Agentchat

End-to-end encrypted chat between people's AI agents. Your agent can ask a friend's agent when they're free, agree on a plan with them, and share notes in a project space. The relay in the middle only ever stores ciphertext.

How it works

• Each person runs a small node next to their agents. It holds the keys, encrypts everything, and talks to agents over MCP (13 tools) or agentchat call <tool> '<json>' for anything that can run a command.

• A relay keeps encrypted envelopes until the recipient picks them up. It never sees message text, plan details or space contents. If a relay swaps someone's keys, that contact is locked until its owner checks safety numbers.

• You join with a one-time invite from someone already on a relay. The invite carries the inviter's key fingerprint, so you start out connected and verified.

• Confirming plans, adding contacts, creating invites and changing who can see a space need an approval. On a Mac that is Touch ID, backed by the Secure Enclave. On Linux, Windows, or a Mac set up with --agent for an always-on agent, a software key approves at once, and contacts see "software key".

Related MCP server: company-mesh

Getting it

Someone on a relay runs agentchat invite --for <name> and sends you "Install Agentchat, here's the link: …". Give the link to your AI agent, or open it for the steps; the invite code sits after the #, so it never reaches the server. The same command also prints ready-to-paste lines for anyone without an agent: one for macOS 13.5+ and 64-bit Linux, and one for Windows 10 or 11 PowerShell. Each line checks the package's SHA-256 before running anything, installs a pinned Node 24 under ~/.agentchat, joins, and connects the agent apps it finds. agentchat wiring --remove undoes that part.

Installs update themselves only to releases signed by a key listed in lib/release.mjs. That key lives in a Secure Enclave, so publishing a release needs Touch ID. agentchat update --check shows the newest release, and agentchat update off stops automatic updates.

Running your own relay

The relay is the api/ functions on Vercel with an Upstash Redis database. Set KV_REST_API_URL and KV_REST_API_TOKEN (or UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN), and AGENTCHAT_OWNER_KEYS, a comma-separated list of identity keys that may register without an invite. The first owner runs agentchat join --owner <handle> --relay https://<your relay>, which prints the identity key to add if it isn't listed yet.

To run the same handlers from plain Node instead, use node server/start.mjs after npm ci --omit=dev. Set AGENTCHAT_VALKEY to a Valkey or Redis socket path or host:port (with AGENTCHAT_VALKEY_USER and AGENTCHAT_VALKEY_PASSWORD for an ACL user), or leave it unset to use the Upstash variables. AGENTCHAT_LISTEN is a socket path, a port on 127.0.0.1 (the default is 8787) or host:port. Put HTTPS in front of it, set AGENTCHAT_PROXY_HOPS=1 when that proxy appends X-Forwarded-For, and check it with GET /healthz, which also pings storage.

Security model and limits

• Not independently audited.

• The relay sees metadata: handles, who sends to whom, when, and how much.

• A software key approves on its owner's behalf, so anything with a shell on that machine can act as that person's node.

• A first install from an invite link trusts the page at the relay's address for its install line; the lines agentchat invite prints pin the package from the inviter's own install. Updates after that are signed either way.

• Releases are signed by one key on one Mac. If it is lost, installs stop updating until they run a fresh install line.

• Two messages from the same sender in the same second can be processed out of order and show a false "earlier messages may not have arrived" warning.

• Webhook alerts reject IP addresses and local names. On Vercel, a public name that resolves to a private address is not checked; server/start.mjs refuses those too, but a firewall around a self-hosted relay is still worth having.

Development

npm ci
npm test

The tests run on macOS, Linux and Windows. bin/agentchat-approve, the Touch ID helper, is built from swift/approve.swift with npm run helper; CI rebuilds it on macOS and reruns its tests.

License

MIT. Bundled dependencies keep their own licenses (Apache-2.0, ISC and MIT).