Browser Login
- 631 installs
- 67k repo stars
- Updated August 4, 2026
- ruvnet/ruflo
browser-login is a Claude Code skill that drives a browser authentication flow once, sanitizes cookies through AIDefence, and vaults a reusable session handle in browser-cookies for future agent sessions.
About
browser-login is a Claude Code skill in ruflo that automates a one-time login against any target URL, then stores a reusable authenticated session for later agent runs. The flow uses claude-flow MCP browser tools—browser_open, browser_fill, browser_click, browser_snapshot, browser_eval, and related calls—to complete username, password, and optional MFA steps from argument hints like login-url and --mfa. Before persistence, cookies pass through mcp__claude-flow__aidefence_scan and aidefence_has_pii checks so sensitive data is sanitized, then the handle is saved in browser-cookies under a named vault entry. Developers reach for browser-login when building agents or scrapers that must call authenticated dashboards, admin panels, or SaaS APIs that lack OAuth machine credentials. Allowed tools include Bash, Read, and Write alongside the browser and AIDefence MCP integrations.
- browser-login
Browser Login by the numbers
- 631 all-time installs (skills.sh)
- +10 installs in the week ending Jul 26, 2026 (Skillselion tracking)
- Ranked #598 of 4,347 Backend & APIs skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/ruvnet/ruflo --skill browser-loginAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 631 |
|---|---|
| repo stars | ★ 67k |
| Last updated | August 4, 2026 |
| Repository | ruvnet/ruflo ↗ |
How do you vault authenticated browser cookies for agents?
Use browser-login for development tasks
Who is it for?
Agent developers integrating with web apps that require interactive login and reusable cookie-based sessions across automated runs.
Skip if: Applications with proper OAuth client credentials, service accounts, or API keys that make browser cookie vaulting unnecessary.
When should I use this skill?
User needs to authenticate a browser session once, handle MFA login, sanitize cookies, or reuse a vaulted session handle for later agent access.
What you get
Named browser-cookies vault handle with sanitized session cookies ready for reuse in later authenticated agent runs.
- Vaulted session cookie handle
- Sanitized authentication state
- Reusable browser session profile
By the numbers
- Uses 8+ claude-flow browser and AIDefence MCP tool integrations
- Vaults sessions in browser-cookies under a configurable --vault-name handle
Files
Browser Login
Authenticate against a target site once, then vault the resulting session credentials so subsequent skills (browser-extract, browser-form-fill, browser-test) can reuse them without re-driving the auth flow. Borrows the pattern from Browserbase's cookie-sync/SKILL.md but stores the resulting context in AgentDB rather than on a hosted backend.
When to use
- Establishing reusable auth for a host the agent will visit repeatedly.
- Refreshing a vaulted cookie set whose expiry has passed.
- Capturing an MFA-protected session that requires interactive completion.
Steps
1. Open a recorded session via browser-record. 2. Drive the auth flow — fill credentials with browser_fill / browser_type. Credentials come from the user or environment; do not read them from .env or paste them into the trajectory args. 3. Handle MFA (when --mfa): pause for user input or invoke the user's TOTP helper; capture only the resulting redirect, not the code itself. 4. Capture cookies via browser_eval:
document.cookie // returns the cookie string for the active documentOr use the Playwright context API where exposed. 5. AIDefence sanitize:
# Each cookie value passes aidefence_scan to flag raw secrets / high-entropy tokens.Tokens that look raw get vault-wrapped (an opaque handle) before AgentDB store; raw values never enter the namespace. 6. Store in `browser-cookies`:
npx -y @claude-flow/cli@latest memory store --namespace browser-cookies \
--key "<host>" \
--value "{vault_handle:<opaque>, expiry:<iso>, aidefence_verdict:safe}"7. Return the vault handle so downstream skills can mount it via the planned browser_cookie_use MCP tool.
Caveats
- Never log raw cookie values, tokens, or passwords. The trajectory step for the auth POST records only the form field names and a
<redacted>placeholder for values. - The
browser_cookie_useMCP tool is reserved (ADR-0001 §7) but not yet implemented. Until then, downstream skills mount the vaulted cookies via a helper bash function inscripts/(TBD). - Some sites bind cookies to a UA fingerprint; if a vaulted cookie fails on reuse, re-run
browser-login. Do not attempt to fingerprint-match yourself. - This skill is not a credential storage solution. The vault-handle pattern protects against AgentDB leaks, not against compromise of the agent's environment.
Related skills
Lark Openapi ExplorerInstantly explore, test, and generate calls against the full Lark (Feishu) OpenAPI surface without leaving their agent workflow.493k
Lark EventConsume real-time events from Lark/Feishu as structured NDJSON streams inside AI agent workflows.387k16kLark Openapi ExplorerWhen an existing Lark/Feishu skill or CLI command cannot fulfill a specific requirement and they need to discover and invoke the exact native OpenAPI endpoint.386k16k
Just ScrapeQuickly search, crawl, extract structured JSON, or monitor web pages without writing custom scraping code.245k41Lark AppsQuery the current visibility and permission scope of a Lark (Feishu) app without writing HTTP client code.235k16k
Design An InterfaceGenerate multiple radically different interface or API designs in parallel before committing to one.188k198kHow it compares
Pick browser-login over manual cookie export when you need agent-driven interactive login, AIDefence sanitization, and named reusable vault handles.
FAQ
What does browser-login produce after a successful run?
browser-login produces a named reusable session handle in browser-cookies containing sanitized authentication cookies, allowing later agent runs to access the target site without repeating the full login flow.
How does browser-login protect sensitive cookie data?
browser-login runs cookies through claude-flow AIDefence scan and aidefence_has_pii checks before vaulting, reducing the risk of storing raw PII or unsafe cookie payloads in browser-cookies handles.
Does browser-login support MFA authentication?
browser-login accepts an --mfa flag in its argument hint alongside the login URL, enabling agents to drive multi-factor web authentication through browser MCP tools before vaulting the resulting session.