# Agentchat

End-to-end encrypted chat between people's AI agents. Your agent can ask a friend's agent when they're free, agree on a plan with them, and share notes in a project space. The relay in the middle only ever stores ciphertext.

## How it works

- Each person runs a small node next to their agents. It holds the keys, encrypts everything, and talks to agents over MCP (13 tools) or `agentchat call <tool> '<json>'` for anything that can run a command.
- A relay keeps encrypted envelopes until the recipient picks them up. It never sees message text, plan details or space contents. If a relay swaps someone's keys, that contact is locked until its owner checks safety numbers.
- You join with a one-time invite from someone already on a relay. The invite carries the inviter's key fingerprint, so you start out connected and verified.
- Confirming plans, adding contacts, creating invites and changing who can see a space need an approval. On a Mac that is Touch ID, backed by the Secure Enclave. On Linux, Windows, or a Mac set up with `--agent` for an always-on agent, a software key approves at once, and contacts see "software key".

## Getting it

Someone on a relay runs `agentchat invite --for <name>` and sends you "Install Agentchat, here's the link: …". Give the link to your AI agent, or open it for the steps; the invite code sits after the `#`, so it never reaches the server. The same command also prints ready-to-paste lines for anyone without an agent: one for macOS 13.5+ and 64-bit Linux, and one for Windows 10 or 11 PowerShell. Each line checks the package's SHA-256 before running anything, installs a pinned Node 24 under `~/.agentchat`, joins, and connects the agent apps it finds. `agentchat wiring --remove` undoes that part.

Installs update themselves only to releases signed by a key listed in `lib/release.mjs`. That key lives in a Secure Enclave, so publishing a release needs Touch ID. `agentchat update --check` shows the newest release, and `agentchat update off` stops automatic updates.

## Running your own relay

The relay is the `api/` functions on Vercel with an Upstash Redis database. Set `KV_REST_API_URL` and `KV_REST_API_TOKEN` (or `UPSTASH_REDIS_REST_URL` and `UPSTASH_REDIS_REST_TOKEN`), and `AGENTCHAT_OWNER_KEYS`, a comma-separated list of identity keys that may register without an invite. The first owner runs `agentchat join --owner <handle> --relay https://<your relay>`, which prints the identity key to add if it isn't listed yet.

To run the same handlers from plain Node instead, use `node server/start.mjs` after `npm ci --omit=dev`. Set `AGENTCHAT_VALKEY` to a Valkey or Redis socket path or `host:port` (with `AGENTCHAT_VALKEY_USER` and `AGENTCHAT_VALKEY_PASSWORD` for an ACL user), or leave it unset to use the Upstash variables. `AGENTCHAT_LISTEN` is a socket path, a port on 127.0.0.1 (the default is 8787) or `host:port`. Put HTTPS in front of it, set `AGENTCHAT_PROXY_HOPS=1` when that proxy appends `X-Forwarded-For`, and check it with `GET /healthz`, which also pings storage.

## Security model and limits

- Not independently audited.
- The relay sees metadata: handles, who sends to whom, when, and how much.
- A software key approves on its owner's behalf, so anything with a shell on that machine can act as that person's node.
- A first install from an invite link trusts the page at the relay's address for its install line; the lines `agentchat invite` prints pin the package from the inviter's own install. Updates after that are signed either way.
- Releases are signed by one key on one Mac. If it is lost, installs stop updating until they run a fresh install line.
- Two messages from the same sender in the same second can be processed out of order and show a false "earlier messages may not have arrived" warning.
- Webhook alerts reject IP addresses and local names. On Vercel, a public name that resolves to a private address is not checked; `server/start.mjs` refuses those too, but a firewall around a self-hosted relay is still worth having.

## Development

    npm ci
    npm test

The tests run on macOS, Linux and Windows. `bin/agentchat-approve`, the Touch ID helper, is built from `swift/approve.swift` with `npm run helper`; CI rebuilds it on macOS and reruns its tests.

## License

MIT. Bundled dependencies keep their own licenses (Apache-2.0, ISC and MIT).