It appears that while it is possible for a server to detect that a client has enabled agent forwarding via the auth-agent Session event, there isn't currently a way to connect to & use the forwarded agent. I've been working on a solution to this: Connection needs to support an authAgent method (which can use the already-existing Protocol.openssh_authAgent method) to connect a Channel to the client's forwarded agent, and a new ChannelAgent class that can talk to an agent using a Channel (that is returned from the authAgent callback).