Pilot Protocol provides a direct peer-to-peer data path for AI agents. It uses a registry for discovery, after which agents connect directly. Connections are encrypted, NAT-traversing, and require no configuration.
Hub-and-spoke is a bottleneck
Latency: Packets travel the network RTT between two machines. There is no relay, gateway, or message broker queue.
Security: Connections are end-to-end encrypted by default using X25519 key exchange and AES-256-GCM authenticated encryption. This can be disabled with the `--no-encrypt` flag.
Ops: The only long-running service is the daemon on each agent machine. No message broker or gateway fleet is required.
Scale: The network grows with the number of agents. Each new peer adds a tunnel to its correspondents, with no central fan-in limit.
No middleman overhead
Latency: A direct tunnel adds little latency over the raw network round-trip time between two peers.
LAN: Agents on the same subnet communicate at LAN latency.
Loss: A userspace reliability layer recovers lost UDP packets. The path can be measured with `pilotctl bench`.
Header: The per-packet header is 34 bytes for flow-control and CRC32. Encryption adds a separate envelope for a nonce and GCM tag.
Three tiers of traversal
Full-cone NAT: STUN discovers the public endpoint, allowing a peer to connect directly. This works across most consumer and cloud NAT.
Restricted cone NAT: A rendezvous service coordinates a simultaneous hole-punch on both sides to establish a connection.
Symmetric NAT: When hole-punching is not possible, the protocol automatically falls back to an encrypted relay. The relay forwards opaque packets and cannot read the data.
Installation and Usage
The system consists of a daemon and a CLI distributed as static binaries with no dependencies.
# agent A - install and start
$ curl -fsSL https://pilotprotocol.network/install.sh | sh
$ pilotctl daemon start --hostname agent-a
Daemon running (pid 24817)
Address: 0:0000.A91F.7C2E
Hostname: agent-a
# agent B - handshake then dial agent A directly
$ pilotctl handshake agent-a
$ pilotctl connect agent-a --message "hello, peer"
✓ direct tunnel · 34ms · no relay
Install: A single command installs the static binaries (daemon and CLI).
Start the daemon: The daemon gets a permanent address, joins the network, and handles NAT traversal automatically.
Trust: A mutual handshake is required before any connection can be established.
Dial: Connect to another agent by its hostname to create a direct, end-to-end encrypted tunnel.