agent-auth
A tool that gives AI coding agents like Codex SSH authentication without storing private keys on the server. It presents a normal SSH_AUTH_SOCK to the agent, supports sudo through pam_ssh_agent_auth, and routes signing requests to the 1Password SSH agent on an available Mac or to Agent Witness on a phone.
What it addresses
Giving an AI agent the access it needs without leaving private keys and other credentials on the server.
Shared over time
Each entry reflects what was shared on that date. Details may have changed since then.
agent-auth
A tool that gives AI coding agents like Codex SSH authentication without storing private keys on the server. It presents a normal SSH_AUTH_SOCK to the agent, supports sudo through pam_ssh_agent_auth, and routes signing requests to the 1Password SSH agent on an available Mac or to Agent Witness on a phone.
Problem: Giving an AI agent the access it needs without leaving private keys and other credentials on the server.
Posted by @evanpurkhiser · Original comment ↗
“For SSH (and sudo through pam_ssh_agent_auth), I ended up building agent-auth and Agent Witness. Codex sees a normal SSH_AUTH_SOCK and supplies some context about why it needs a signature. If one of my Macs is available, agent-auth proxies the request to the 1Password SSH agent there. Otherwise it routes the request to Agent Witness on my phone.”