Open-source Godmode Bot fills browser logins and 2FA codes without exposing secrets to the model

A developer has published Godmode Bot, an open-source, MIT-licensed AI agent built to solve the problem where most browser agents give up: the login screen. According to a post on dev.to, the tool pairs a managed Chromium browser with a local credential vault, so agents can sign in with passwords and two-factor codes while the underlying model never sees any of those secrets.

Fill, don't reveal

The centrepiece is what the author calls "fill, don't reveal." Credentials and TOTP seeds live in a vault on the user's machine, with each secret encrypted individually using AES-256-GCM. The key hierarchy described in the post runs scrypt to derive a key-encryption key, which in turn unwraps a random 256-bit data key.

When an agent reaches a login form, it calls a tool such as vault_fill_login or vault_fill_totp, and the application itself types the value into the page over the Chrome DevTools Protocol. The secret therefore never enters the model's context, where it could otherwise surface in logs, screenshots or a prompt-injection attack.

Fills are also site-bound. A stored login is only typed into its own HTTPS origin and into fields recognised as genuine password inputs, which the developer says leaves phishing pages and prompt-injected lookalikes empty-handed. Known secrets are redacted from transcripts, logs and the UI, and every vault access is written to an audit log.

Getting data in is deliberately simple: passwords can be imported from Chrome, 1Password, Bitwarden, Apple Passwords and Firefox, while 2FA seeds can be added from a screenshot of a Google Authenticator export QR code, including multi-account exports.

Claude Code with a browser

Godmode Bot is a desktop application for macOS, Windows and Linux built on Tauri 2, and it can also run headless on a server, NAS or Raspberry Pi behind a web dashboard. Claude Code acts as the reasoning engine and browser-use drives the Chromium instance. Each turn runs claude -p --output-format stream- and streams every thought, tool call and screenshot back to the interface, where the user can watch the browser live next to the chat and take over manually at any point, for example to solve a CAPTCHA.

A local MCP gateway supplies the agent with the vault tools, delegation tools and a report_missing_login function, which tells the user exactly which credential is absent instead of letting the agent stall.

Agents as git repositories

Each agent is a git repository containing a CLAUDE.md file with its identity and instructions, a MEMORY.md file for long-term memory the agent maintains itself, markdown transcripts of conversations, raw JSONL event logs with secrets redacted, and a workspace for files the agent produces. Every run is committed, so users can review exactly what an agent learned and did, and roll it back if needed.

The post also lists routines on cron schedules with a friendly builder, delegation between peer agents plus short-lived subagents, Chrome session import to continue an existing profile, Composio integrations and custom MCP servers scoped globally, per workspace or per agent, voice mode, encrypted backup and restore, and Claude Code slash commands in the composer.

The honest caveat

The developer is upfront about the trade-off: agents run Claude Code with bypass permissions, meaning there are no permission prompts at all. The recommendation is to treat the agent like a trusted coworker with access to the machine, and to run it inside a VM or container for sensitive setups. A SECURITY.md file documents the threat model, a full computer-use VM mode is on the roadmap, and the code is available on GitHub under codextde/godmode-bot.

Why it matters

Authentication is where browser agents most often fail, and the usual fixes are poor ones: pasting a password into the chat or handing over a long-lived session cookie. Both put durable secrets inside a context window that can leak through logs, screenshots or a crafted web page.

Godmode Bot's approach — keeping secrets in an encrypted local vault, letting a site-bound component type them, and auditing every access — is a pattern other agent frameworks could adopt regardless of which model they run. The bypass-permissions caveat is the flip side worth watching: the vault protects your secrets from the model, but nothing in the current design protects the machine from the agent itself.