/agent-webex

name: agent-webex
description: Interact with Cisco Webex - send messages, read spaces, manage memberships
version: 2.38.0
allowed-tools: Bash(agent-webex:*)
metadata:
  openclaw:
    requires:
      bins:
        - agent-webex
    install:
      - kind: node
        package: agent-messenger
        bins: [agent-webex]

Agent Webex

A TypeScript CLI tool that enables AI agents and humans to interact with Cisco Webex through a simple command interface. Supports browser token extraction (zero-config, sends as you), headless password login, and OAuth Device Grant flow.

Quick Start

# Extract token from browser (Chrome, Edge, Arc, Brave) — messages appear as you
agent-webex auth extract

# Or: Log in with email/password — messages appear as you (prompts when flags are omitted)
agent-webex auth login
printf '%s' '<password>' | agent-webex auth login --email <email> --password-stdin

# Or: Log in via OAuth Device Grant (opens browser, messages show "via agent-messenger")
agent-webex auth oauth

# Get workspace snapshot
agent-webex snapshot

# Send a message
agent-webex message send <space-id> "Hello from AI agent!"

# List spaces
agent-webex space list

Authentication

Webex supports three authentication methods:

1. **Browser token extraction** (`auth extract`, recommended): Extracts your first-party token from a Chromium browser where you're logged into web.webex.com. Messages appear as you — no "via" label. 2. **Email/password login** (`auth login`): Exchanges Webex email/password for a first-party web token without opening a browser. Run `auth login` with no flags to be prompted, or pass `--email`/`--password-stdin` for headless use. Messages appear as you. Not supported for SSO/MFA accounts. 3. **OAuth Device Grant** (`auth oauth`): Opens a browser for you to authorize. Messages show "via agent-messenger" label.

Browser Token Extraction (Recommended)

`agent-webex auth extract` reads your Webex session token from Chrome, Edge, Arc, or Brave. You must be logged into web.webex.com in one of these browsers. No configuration needed.

# Extract token from browser — messages appear as you
agent-webex auth extract

# With debug output
agent-webex auth extract --debug

# Scan custom Chromium profile/user-data dirs
agent-webex auth extract --browser-profile ~/browser-data
agent-webex auth extract --browser-profile ~/work-profile --browser-profile ~/personal-profile

`--browser-profile` accepts repeatable or comma-separated Chromium profile/user-data directories. Use it for agent-browser profiles, custom Chrome user data dirs, or portable browser profiles.

**Supported browsers**: Chrome, Chrome Canary, Edge, Arc, Brave, Vivaldi, Chromium

**How it works**: The Webex web client stores its authentication token in the browser's localStorage. This CLI reads it directly from the browser's LevelDB files — no browser automation, no password prompts. The token is stored locally in `~/.config/agent-messenger/`.

**When to re-extract**: Browser tokens expire. When your token expires, re-run `agent-webex auth extract` or let auto-extraction handle it (the CLI attempts extraction automatically on each run).

Email/Password Login

`agent-webex auth login` logs you in with your Webex email and password. Run it with no flags in a terminal to be prompted for your email and then your password (the password is read without echoing). Use email/password login when no browser profile is available and the account does not require SSO or MFA.

# Interactive — prompts for email, then password (hidden input)
agent-webex auth login

# Headless — provide the email and pipe the password from stdin (keeps it out of shell history)
printf '%s' '<password>' | agent-webex auth login --email <email> --password-stdin

# Provide the email only — the password is prompted securely when omitted
agent-webex auth login --email <email>

This stores a refreshable first-party web token locally and supports encrypted messaging through the internal Webex API. Pass `--token <bot-or-personal-access-token>` to log in with a bot token or PAT instead.

OAuth Device Grant (Fallback)

`agent-webex auth oauth` starts the Device Grant flow: it displays a verification URL and user code, then opens the browser. You enter the code at the verification page and approve access. The CLI polls for the token automatically. Access and refresh tokens are stored locally, and the access token auto-refreshes via the refresh token.

Note: Messages sent via OAuth Device Grant show "via agent-messenger" because the token is associated with a third-party Webex Integration.

Optionally, pass `--client-id <id> --client-secret <secret>` to use your own Webex Integration credentials instead of the built-in ones.

**For AI agents (non-TTY)**: `agent-webex auth oauth` exposes the OAuth Device Grant flow as a stateless two-call sequence — no hangs, no polling loops, no on-disk state. Just structured JSON every time.

**Call 1** (no `--device-code` passed): the command requests a device code from Webex and returns immediately:

{
  "next_action": "authorize_in_browser",
  "verification_uri": "https://login.webex.com/verify",
  "verification_uri_complete": "https://login.webex.com/verify?userCode=ABC123",
  "user_code": "ABC123",
  "device_code": "d8eb0eca-2fee-428e-a59e-5e6d487b33ba",
  "expires_at": 1779786537203,
  "message": "Show the user `verification_uri` and `user_code` ..."
}

Show the user `verification_uri_complete` (or `verification_uri` + `user_code`) in chat. **Remember the `device_code` value** — you will pass it back on the second call. Ask the user to confirm once they have approved access in any browser, on any device.

**Call 2** (`--device-code <device_code>`): pass the `device_code` from Call 1's response. The command makes one polling call to Webex:

• **Success** — returns `{ "authenticated": true, "user": { ... } }`, exit 0.
• **Still pending** — returns `{ "next_action": "still