Agent Autofill macOS · Open Source · v0.1.2

Give your agent the exact information it needs.

A local-first personal vault and MCP broker for macOS. Share selected profile fields, origin-bound logins, and 2FA codes with Claude, Codex, and Cursor—while keeping final submission yours.

uv tool install git+https://github.com/lifan-builds/agent-autofill.git
AES-GCM SQLite · macOS Keychain · 0 chat secrets
Try the 60-second interactive demo → View on GitHub ↗
0:33 synthetic walkthrough · Chrome intake, origin-bound credential handoff, and 2FA retrieval Step through interactively →
Read the video transcript

Every time an AI agent hits a form, you end up retyping your address, pasting a password into chat, or hunting down a verification code. Agent Autofill is a local-first personal vault for AI agents on your Mac. Start from Chrome: it organizes saved addresses, confirms Home versus Work, and remembers those meanings across tasks. When a site needs a login or a two-factor code, it hands off a one-time, origin-bound token and pulls the code from connected email or Messages so your raw password never enters model context. And before anything is submitted, you stay in control.

How it works

Three local boundaries keep credentials out of chat logs and keep form submissions human-approved.

1. Import locally from Chrome

Bootstrap saved addresses and logins into an AES-GCM encrypted SQLite vault with keys stored in the macOS Keychain—no plaintext CSV exports.

2. Pair MCP with scoped grants

Run agent-autofill mcp-install for Claude, Codex, Cursor, or Antigravity. Approve only the requested fields or use credential.use for an origin-bound fill.

3. Confirm before submission

The broker is strictly information-only: it never navigates, submits forms, or makes purchases. Your acting agent pauses for confirmation before clicking submit.

Scoped MCP & CLI Quick Start

Pair your coding agent with origin-bound credential handoff and recipient-scoped 2FA retrieval.

Origin-bound credential handoff (0 passwords in model context) 

      

    


    

      

        

          
Documentation

          
Start with a value-free inventory and connect sources only when a task needs them.

        

      

      

        
          Getting started
          First install, inbox check, and vault unlock →
        
        
          Chrome seed onboarding
          Import addresses and saved passwords locally →
        
        
          Access modes
          Direct field delivery vs. extension handoff →
        
        
          CLI cookbook
          Copy-paste commands for daily operation →
        
        
          Operator & MCP reference
          Read-only Gmail (gmail.readonly), Messages, and scopes →
        
        
          Interactive synthetic demo
          Walk through approval and revocation in the browser →
        
      

      

        Privacy boundary: Saved records stay encrypted in local SQLite on your Mac, and vault keys live in the macOS Keychain. Using the Chrome extension handoff (credential.use) keeps website passwords out of model context.