Why Your AI Browser Agent Needs a Local Vault (Not a Cloud Bot Vault or Plaintext .env)

Give an AI agent a browser task—booking a flight, filling a job application, or reconciling SaaS invoices—and it immediately hits three walls:

1. Profile ambiguity: Which of the three addresses Chrome saved over the last five years is your current home vs. work address?
2. Credentials and payment cards: How does the agent sign in or select the right corporate card without you pasting passwords into the prompt or leaving a plaintext .env / CSV export on disk?
3. 2FA verification: When the site sends a 6-digit OTP to Gmail or iMessage, how does the agent read that one code without turning your inbox into an unrestricted search oracle?

Recently, xAI shipped Grok Bot Vault (v0.75.2+) with saved Logins, Cards, Contact Info, and natural-language Hints. It proved the exact product category—but also highlighted why a cloud-hosted, vendor-locked bot vault makes security-conscious developers nervous:

• In Grok Bot Vault, saved payment cards auto-fill and pay at checkout without a separate payment confirmation step.
• Vault entries are shared globally across all bots on the account.
• Importing logins requires exporting a plaintext <5 MB CSV file to disk.
• It only works inside Grok Bot—not Claude Code, Codex, Cursor, or OpenClaw.

I built Agent Autofill to solve the full loop locally on macOS behind a single MCP server.

How Agent Autofill compares

Capability	Agent Autofill	Grok Bot Vault (v0.75.2+)	1Password Agentic Autofill	personal-vault-mcp (PCP)
Custody	Local SQLite (AES-GCM) + macOS Keychain	xAI Cloud	1Password Cloud + Local Agent	Local SQLite
Works with any MCP agent	Yes (Claude, Codex, Cursor, OpenClaw)	No (Grok Bot only)	Constrained integrations	Yes
Addresses + Home/Work meaning	Yes (Chrome seed + confirmed bundles)	Basic Contact Info + Hints	Static identity items	Identity + Preferences
Password import without CSV	Direct Chrome Keychain Safe Storage	Requires plaintext CSV export	Native vault	Not supported
Secretless browser login	Local Chrome extension (credential.use)	Server-side bot runtime	Browserbase / extension	Not supported
Checkout confirmation gate	Mandatory pre-submit human gate	Saved cards auto-pay without prompt	Approval prompt	Not supported
Scoped Email + iMessage 2FA	Yes (email.otp + macOS Messages)	No (manual takeover on 2FA)	TOTP only	Not supported

Architecture: Metadata first, scoped reads second

Agent Autofill separates choosing a record from reading its secret or personal values:

1. Value-free discovery: The agent calls list_profile_groups, match_credentials, or match_financial_records (supporting natural-language hint, last4, or card_suffix comparisons inside the vault). No passwords, card numbers, or street addresses are returned during discovery.
2. Origin + purpose grants: Every sensitive read requires an explicit grant (or a paired local service identity) bound to a normalized target_origin and purpose.
3. Two credential delivery paths:
   • Extension handoff (delivery="extension"): Issues a short-lived, origin-bound one-time handle (credential.use). The paired local Chrome extension fills the login on the matching tab so the password never enters model context.
   • Direct (delivery="direct"): Returns only the requested fields (username, password) for the approved origin when extension handoff isn't used.
4. Target-bound 2FA extraction: request_auth_code_for_recipient validates sender domain, recipient, and freshness window before returning a single code, and MacMessagesAdapter reads scoped macOS Messages (including modern macOS attributedBody typedstream payloads) in read-only mode.

Hard boundary: Information-only

Agent Autofill never navigates, clicks submit, sends outbound messages, or completes a purchase. Reading a field and submitting a form are two distinct decisions. Even when an agent is authorized to read checkout fields, the consuming workflow must pause and show the final review summary before clicking submit, pay, or send.

Try it in 60 seconds on macOS

You can run the synthetic in-memory tour before connecting any real database, Keychain entry, or browser profile:

git clone https://github.com/lifan-builds/agent-autofill.git
cd agent-autofill
uv tool install .

# 1. Run the memory-only synthetic tour (touches zero real files)
agent-autofill demo

# 2. Initialize your encrypted vault and inspect the loopback Inbox
agent-autofill --db ~/.agent-autofill.sqlite3 init
agent-autofill --db ~/.agent-autofill.sqlite3 quickstart
agent-autofill --db ~/.agent-autofill.sqlite3 inbox-web

# 3. Register the MCP server with Claude Desktop, Cursor, Codex, or Antigravity
agent-autofill mcp-install --client claude

Agent Autofill is currently macOS-first (using macOS Keychain, Chrome Safe Storage, and chat.db); Linux and Windows support are on the roadmap.

• Repository & 33-second product tour: github.com/lifan-builds/agent-autofill