Which agents work with OTPilot?

Any agent that supports the Model Context Protocol (MCP): Claude Code, Codex, Cursor, Claude Desktop and others. Each one is connected and approved separately.

Does my agent use the browser extension?

No. You manage everything in the extension: which agents are connected and which accounts each can use. The agent only talks to the OTPilot MCP server running on your computer, which signs in or runs the command and returns the result.

Can the AI model see my password or 2FA code?

Not through OTPilot: no tool returns a secret. The agent gets results ("signed in", a command's output with secrets scrubbed). An agent that runs commands decides what they do, though, and could try to reveal a secret on purpose. For sensitive accounts, allow only the 2FA code, limit the commands, or turn on "ask every time".

Do I need an account? What does the agent receive?

You need a free OTPilot account (a free plan works) so the agent can receive what you allow. For each account you allow, OTPilot uploads a copy encrypted for that agent's key, holding only what you chose. Connecting an agent uploads nothing else; if you use sync, the rest of your vault stays encrypted under your own key, which agents never get.

Does it work when Chrome is closed?

Yes, for accounts you allowed until you revoke them: the agent doesn't need the browser. Approving a new request, or an account set to "ask every time", needs the extension.

It's included in every plan. Free connects 1 agent with up to 3 accounts; Personal and Team have no limit on agents or accounts.

What if my agent is compromised?

It can only open the accounts you allowed it, not your vault. Revoke the agent in OTPilot so it can't get them again, and change the passwords of the accounts it had. A compromised computer is a bigger problem, as with any password manager: whoever controls it can also capture your vault when you unlock it.

NEWOTPilot 2.1 · agentic sign-in for AI agents

Give your agents your logins.
Not your passwords.

Claude Code, Codex and Cursor can sign in, pass the 2FA step and run commands with the accounts you allow. OTPilot uses the secrets; the model only sees the result.

Add to Chrome — it's free How it works

claude — ~/code/acme

> Test the staging login and check the dashboard loads the payments
 
● otpilot.list_accounts()
  ⎿ GitHub (2FA, login) · AWS staging (2FA, login) · acme-db (password)
 
● otpilot.browser_login(account: "AWS staging")
  ⎿ pending_approval — approve "Claude Code → AWS staging" in OTPilot
 
  I need access to AWS staging. Approve it in OTPilot and I'll continue.
 
● otpilot.browser_login(account: "AWS staging")
  ⎿ signed_in — session saved to .otpilot/aws-staging.json (expires 1h)
 
● playwright.open("https://staging.acme.io/payments",
              storageState: ".otpilot/aws-staging.json")
  ⎿ 200 · 14 payments listed
 
● otpilot.run("psql -h db.staging -c 'select count(*) from payments'",
           env: { PGPASSWORD: "acme-db/password" })
  ⎿ count: 14   (secrets redacted from output)
 
  Done: the staging login works and the dashboard shows all 14 payments.
  I never saw the password or the 2FA code.

Works with any MCP agent · Off by default · Revoke anytime

Agents need your logins. Today that means leaking them.

Asking an agent to test a login, check a dashboard or query a database usually ends in one of these.

Pasted into the chat

A password typed into a prompt lives on in the transcript, your history, logs and the model provider's servers.

Left in a .env file

Plaintext on disk, one wrong commit away from a public repo, and readable by every tool your agent runs.

Stuck at the 2FA step

Even with the password, the agent stops at "enter the code from your app" and hands the task back to you.

How it works

You stay in the extension. Your agent stays in the terminal. The secrets stay with OTPilot.

Connect your agent

Add the OTPilot MCP server to Claude Code, Codex, Cursor or any MCP client. It shows a short code; approve it in the extension if the codes match.

Choose its accounts

A new agent gets nothing. Allow accounts one by one, per agent, and pick what each can use: just the 2FA code, the whole sign-in, or chosen fields.

Let it work

The agent asks OTPilot to sign in or run a command. OTPilot does it with the real values and returns the result. Need another account? You get a request to approve.

Set it up in two minutes

You need the OTPilot extension and an OTPilot account (free works). Each agent is connected and approved on its own.

1
Install the plugin (the MCP server plus a skill that teaches Claude to use it):
```
/plugin install otpilot --marketplace OTPilot/OTPilot
```
2
Connect it once, then approve it in the extension if the codes match:
```
npx -y @otpilot/mcp@latest connect --name "Claude Code"
```
3
In the extension, open Agents and allow it the accounts it may use — or let it ask as it works.

What your agent can do with it

Username, password and the 2FA code, on the account's own site only. Your agent's browser gets the signed-in session, never the credentials.

Run commands with secrets

psql, curl, deploy scripts: secrets go in as environment variables for that one process, and are scrubbed from the output before your agent reads it.

Fresh 2FA codes for scripts

End-to-end tests that log in with 2FA get a current code injected at run time, so the test passes without a human holding a phone.

Know what it can use

The agent can list the accounts you allowed it, by name and site. Nothing else in your vault exists for it.

Built so you can say yes

Everything is off by default. Each agent gets exactly what you approved, and nothing it can open without you.

Encrypted for that agent only

Each agent has its own key, kept in your computer's keychain. An account you allow is encrypted for that key alone; our servers only ever see ciphertext.

Two approvals

Connecting an agent gives it no accounts. Every account is a separate approval, per agent: two agents, two decisions.

A code to catch impostors

The code in your terminal and the one in OTPilot must match before you approve, so nobody can slip in their own "Claude Code".

Ask every time

For the accounts that matter most, OTPilot asks you before each use, and you can allow an account for an hour instead of for good.

Every use on record

The activity log shows which agent used which account, when and for what. Revoke an agent, or a single account, in one click.

Only on the right site

A sign-in is only ever made on the site saved in the account, so a prompt injection can't send your password somewhere else.

Honest limit: an agent that runs commands decides what those commands do, and could try to reveal a secret on purpose. OTPilot scrubs secrets from what it returns; for sensitive accounts, allow only the 2FA code, limit the commands, or turn on "ask every time".

In every plan

Free

1 connected agent
Up to 3 accounts for it
Passwords and 2FA codes
Activity log and revoke

Personal & Team

from $3 / month

Unlimited agents
Unlimited accounts per agent
Everything in your plan: sync, sharing…
Activity log and revoke

See all plans →·How it compares to 1Password and Bitwarden →

Questions

Which agents work with OTPilot?: Any agent that supports the Model Context Protocol (MCP): Claude Code, Codex, Cursor, Claude Desktop and others. Each one is connected and approved separately.
Does my agent use the browser extension?: No. You manage everything in the extension: which agents are connected and which accounts each can use. The agent only talks to the OTPilot MCP server running on your computer, which signs in or runs the command and returns the result.
Can the AI model see my password or 2FA code?: Not through OTPilot: no tool returns a secret. The agent gets results ("signed in", a command's output with secrets scrubbed). An agent that runs commands decides what they do, though, and could try to reveal a secret on purpose. For sensitive accounts, allow only the 2FA code, limit the commands, or turn on "ask every time".
Do I need an account? What does the agent receive?: You need a free OTPilot account (a free plan works) so the agent can receive what you allow. For each account you allow, OTPilot uploads a copy encrypted for that agent's key, holding only what you chose. Connecting an agent uploads nothing else; if you use sync, the rest of your vault stays encrypted under your own key, which agents never get.
Does it work when Chrome is closed?: Yes, for accounts you allowed until you revoke them: the agent doesn't need the browser. Approving a new request, or an account set to "ask every time", needs the extension.
What does it cost?: It's included in every plan. Free connects 1 agent with up to 3 accounts; Personal and Team have no limit on agents or accounts.
What if my agent is compromised?: It can only open the accounts you allowed it, not your vault. Revoke the agent in OTPilot so it can't get them again, and change the passwords of the accounts it had. A compromised computer is a bigger problem, as with any password manager: whoever controls it can also capture your vault when you unlock it.

Let your agent finish the job

Sign-ins, 2FA and secrets, handled by OTPilot. Free to start.

Add to Chrome — it's free

Give your agents your logins.Not your passwords.