agent-cookie-sync

A Chrome extension and a small native host. Local only. No password pasted anywhere.
Hand the folder to your bot and it installs itself.

The setup and the plays  •  8 AI Employees  •  Agent Ops Club  •  Live sessions

⭐ Found this useful? Star the repo. It takes a second and helps the next person find it.

Grok Bot and Muse browse from a cloud computer of their own. Fresh browser, no sessions, signed out of everything you use, so the first piece of real work hits a login wall.

This is the bridge. A Chrome extension reads the cookies of the sites you are signed into, only the sites you choose if you like, and hands them to a native host, which writes them to a folder on your own machine, every 15 minutes, the moment you sign in somewhere, or on demand. Your bot syncs that folder, then injects the cookies into its own Chrome over DevTools Protocol so the window is actually signed in. Folder sync alone is not enough. Setup is one prompt to your bot, or a few steps by hand.

No password ever moves. Chrome holds a session cookie for every site you are signed into, and the cookie is what proves you are you. Your passwords stay in your password manager.

Built by Mark Fulton of Reinventing.AI, founder of Vibe Coding is Life (340,000+ members), from a setup he runs on his own machine.

You need Chrome and Python 3.

Download this repository (Code, Download ZIP) or clone it, extract it somewhere you will find again, then paste this to Grok Bot or Muse:

Please install and set up the Agent Cookie Sync Chrome extension and native host I just extracted to my computer's Downloads folder. I'll give you the extension id, tell me where to find it. Then set a recurring sync every 15 minutes from the cookie export folder to your computer, inject those cookies into your Chrome via CDP after each pull (see agent/inject-cookies.py), and support on-demand sync with Request-Sync.ps1 / request-sync.sh. Do not use these cookies to sign in to any Google, Meta or X account, as that can trigger a security warning on my account; use your own MCP or plugin for those.

That one prompt does the whole setup, the recurring sync included. It stops once, to walk you through loading the extension in Chrome and to take the extension ID from you, because that part only you can do.

Windows

powershell -ExecutionPolicy Bypass -File Install.ps1

Then load the extension: Chrome, chrome://extensions, Developer mode on, Load unpacked, pick the extension folder the script printed, and copy the extension ID from its card. Register the host with that ID:

powershell -ExecutionPolicy Bypass -File Register-NativeHost.ps1 -ExtensionId YOUR_EXTENSION_ID

macOS and Linux

Load the extension the same way, copy the ID, then one script does the rest:

bash register-mac-linux.sh YOUR_EXTENSION_ID

Both

Reload the extension on chrome://extensions, then click its toolbar icon once. The badge turns into your cookie count and cookies.json lands in the sync folder: %LOCALAPPDATA%\AgentCookieSync on Windows, ~/.agentcookiesync elsewhere.

The settings page opens by itself the first time. Come back to it any time: right click the toolbar icon, Options.

Last, tell your bot once:

Set a recurring sync every 15 minutes from that export folder to your computer, inject the cookies into your Chrome with agent/inject-cookies.py after each pull, and wire on-demand sync via Request-Sync.ps1 / request-sync.sh.

The setup page has the same four steps with every click path, free and with no account.

• The export file is your keys. cookies.json signs in as you on every site in it. Treat the sync folder like a password vault.
• Every bot on the account shares every login. They share one cloud computer, so a login one bot gets, they all get.
• Sync from a work profile. Use a Chrome profile holding only the accounts you would hand to an employee. Not your personal one.
• Revoking is three moves. Remove the extension, delete the sync folder, change the password on anything you want signed out.
• Leave Google and Meta to their own tools. Tell the bot not to sign in to Google, Meta or X with these cookies. See below.

The extension and the host never touch the network. The sync to your bot's computer is the bot's job and your decision. Found a way to make this leak? SECURITY.md, not a public issue.

Do not use these cookies to sign in to a Google, Meta or X property. Gmail, Drive, Search Console, Google Ads, YouTube, Facebook, Instagram, WhatsApp, Meta Ads Manager, x.com.

A cloud browser arriving on those accounts is exactly what their risk systems are built to catch. The cost is a security warning, a locked account or a disabled ad account, not a failed task.

Use their own MCP servers, plugins or official APIs for those connections. They authenticate the way the account expects and they do the job better. It is the same rule the scraping crowd follows: steer clear of the big three.

Everything else is fair game, and it is most of what you actually work in: Canva, the CRM, the help desk, Stripe, the invoicing tool, your product's admin dashboard, the project tracker.

Right click the toolbar icon, Options. Every change saves as you make it, and the page tells you what the next export will carry before you run it.

Which sites. Three rules: every site you are signed into, only the sites you tick, or every site except the ones you tick. The list groups cookies by site, shows how many each holds and when you last used it, and has a search box and a switch for sites that look signed in. A separate switch, on by default, holds back Google, Meta and X no matter what else you pick.

Only sites used recently. Today, the last 7, 30 or 90 days, or any time. Chrome does not record when a cookie was created, so this reads your browsing history (the extension asks for that permission once, when you first pick a window, and reads it on this computer only) plus the cookie changes it has seen since it was installed.

Timing. The scheduled export runs every 15 minutes unless you change it. Instant sync, on by default, exports within about a minute of a sign-in cookie changing on a site your rules allow, so a fresh login reaches your bot on its next pull instead of up to 15 minutes later. At most one of those every two minutes.

The rules that applied are written into cookies.meta.json under filter, so your bot can see what it was given.

extension/manifest.json          Manifest V3, cookies + alarms + nativeMessaging (history is optional)
extension/background.js          exports on the schedule, on click, on demand, and on sign in
extension/lib.js                 the site rules: which sites, how recent, never the big three
extension/options.html, .css, .js  the settings page, on the club palette
extension/icons/                 the Agent Ops Club icon at 16, 32, 48 and 128
native-host/cookie_sync_host.py  writes the file; also answers poll_request
Request-Sync.ps1                 Windows: drop sync-request.flag for a fresh export
request-sync.sh                  macOS/Linux: same on-demand flag
agent/inject-cookies.py          agent computer: inject cookies.json into Chrome via CDP
agent/README.md                  how the bot pulls, injects, and requests a fresh export
Install.ps1                      Windows: copies the files, writes the launcher
Register-NativeHost.ps1          Windows: registers the host for your extension ID
register-mac-linux.sh            macOS and Linux: both steps in one run

After your bot copies cookies.json, it must inject into its own Chrome. Use agent/inject-cookies.py against a browser that has --remote-debugging-port (Grok Bot and Muse already do). The script uses Chrome DevTools Storage.setCookies and never prints cookie values.

Need a fresher session than the 15-minute alarm?

1. Run Request-Sync.ps1 on Windows, or request-sync.sh on macOS/Linux.
2. Within about a minute the extension exports and clears sync-request.flag.
3. Your bot pulls the folder and runs inject-cookies.py again.

You can also click the extension icon anytime for an immediate export.

Does this send my cookies anywhere? Not from here. The extension and the host are local only. The sync to your bot is a separate job it runs at your say so.

Does it work with anything other than Grok Bot and Muse? Any agent that browses from a machine that is not yours and can sync a folder. Those two are what it is tested against.

Do I need this for an agent on my own PC? No. It already has your browser.

Why is my bot still on a login page after sync? Syncing the folder is not enough. The bot has to inject cookies.json into its Chrome (see agent/inject-cookies.py). Then reload the site.

Can my bot use it to log into Gmail, my ad account or Facebook? Do not let it. Google, Meta and X treat a cloud browser arriving on your account as the thing their risk systems exist to catch, and the cost is a security warning, a locked account or a disabled ad account. Use their own MCP servers, plugins or official APIs for those, and keep the cookie bridge for everything else: Canva, the CRM, the help desk, Stripe, the invoicing tool, your own admin dashboard.

Can I sync only a few sites? Yes. Options, then Only the sites I pick, tick them, done. The next export carries nothing else.

Can it sync only the sites I actually use? Pick a window under Only sites used recently. It works from your browsing history and from cookie changes, because Chrome keeps no creation date on a cookie.

How fast does a new login reach my bot? With instant sync on, the export runs within about a minute of the sign-in. Your bot has it on its next pull.

What happens when I sign out of a site? The next export carries no session for it and your bot loses access at the next sync.

Can I use it for clients? Yes, it is MIT. Just do not ship it under the club's name.

MIT. Copyright (c) 2026 Mark Fulton. LICENSE.

Built with Claude Code.