I built an open-source AI coworker that logs in with 2FA without the model ever seeing your passwords

Every AI agent I tried had the same weak spot: it was great until it reached a login screen. Then it needed a password, a 2FA code, or me.

So I built Godmode Bot, an open-source (MIT) AI coworker that has a real browser plus your logins and 2FA codes. The model never sees any of those secrets.

What it is

Godmode Bot is a desktop app for macOS, Windows and Linux built with Tauri 2. It can also run headless on a server, NAS or Raspberry Pi with a web dashboard. It uses Claude Code as the brain and browser-use to drive a managed Chromium.

You can start with a single chat ("log into our billing portal and download September's invoice"), or build a team of persistent agents that each have their own instructions, memory, schedules and history.

Fill, don't reveal

This is the part I spent the most time on.

• Logins and TOTP secrets live in a local vault: scrypt → key-encryption key → random 256-bit data key → AES-256-GCM per secret.
• When an agent reaches a login form, it calls a tool like vault_fill_login or vault_fill_totp. Godmode types the value into the page over CDP. The password never enters the model's context.
• Fills are site-bound. A login is only typed into its own https site and into real password fields, so a phishing or prompt-injected lookalike page gets nothing.
• Known secrets are redacted from transcripts, logs and the UI, and every secret access is written to an audit log.

Getting secrets in is easy too. You can import passwords from Chrome, 1Password, Bitwarden, Apple Passwords or Firefox, and 2FA from a screenshot of a Google Authenticator export QR code (multi-account codes work).

Agents are git repos

Every agent gets its own repository:

~/.godmode/agents/invoice-collector/
├── CLAUDE.md                 # identity & instructions
├── MEMORY.md                 # long-term memory the agent maintains
├── conversations/<id>.md     # transcripts
├── runs/2026-09-27/<id>.jsonl# raw event logs (secrets redacted)
└── workspace/                # files the agent produced

Every run is committed, so you can see exactly what an agent learned and did, and roll it back.

Other features

• Routines: cron schedules with a friendly builder ("weekdays at 08:00")
• Delegation: agents hand tasks to peer agents or spawn short-lived subagents
• Missing-login inbox: when an agent can't sign in, it tells you exactly what's missing instead of stalling
• Chrome session import: continue where your Chrome profile left off
• Integrations: Composio toolkits and custom MCP servers, globally, per workspace or per agent
• Voice mode, encrypted backup & restore, and all Claude Code slash commands in the composer

How it works

Each turn runs claude -p --output-format stream-json inside the agent's git repo and streams every thought, tool call and screenshot to the UI. A local MCP gateway gives the agent vault tools, delegation tools and report_missing_login. You can watch the browser live next to the chat and take control at any point, for example to solve a CAPTCHA.

The honest caveat

Agents run Claude Code with bypass permissions, so there are no permission prompts. Treat it like a trusted coworker with access to your machine. For sensitive setups, run it in a VM or container. SECURITY.md covers the threat model.

Try it

• Desktop app: Releases
• Headless: docker compose up -d and open http://localhost:7777
• Code, issues and PRs: https://github.com/codextde/godmode-bot

I'd love feedback, especially on the vault design and what you'd want agents to do next. A full computer-use VM mode is on the roadmap.