agentcookie
github.com/mvanhorn/agentcookie- Category
- Developer Tools
- Rank
- No. 124Tools index
- Type
- APP
- Builder
- @mvanhorn
- GitHub
- 829 stars
- Latest release
- v1.1.0
- Date
About
Your agent runs on a Mac that isn't your daily driver. agentcookie keeps its sessions in sync with the Mac you actually browse on, continuously, encrypted over Tailscale, so OpenClaw, Hermes, or any other agent runtime wakes up authenticated. macOS, peer-to-peer, no cloud middleman.
What it does
agentcookie watches authentication state on one Mac, decrypts browser cookies, applies policy filters, and pushes changes to another Mac. The receiver can populate Chrome, a cookie database, supported command-line tool formats, or an optional WebKit browser. It also carries bearer tokens, API keys, and other command-line secrets through the same replication channel.
Why it's ranked here
The tool tackles a narrow but costly operational problem with unusually broad delivery options. Existing tools can consume a real Chrome profile, a compatible cookie database, environment-based secrets, or dedicated adapters. Its strongest engineering choices are policy filtering, authenticated encryption, replay defense, atomic sidecar replacement, post-write health checks, and explicit handling of device-bound sessions.
What's good
It accommodates tools instead of demanding one integration model. Cookie-aware clients can read the sidecar, unmodified clients can use Chrome, and supported command-line tools receive their native configuration. Source cookies are decrypted read-only while Chrome holds its lock. The receiver re-encrypts values for its own Keychain, and tests cover device-bound session classification plus regressions in Chrome cookie encoding.
Tradeoffs
This is firmly a macOS and Chromium-oriented system. Direct database delivery requires Chrome to remain stopped on the destination. The WebKit route copies cookies only, can lose cross-site cookies, and needs a socket setting plus restart for unattended use. Device-bound sessions may expire because the receiving Mac cannot perform source-device challenges. The sidecar can contain plaintext values unless sealing is enabled.
How to use it well
Use it when a dedicated Mac runs unattended browser or command-line agents under your identity. Start with restrictive domain policy, use the signed installed binary for stable Keychain access, and choose the least exposed delivery surface each consumer supports. It does not replicate complete browser storage or defeat device-bound authentication, so plan occasional sign-ins for sites relying on those mechanisms.
Technical notes+
The Go module and dependencies are declared in go.mod, with Cobra providing the CLI surface and SQLite, fsnotify, Keychain, and Chrome DevTools Protocol support. internal/chrome/read.go opens Chrome SQLite read-only, decrypts v10 AES-CBC values, and strips matching App-Bound host prefixes. internal/chrome/write.go adapts to the live schema, re-encrypts cookies, and pins the metadata version for reader compatibility. internal/chrome/sidecar.go builds a Chrome-shaped database atomically and optionally seals values. internal/cdp/setcookies.go injects cookies through Chrome DevTools Protocol with domain, host-only, SameSite, and expiry handling. internal/chrome/dbsc.go ships suspected device-bound cookies with warnings by default, with opt-in skipping. internal/chrome/probe.go validates recent writes, prefix leakage, and metadata. Makefile exposes build, install, signing, notarization, test, and vet targets.
Observed
- Primary language
- Go
- Interface
- Command-line application built with Cobra
- Platform support
- macOS, with macOS Keychain and LaunchAgent integration
- Install surface
- Go build and install targets, plus code-signing and notarization targets
- Browser surfaces
- Chrome-family cookie databases, Chrome DevTools Protocol, and optional cmux WebKit delivery
- Secret delivery
- Cookie sidecar, native CLI adapters, environment-based secret files, and an in-process Go library
- Tests
- Supplied repository files include Go tests for device-bound session classification and cookie database probing
Read from README.md, go.mod, Makefile, internal/cdp/prefix.go, internal/chrome/dbsc.go, internal/chrome/read.go, internal/chrome/probe.go, internal/chrome/write.go, internal/cdp/setcookies.go, internal/chrome/browser.go, internal/chrome/sidecar.go, internal/chrome/appbound.go, internal/chrome/keychain.go, internal/chrome/dbsc_test.go, internal/chrome/probe_test.go.
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.