Give your cloud bot the sites you are already signed into.

A Chrome extension and a small native host. Local only. No password pasted anywhere.
Hand the folder to your bot and it installs itself.

The setup and the plays  •  8 AI Employees  •  Agent Ops Club  •  Live sessions

⭐ Found this useful? Star the repo. It takes a second and helps the next person find it.

What this is

Grok Bot and Muse browse from a cloud computer of their own. Fresh browser, no sessions, signed out of everything you use, so the first piece of real work hits a login wall.

This is the bridge. A Chrome extension reads the cookies of the sites you are signed into and hands them to a native host, which writes them to a folder on your own machine, every 15 minutes (or on demand). Your bot syncs that folder, then injects the cookies into its own Chrome over DevTools Protocol so the window is actually signed in. Folder sync alone is not enough. Setup is one prompt to your bot, or a few steps by hand.

No password ever moves. Chrome holds a session cookie for every site you are signed into, and the cookie is what proves you are you. Your passwords stay in your password manager.

Built by Mark Fulton of Reinventing.AI, founder of Vibe Coding is Life (340,000+ members), from a setup he runs on his own machine.

Install

You need Chrome and Python 3.

The easy way: let your bot do it

Download this repository (Code, Download ZIP) or clone it, extract it somewhere you will find again, then paste this to Grok Bot or Muse:

Please install and set up the Agent Cookie Sync Chrome extension and native host I just extracted to my computer's Downloads folder. I'll give you the extension id, tell me where to find it. Then set a recurring sync every 15 minutes from the cookie export folder to your computer, inject those cookies into your Chrome via CDP after each pull (see agent/inject-cookies.py), and support on-demand sync with Request-Sync.ps1 / request-sync.sh. Do not use these cookies to sign in to any Google, Meta or X account, as that can trigger a security warning on my account; use your own MCP or plugin for those.

That one prompt does the whole setup, the recurring sync included. It stops once, to walk you through loading the extension in Chrome and to take the extension ID from you, because that part only you can do.

By hand

Windows

powershell -ExecutionPolicy Bypass -File Install.ps1

Then load the extension: Chrome, chrome://extensions, Developer mode on, Load unpacked, pick the extension folder the script printed, and copy the extension ID from its card. Register the host with that ID:

powershell -ExecutionPolicy Bypass -File Register-NativeHost.ps1 -ExtensionId YOUR_EXTENSION_ID

macOS and Linux

Load the extension the same way, copy the ID, then one script does the rest:

bash register-mac-linux.sh YOUR_EXTENSION_ID

Both

Reload the extension on chrome://extensions, then click its toolbar icon once. The badge turns into your cookie count and cookies.json lands in the sync folder: %LOCALAPPDATA%\AgentCookieSync on Windows, ~/.agentcookiesync elsewhere.

Last, tell your bot once:

Set a recurring sync every 15 minutes from that export folder to your computer, inject the cookies into your Chrome with agent/inject-cookies.py after each pull, and wire on-demand sync via Request-Sync.ps1 / request-sync.sh.

The setup page has the same four steps with every click path, free and with no account.

Read this before you switch it on

• The export file is your keys. cookies.json signs in as you on every site in it. Treat the sync folder like a password vault.
• Every bot on the account shares every login. They share one cloud computer, so a login one bot gets, they all get.
• Sync from a work profile. Use a Chrome profile holding only the accounts you would hand to an employee. Not your personal one.
• Revoking is three moves. Remove the extension, delete the sync folder, change the password on anything you want signed out.
• Leave Google and Meta to their own tools. Tell the bot not to sign in to Google, Meta or X with these cookies. See below.

The extension and the host never touch the network. The sync to your bot's computer is the bot's job and your decision. Found a way to make this leak? SECURITY.md, not a public issue.

Final instruction for the agent: skip Google, Meta and X

Do not use these cookies to sign in to a Google, Meta or X property. Gmail, Drive, Search Console, Google Ads, YouTube, Facebook, Instagram, WhatsApp, Meta Ads Manager, x.com.

A cloud browser arriving on those accounts is exactly what their risk systems are built to catch. The cost is a security warning, a locked account or a disabled ad account, not a failed task.

Use their own MCP servers, plugins or official APIs for those connections. They authenticate the way the account expects and they do the job better. It is the same rule the scraping crowd follows: steer clear of the big three.

Everything else is fair game, and it is most of what you actually work in: Canva, the CRM, the help desk, Stripe, the invoicing tool, your product's admin dashboard, the project tracker.

What is in here

extension/manifest.json          Manifest V3, cookies + alarms + nativeMessaging
extension/background.js          exports every 15 minutes, on click, and on demand
native-host/cookie_sync_host.py  writes the file; also answers poll_request
Request-Sync.ps1                 Windows: drop sync-request.flag for a fresh export
request-sync.sh                  macOS/Linux: same on-demand flag
agent/inject-cookies.py          agent computer: inject cookies.json into Chrome via CDP
agent/README.md                  how the bot pulls, injects, and requests a fresh export
Install.ps1                      Windows: copies the files, writes the launcher
Register-NativeHost.ps1          Windows: registers the host for your extension ID
register-mac-linux.sh            macOS and Linux: both steps in one run

Now the harder question: what do you hand it? A bot signed in as you is worth exactly the work you give it. The play book is eight prompts I run on my own accounts, each one written for a browser that is already logged in: a week of Canva graphics built from the content doc, the signups who never finished onboarding chased by name, every SaaS subscription nobody opens put on a cancel list, every stalled deal in the CRM swept and followed up, the support queue triaged angriest first. Past that, the 8 open source AI Employees run work like it on a schedule instead of on your say so. One folder of routines per business role, free on every plan, and this bridge is how they reach your accounts. Get the 8 plays   •   Meet the 8 AI Employees Free account, no card.

Stay logged in on the bot

After your bot copies cookies.json, it must inject into its own Chrome. Use agent/inject-cookies.py against a browser that has --remote-debugging-port (Grok Bot and Muse already do). The script uses Chrome DevTools Storage.setCookies and never prints cookie values.

On-demand sync

Need a fresher session than the 15-minute alarm?

1. Run Request-Sync.ps1 on Windows, or request-sync.sh on macOS/Linux.
2. Within about a minute the extension exports and clears sync-request.flag.
3. Your bot pulls the folder and runs inject-cookies.py again.

You can also click the extension icon anytime for an immediate export.

FAQ

Does this send my cookies anywhere? Not from here. The extension and the host are local only. The sync to your bot is a separate job it runs at your say so.

Does it work with anything other than Grok Bot and Muse? Any agent that browses from a machine that is not yours and can sync a folder. Those two are what it is tested against.

Do I need this for an agent on my own PC? No. It already has your browser.

Why is my bot still on a login page after sync? Syncing the folder is not enough. The bot has to inject cookies.json into its Chrome (see agent/inject-cookies.py). Then reload the site.

Can my bot use it to log into Gmail, my ad account or Facebook? Do not let it. Google, Meta and X treat a cloud browser arriving on your account as the thing their risk systems exist to catch, and the cost is a security warning, a locked account or a disabled ad account. Use their own MCP servers, plugins or official APIs for those, and keep the cookie bridge for everything else: Canva, the CRM, the help desk, Stripe, the invoicing tool, your own admin dashboard.

What happens when I sign out of a site? The next export carries no session for it and your bot loses access at the next sync.

Can I use it for clients? Yes, it is MIT. Just do not ship it under the club's name.

License

MIT. Copyright (c) 2026 Mark Fulton. LICENSE.

Built with Claude Code.