authyouragentBLOCK
Auth Your Agent: let AI agents act for a person on websites, with the person's approval on their phone. Take over lets the owner drive a stuck agent's browser from their phone.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An open-source MCP server that lets an AI agent act for a person on websites, with the person's approval on their phone.
The agent drives a sandboxed browser (the vault) that runs on the person's own machine. When a site asks for a password, a CAPTCHA or a 2FA code, the person takes over that browser from their phone, signs in, and hands it back. The agent never sees the password and never holds the cookies. When the task is done, the vault signs out of every site it used, then destroys the browser profile.
Website: authyouragent.com · License: MIT
What is in this repository
The MCP server, the browser vault and the SDKs:
The phone app and the appr
27120ea48773OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add authyouragent -- uvx authyouragent==0.3.40
Exposed tools (23)
18 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
check_agent_status | destructive | Check whether your agent is still authorized by the owner. The owner can revoke |
check_login_wall | read | Check whether the page is stuck at a sign-in, one-time code (2FA) or sign-in |
click | read | Click an element on the current page and return the page |
end_session | read | End the owner |
fill_secret | read | Fill a field from the owner |
go_back | read | Go back to the previous page, like the browser |
list_secrets | read | List the sign-ins the owner has made available to you from their password |
navigate | read | Open a URL in the vault |
notify_owner | write | Send your owner a one-way note on their phone. Nothing to approve. |
plan_status | read | The state of a plan you submitted: for each step, whether it is |
press_key | read | Press a key in the page: Enter, Space, Tab, Shift+Tab, Escape, Backspace, |
read_page | write | Read the current page: its URL, title, visible text in reading order, and a |
report_site | read | Report a site where take over did not work correctly, so the team can improve it. |
request_approval | read | Ask your owner to approve a sensitive action before you perform it. |
request_takeover | read | Ask your owner to take over the browser from their phone when you are stuck at a |
save_secret | write | Save the sign-in your user typed by hand during a take over on this site to |
screenshot | read | A picture of what the browser shows (JPEG), for when the text is not |
scroll | read | Scroll the page, to read further or to load more (endless lists). |
select_option | read | Choose an entry in a dropdown (<select>). read_page lists each dropdown |
submit_plan | write | Ask your owner, once and in advance, to pre-approve the actions of a |
type_text | read | Type into a form field (replaces its value). Never use this for the owner |
wait_for | read | Wait for the page to change, instead of guessing with sleeps. |
wait_for_takeover | read | Keep waiting for a take over that request_takeover returned as |
Trust audit
BLOCKgrade F · trust 52/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(src[start:end], {"unwrap": unwrap}, ns)exec(s, {"DIR_HDRS": DIR_H}, e23)print(f"Copy {HOME / 'token'} there as the token file" +TELEMETRY = re.compile(r"/(collect|stats|telemetry|analytics|metrics|beacon|events?|log|logs|logging|"
if req.method.upper() not in WRITE_METHODS or req.resource_type in ("ping", "beacon"):if req.method.upper() not in ("GET", "HEAD") or req.resource_type in ("ping", "beacon"):"AYA_VAULT_URL": "http://127.0.0.1:7801",
"privkey_pem": "-----BEGIN PRIVATE KEY-----..."
check_agent_status
const c = async (s) => page.$eval(s, (e) => { const b = e.getBoundingClientRect(); return [b.x + b.width / 2, b.y + b.height / 2]; });const o = { id: String(1000 + Math.floor(Math.random() * 9000)), key: randomBytes(16).toString("hex"),import * as W from "../../sdk-js/src/webbotauth.js";
import * as S from "../../sdk-js/src/_sfv.js";
for (const t of ["https://127.0.0.1/", "https://localhost/", "https://[::1]/", "https://169.254.169.254/", "https://10.1.2.3/",
foreach ( array( '127.0.0.1', '10.1.2.3', '192.168.1.1', '169.254.169.254', '100.64.0.1', '0.0.0.0', '::1', '::ffff:127.0.0.1', 'fd00::1', 'fe80::1', '2001:db8::1' ) as $ip ) {"AYA_VAULT_URL": "http://127.0.0.1:7801",
"AYA_VAULT_URL": "http://127.0.0.1:7801",
"AYA_VAULT_URL": "http://127.0.0.1:7801",
AYA_VAULT_URL: http://127.0.0.1:7801
agent = AgentClient(base_url=CLOUD, agent_id=acct["agent_id"], privkey_pem=priv, verify=False)
v = SiteVerifier(CLOUD, verify=False, mode="local", expected_audience=SITE, public_base_url="http://127.0.0.1:1")
check("raw proof accepted by the cloud verify", httpx.post(CLOUD + "/api/v1/verify", verify=False, json={c = httpx.Client(base_url=CLOUD, verify=False, timeout=30, headers={"Origin": CLOUD})"sig2=:gHzpLNeHaHIO19NaJH9YMW5dcVSi2s0wOMBr6p18vcofS106sfC4KBIS0/szPlBBd1vIcyQ88B6CTEWIhRAiVrb9zfX0mx1aG12CSGWcYkSirHeyTxhbuJvXd27ed6skWoy4PjXItq38936ivUQjfdIwXh1aX6HxkAC3vRnEdSNfntkLWeEuIQ5BLIOBGE39f
"sig2=:I1QWNzGXdP1a4dSvOHLCVOOanEYHDk+ZsVxM9MLX/p4ko69ghKwR5EOtAD96g7g4GWP7lmpM/jFAf9q8EFRDTPLjUXySwMv4YPgabv2LQihTJG2y8a2m6IGltyruwQNiqSJVUuRaG9+b17CGmAMFZh30X6GXLdQJrCARpeTqPwp2DC+a8haDE/VE5EruqzjA5
Gates applied: no_behavioural_pass.
27120ea48773full audit observations/trust-audit/mcp-server/kjames2001__authyouragent.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 27120ea48773 | BLOCK | F | 52 | first audit |
Questions
What is the authyouragent MCP server?
Auth Your Agent: let AI agents act for a person on websites, with the person's approval on their phone. Take over lets the owner drive a stuck agent's browser from their phone.
What tools does authyouragent expose?
23 in total: 18 read-only, 4 that write, and 1 that can delete or overwrite (check_agent_status). Every one is listed on this page with its risk.
Is authyouragent safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (52/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does authyouragent need?
It reads AUTHYOURAGENT_CLOUD, AUTH_SECRET, AYA_CLIENT_SECRET, AYA_KEY_FILE, AYA_VAULT_TOKEN, AYA_VAULT_TOKEN_FILE, KEY_FILE, RFC_KEYS, VAULT_TLS_KEY, VAULT_TOKEN and VAULT_WEB_BOT_AUTH from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does authyouragent run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as authyouragent at 0.3.24.
How current is this page?
The grade is for one exact copy of the source (27120ea48773), read on 2026-10-11. The repository is watched and re-audited when it changes.