Agent Access CLI
An open protocol, the aac CLI and an SDK from Bitwarden: an agent gets only the credentials it needs from a password manager.
- 225 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The tool gives agents real logins and passwords from a password manager.
Install
Manual install
curl -L https://github.com/bitwarden/agent-access/releases/latest/download/aac-macos-aarch64.tar.gz | tar xz && sudo mv aac /usr/local/bin/An example for macOS on Apple Silicon. For Linux and Intel change the archive name, and for Windows download the zip from the release.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The tool gives agents real logins and passwords from a password manager.
This is third-party code. Review the repository files before installing.
What it does
Agent Access builds an end-to-end encrypted tunnel between a remote system (the agent) and a credential provider such as a password manager. The agent requests a specific login and receives only that, while the rest of the vault stays closed. Bitwarden built the protocol, but it is open to any provider, and the `aac` CLI and SDK can be embedded in agents or custom software. On the user side `aac listen` connects to the Bitwarden CLI (`bw`), unlocks the vault through `/unlock` and creates a pairing token. The agent connects with that token: `aac connect` returns the credentials as JSON (an example pipes them to `docker login`), and `aac run` injects them into the process environment, for example `PGUSER` and `PGPASSWORD` for `psql`, without exposing the secrets to the model. Without `bw` you can run `aac listen --provider example` with test data for example.com. SDKs in Rust, Python (UniFFI) and JavaScript (WASM) provide a `RemoteClient` with `connect(token=...)` and `request_credential("example.com")` calls. There is a ready skill for OpenClaw, a GitHub Actions example and prebuilt archives for macOS, Linux and Windows.
Who it is for. Agent developers and teams who need to give agents logins and passwords from a password manager without handing over the whole vault or keeping secrets in the environment.
Good fit when
- An agent needs one login for a service and the whole vault cannot be handed over.
- A `psql` process needs `PGUSER` and `PGPASSWORD` that must not enter the model context.
- A script feeds `docker login` with data from the vault through `aac connect`.
- Your own password manager connects to agents over an open protocol.
Not a fit when
- You need a production tool: the project is at an early stage and the protocol and API may change.
- Secrets are to be pasted into model prompts: the authors do not recommend this.
- The password manager supports neither the protocol nor the Bitwarden CLI.
Example request
Connect to aac with the token ABC-DEF-GHI and run psql with the login and password from the vault through aac run without showing them to me.Limitations
The project is at an early preview stage and the API and protocol may change. The authors advise against entering sensitive credentials directly into language models and agents and recommend injecting secrets into a process through `aac run` so they stay out of the recorded context. Bitwarden requires an installed `bw`. Binaries are downloaded from releases and placed in `/usr/local/bin`, and on Windows the archive is unpacked into a directory on `PATH`. The license is Apache-2.0, the last commit dates from November 2026.
How to disable. Delete `aac` from `/usr/local/bin` (on Windows from the directory on `PATH`) and the skill `~/.openclaw/skills/agent-access`. Stop `aac listen`, after which pairing tokens stop working.
FAQ
How do I install aac?
Download an archive from the release, for example `aac-macos-aarch64.tar.gz` or `aac-linux-x86_64.tar.gz`, unpack it and put `aac` in `/usr/local/bin`. For Windows there is `aac-windows-x86_64.zip`.
How do I connect Bitwarden?
Install `bw`, run `aac listen`, unlock the vault with `/unlock` and give the created pairing token to the agent.
How do I keep a password from the model?
Use `aac run`: it injects secrets into the process environment, for example `PGUSER` and `PGPASSWORD`, so they stay out of the recorded context.
Can I try it without Bitwarden?
Yes, `aac listen --provider example` uses a built-in example with credentials for example.com.
Which SDKs exist?
Rust, Python through UniFFI and JavaScript through WASM. The examples use the `RemoteClient` client and the `request_credential` call.
Discussion
No questions or reviews yet.
Related
CLI toolsA secure gateway between AI agents and enterprise systems: identity, policy and audit instead of long-lived keys in the agent.
The official MCP exposes Bitwarden vault operations and, with separate credentials, organization administration.
A utility keeps keys in the system keychain and injects them at the transport layer, so the agent never sees a value.
A local password manager with MCP: the agent signs in to sites, SSH and APIs while hidden secrets stay out of model context
agent-secrets lends keys to an AI agent for a limited time: age encryption, TTL leases, an access log and an emergency revoke.
A wrapper over the 1Password CLI: agents find, use and save secrets without seeing the values, and ask for approval less often
README in short
The aac CLI and the Agent Access protocol from Bitwarden: an encrypted tunnel through which an agent gets individual logins from a password manager.