEN_FILE": "~/.authyouragent/vault/token"
      }
    }
  }
}

Node clients can use npx authyouragent-mcp as the command. The agent ID and key come from adding the agent in the phone app (Agents > Add an agent). Without them the server still starts and lists its tools; each tool then says what is missing.

Security

• Chromium's own sandbox is on (custom seccomp profile, all container capabilities dropped); gVisor is used automatically when Docker has the runsc runtime.
• The browser can reach only the public internet: loopback, private networks, cloud metadata addresses and the vault's own ports are refused, checked on the resolved address.
• The agent is disconnected while the owner is in control, and cannot read the browser's cookies.
• Sign out first, wipe second: at the end of a session, when the agent stops sending heartbeats, or when it is revoked. Sites the vault could not sign out of are reported to the owner, also after a crash.

Known limits are listed in vault/README.md.

Scope: what Auth Your Agent does, and does not do

Auth Your Agent answers one question for a website: who is acting, for whom, with what permission, and can it be withdrawn. A feature belongs here if it grants, limits, proves or withdraws an agent's authority on a site. That covers approvals, sign-in for agents, step-ups in the site's own words, take over at a sign-in wall, signing out, and the vault's own record of what was done with the owner's authority.

It does not do:

• Conversation with the agent. No multiple-choice or free-text questions, chat or task updates beyond a short note. A card from Auth Your Agent is always about permission, so the owner never learns to tap through it like a chat prompt. Use a tool built for talking to agents (for example Paseo) alongside it.
• Running or orchestrating agents. It works with whichever agent you use; it does not start, schedule or supervise them.
• Judging intent with AI. Approval rules are fixed rules the owner can read. No model decides what is safe.
• Getting past sites' defences. No CAPTCHA solving or bot-detection evasion; the owner takes over instead.
• Turning websites into tools. Learning a site's API calls as MCP tools is a separate project built on top of the vault.

New features are checked against this list first.

Documentation

• For AI agents
• Take over developer guide
• Developer quickstart
• How it works
• Changelog: what each release added or fixed

Android app

Download from authyouragent.com/download/android.

License

MIT