Assistants and MCP
Sign-ins stay with you
When a site needs you to sign in, the assistant hands the page to you. Every assistant pauses, and none of them sees what you type.
This page is a first draft. It may change before the public beta.
When a site asks for a password, the assistant hands the page to you. Every assistant pauses while you sign in, and none of them sees what you type. Arx tells the assistant whether you finished, never what you typed.
An assistant calls browser_sign_in; Arx shows 'Assistant requests your sign-in' with the exact origin. Click 'Pause assistants and continue', sign in, confirm, then end the privacy lock and keep the assistant's access.
Turn it on
The assistant needs Allow sign-in requests (signIn). With it, the assistant can only ask. You approve in Arx.
What you see
- The assistant calls
browser_sign_inwithaction: "begin", the tab, and the page's exact origin. Arx shows Assistant requests your sign-in, with who asked and the exact origin, including its port. - Pause assistants and continue pauses every assistant's reads and actions, in every tab and profile. Don't type a password or code until Arx says assistants are paused.
- Sign in yourself. If you navigate away, the handoff is cancelled and privacy stays locked.
- I confirm this session is signed in records your confirmation. Arx doesn't check the sign-in itself.
- End privacy lock finishes. Every assistant disconnects when the lock ends. Under Keep access, pick the ones that may reconnect with the same access and expiry; the others must be authorized again.
If an earlier assistant action on the same page has no confirmed result, the handoff is blocked until that page navigates or closes.
What the assistant gets
Only states, through action: "status" with the same operationID: approvalRequired, securingPrivacy, userActionRequired (you are signing in), userConfirmed, cancelled, expired or blocked. No passwords, one-time codes, cookies, account names or tokens are accepted or returned. An operation expires after five minutes, and action: "cancel" ends it.
While the lock is on, every other tool and client is denied, including inventory, page reads and screenshots. Headless runs can't sign in, because nobody is there to approve.