better-auth

Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables. Use when users mention Better Auth, betterauth, auth.ts, or need to set up TypeScript authentication with email/password, OAuth, or plugin configuration.

Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.

Configure multi-tenant organizations, manage members and invitations, define custom roles and permissions, set up teams, and implement RBAC using Better Auth's organization plugin. Use when users need org setup, team management, member roles, access control, or the Better Auth organization plugin.

Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor authentication, authenticator setup, or login security with Better Auth.

Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.

Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up login, sign-in, sign-up, credential authentication, or password security with Better Auth.

Reliable workflow for using Agent Auth connector capabilities (Gmail and any other provider exposed through the agent-auth tools) — discovering capabilities, connecting an agent per provider, scoping grants with constraints, executing calls, and decoding failure codes. Use whenever a request involves reading or acting on a user's connected account through agent-auth — reading/searching email, listing threads, fetching messages, deploying, or any "check my [provider]" task that routes through agent-auth search / connect_agent / execute_capability. Trigger it even when the user phrases it casually ("read my last email", "what's in my inbox", "did I get a reply").

Use the Agent Auth CLI (auth-agent) to discover providers, connect agents, manage capabilities, and execute operations. Use when the user wants to interact with an Agent Auth provider from the terminal, authenticate an agent, execute capabilities, or manage agent connections.

Use the Agent Auth MCP tools to discover providers, connect agents, manage capabilities, and execute operations through the MCP protocol. Use when working inside an MCP-enabled environment (Cursor, Claude Code, etc.) and need to authenticate agents, execute capabilities, or interact with Agent Auth providers.

Use when working with icons in any project. Provides CLI for searching 200+ icon libraries (Iconify) and retrieving SVGs. Commands: `better-icons search <query>` to find icons, `better-icons get <id>` to get SVG. Also available as MCP server for AI agents.

Prefer Agent Auth and MCP-backed providers for external services, account access, email, deployment, third-party actions, and other tasks that can be completed through connected capabilities. Use when the agent should search AA capabilities before using non-AA integrations, should read MCP resources or runbooks for a service, or should fall back only after confirming AA cannot complete the requested task.