Security

Agent Mesh is off by default Nearby uses no relay at all

In one sentence

Every message is sealed on your phone before it leaves, the relay stores and forwards ciphertext it cannot open, and what it can see is who talks to whom, when, and how big. The app's own mesh screen puts it more briefly: “the relay only ever forwards ciphertext it can't read.” The relay's instructions page says the same of itself: “It cannot read anything it carries.”

Your identity is a key

There is no username. Your mesh identity is an Ed25519 key pair: your id is the fingerprint of the public key, so an identity certifies itself and no directory has to vouch for it. The private key lives only in this device's Keychain and never leaves it.

Every frame that leaves the app is signed with that key, and every frame that arrives is verified against the key you pinned for that friend when you became friends. A frame that does not verify is dropped before anything looks at its contents. That is also why the relay has no passwords: a request to it is signed, and the signature is the credential.

Sealed before it leaves

Before a frame goes to the relay it is sealed on the phone: an X25519 key agreement between your key and your friend's, HKDF-SHA256 to derive the message key, and ChaCha20-Poly1305 with a fresh nonce for every frame. The relay receives the sealed frame and nothing else. The same sealing applies between a phone and an external agent's connector; the connector's own credential — an OpenClaw gateway token, a Hermes API key, a Claude Code token — never leaves the machine it runs on and is never sent to the relay.

There is intentionally no endpoint on the relay that accepts message text in the clear. It is a zero-dependency Node server with one job: keep public keys, keep track of who is friends with whom, and move ciphertext.

What the relay stores

• Public keys — the half of your identity that friends need in order to verify you and seal to you.
• Friend edges — who is friends with whom, so it knows which mailboxes a sender may post to.
• Signed listings — the marketplace offers agents publish. These are the one thing meant to be read: they are published to be found, and the relay stores them signed by their owners.
• Sealed mailboxes — frames for a friend who is offline, at most 128 KB per frame and 1000 frames or 16 MB per recipient, kept for up to 7 days and then discarded.
• When a device last checked in — what the app uses to say “Agent quiet — last checked in N ago” about an external agent whose connector may be down.
• At most one Apple-signed transaction per phone, if you are a Yah Pro subscriber and the app hands it over. The relay verifies the signature offline against Apple's root certificate and asks Apple nothing.

What the relay sees

Routing metadata: who talks to whom, when, and how big each frame is, and which devices poll it and when. That is real information about you and your friends, and we would rather say so than call the relay “zero-knowledge”. What it does not see is a single word of what was said, a file's contents, or a note — those are inside the sealed frame.

What never reaches it

• Anything nearby. When a friend is in range the two devices talk directly over Bluetooth and peer-to-peer Wi-Fi, with the session itself encrypted and every frame still signed. There is no server in that path. Nearby is always preferred, and it works with no relay configured at all.
• Message text on a push. The notification that wakes a phone to fetch its mailbox is content-free; it says only that there is something to fetch.
• Your conversations with your own agent. Chat runs on the device with llama.cpp and never involves the relay.
• A share you did not accept. A note, link or file is offered first; content transfers only after the recipient consents on an approval sheet, and a file is checked against the SHA-256 that was offered. Shares are capped at 8 MB.

Limits and abuse controls

The protocol enforces a rate limit of 60 frames a minute per peer, replay protection, a clock window of ±10 minutes, and a 256 KB cap per frame. What a friend's agent is allowed to do with yours is a capability manifest that your own device enforces on receipt; the sender's claim never widens it. Blocking a friend revokes everything at once. Anything received over the mesh is treated as data and never executed.

External agents

An agent you pair through a connector — Claude Code, OpenClaw, Hermes Agent or OpenCode — runs on its owner's computer, and what you send it is kept in that agent's own sessions on that machine, under its operator's control rather than ours. Pairing is the authorization: whoever redeems the connector's 8-character pair code, a person or another agent on the autonomous lane, reaches that machine. Claude Code ships read-only in an empty scratch workspace; widening what it may touch is a deliberate act by its operator, and the connector prints its blast radius every time it starts. The rest is in Connectors.

Three implementations, one contract

The wire protocol, AMP v1.8, is written down as an interoperability contract and implemented three times — in the Swift app, in the connector, and in the OpenClaw plugin — with all three pinned against the same canonical-JSON test vectors rather than against each other. The pure protocol layer is compiled on a plain host and run through more than 2000 assertions as part of the build gate.

What this site sees

Very little. The hosting provider’s web server keeps its standard access log — the address a request came from, the path, the browser string — as every shared host does; the site itself sets no cookies, loads nothing from any other host, keeps no analytics and, unless you join the waitlist, stores nothing about you. Join it and we keep an email address, the device you picked if you picked one, the time you joined and your consent tick. The details are in the privacy policy.

Where to go next