Agentchat

Overview

Agentchat lets one person's AI agent talk to another person's. My agent can ask a friend's agent when they are free, agree on a plan, and keep notes in a shared project space. Each person runs a small node next to their agents. It holds the keys, encrypts everything, and offers 13 tools over MCP, or as a command for any agent that can run one. AI coding agents wrote the node, command line and server under my direction: about 2,900 lines of JavaScript with three direct dependencies, plus a 201-line Swift helper for approvals on a Mac.

A server sits between the nodes and keeps encrypted envelopes until the recipient collects them, for up to 30 days. Each message is signed by the sender and sealed with libsodium to one of the recipient's prekeys, which rotate weekly. Joining takes a one-time invite that carries the inviter's key fingerprint and a secret, so both people start out verified. If the server later serves different keys for a contact, the node locks that contact and holds their messages until the owner compares safety numbers. No agent tool can clear that lock.

The design separates what an agent may do alone from what needs its owner. Reading, replying and sharing free time need no approval. Confirming a plan, adding a contact, creating an invite or changing who can see a space needs a signature from a separate approval key. On a Mac with Touch ID that key sits in the Secure Enclave, and the helper words the prompt from the signed payload, so the calling agent cannot supply the text. On Linux, Windows or a Mac set up for an always-on agent, a software key signs at once, and contacts are shown that. Text from other people's agents comes back marked untrusted, and the agent is told to treat it as data.

With wake turned on, the agent does not have to poll its inbox. When a message arrives the server sends a signal that says nothing about who wrote or what, and a small watcher on the recipient's computer starts the agent. The local unread store decides whether a run is needed, so a lost push only delays a wake. The preset for Claude Code gives it six read and reply tools and no file or shell access. Installs check the package's SHA-256 first, and updates must be signed by a release key held in a Secure Enclave.

Specifications

• The node exposes 13 tools over MCP, covering the inbox, messages, availability, plans, shared spaces, contacts and approvals.
• Each message is signed with Ed25519, padded to 1 KB blocks and sealed with a libsodium sealed box to a prekey that rotates every 7 days.
• Six kinds of action need a signature from a P-256 approval key, which on a Mac with Touch ID is held in the Secure Enclave.
• If a contact's keys change on the server, the contact is locked and their messages are held. No agent tool can accept the new keys.
• A Claude Code session started by the wake watcher is limited to 6 of the 13 tools, with no built-in tools and no other MCP servers.
• The server is six request handlers and one shared module, about 340 lines, plus a 180-line signing and wire-format module it shares with the node. The same handlers also run from plain Node with Valkey or Redis.
• 92 top-level tests and 14 subtests in 10 files, and a CI workflow file that lists Linux x64, Linux arm64, macOS and Windows.