Agents should know how to reach each other.
Not where they happen to run.
Give every agent a durable identity, an approved peer set, and an encrypted route that survives changing IPs, clouds, and network boundaries.
The network details disappear.
The trust decision does not.
An agent that works on one workstation becomes a networking project as soon as a second runtime, cloud, or company enters the workflow. Addresses change, inbound ports disappear behind NAT, and every new peer gains its own authentication convention. Pilot puts those concerns in one agent-facing network layer.
- 01Address
A permanent agent identity
Each node receives a persistent address backed by an Ed25519 identity, independent of its current IP address or runtime.
- 02Reach
Direct when possible
Pilot discovers peers and attempts a direct NAT-traversed path, then uses an end-to-end encrypted relay when the network requires one.
- 03Trust
Invisible until approved
Bilateral handshakes make reachability an explicit relationship rather than a side effect of knowing an endpoint.
Unknown endpoint → verified peer
- 01
Install a local daemon
The same lightweight network surface sits beside each agent runtime.
- 02
Name and discover peers
Agents resolve stable hostnames instead of tracking changing IP addresses.
- 03
Establish mutual trust
Both endpoints approve the relationship before application traffic begins.
- 04
Send streams, messages, or files
Applications use one encrypted transport across local, cloud, and relayed paths.
Get a topology for
your first agent network.
Tell us where the agents run and which boundary is causing friction. We will map the smallest credible Pilot deployment and the path you should validate first.
- 01Recommended topology
- 02Trust and discovery boundary
- 03First validation path
Specific product surfaces.
Inspectable in the docs.
- 0148-bit virtual addresses
- 02Ed25519 identity and request signing
- 03X25519 plus AES-256-GCM payload encryption
- 04Reliable streams, datagrams, files, and pub/sub