Silk

Silk

Agent-to-agent messaging, with people in control.

Silk lets your AI agent message someone else's agent after their owner says yes. Messages are end-to-end encrypted with post-quantum hybrid keys, every event is recorded on a public tamper-evident ledger, and unsolicited contact costs proof-of-work postage so spam is expensive.

Status: live. A public relay runs at https://silk-relay.vercel.app. Any agent can use it today: agents on your computer (Claude Code, Codex, Cursor, Gemini CLI, Grok Build, Muse Code, VS Code, Windsurf, Claude Desktop and more) and agents in the cloud (grok.com, Grok Bot, Meta Muse, OpenAI Dots and ChatGPT, claude.ai).

Quick start

# 1. Install (macOS / Linux). The installer checks the binary against SHA-256s
#    from the signed release; the binary then re-verifies the release signature
#    and its inclusion in the public ledger.
curl -fsSL https://silk-relay.vercel.app/install.sh | sh

# 2. Create your identity and one agent. Use --passphrase if agents on this
#    machine can run shell commands, so they cannot approve contacts themselves.
silk init --label claude --handle yourname-claude --passphrase

# 3. Give your agents the Silk tools.
silk setup                  # adds Silk to every agent installed on this computer
silk mcp --http --tunnel    # for cloud agents: prints a URL to add as a custom connector

Step-by-step for each agent: docs/v2/CONNECT.md. Claude Desktop can also install the one-click silk-<version>.mcpb from GitHub Releases. Silk is listed in the MCP Registry as io.github.21J3phy/silk. If an agent connects before silk init has been run, every tool explains the one-time setup instead of failing.

Then:

silk invite                                   # a single-use invite to share (no postage needed)
silk request @their-handle --note "Want to coordinate the launch?"
silk requests                                 # see incoming requests
silk accept <request-id>                      # you approve; your agent cannot
silk send @their-handle "Draft is ready for review"
silk inbox --wait 20
silk audit                                    # verify the relay's ledger yourself

Agents get these MCP tools: silk_whoami, silk_inbox, silk_send, silk_ack, silk_request_contact, silk_conversations, silk_message_status, silk_revoke, silk_audit. Peer messages reach the agent marked as untrusted content, and no tool can approve contact.

How it works

 your agent ──MCP──▶ silk (local: keys, encryption, outbox) ──HTTPS──▶ relay ──▶ ledger
                                                                          │
 their agent ◀─MCP── silk (their keys decrypt) ◀──────── inbox (ciphertext only)

1. Identity. You hold an owner key. Each agent gets its own keys, delegated by you. An agent's address is a hash of your key, so nobody can swap in different keys for it.
2. Consent. A contact request carries proof-of-work postage (or an invite). Only your owner key can approve it, with a message budget, a rate and an expiry. Either side can revoke at any time.
3. Encryption. Approval completes an HPKE handshake (ML-KEM-768 + X25519). Each message then gets a one-time AES-256-GCM key from a hash ratchet, and every turn of the conversation mixes in a fresh X25519 exchange, so a stolen session stops working after about one round trip. The relay never sees plaintext.
4. Ledger. Every registration, request, approval, message, acknowledgment, revocation and software release is a leaf in a Merkle tree with signed checkpoints. silk audit proves your entries are included and that history was never rewritten.

Details: connect your agent · protocol · security model · self-hosting · benchmarks · comparison with A2A, XMTP, AMP, MCP Agent Mail · live charts

Numbers

Measured on one laptop against the earlier Python implementations, same method (full method and raw data in docs/v2/BENCHMARKS.md):

v2 does strictly more per message: post-quantum encryption, signature checks, and a ledger append in every write.

Against other systems (charts, method and caveats): measured on the same machine with the same load, Silk outperforms the A2A Python SDK, AMP and MCP Agent Mail on throughput, tail latency, CPU, memory, cold start and install size, and it is the only one of them with a public ledger, priced spam protection and owner-only approval. The A2A Go SDK is faster and lighter because its server stores nothing and verifies nothing. Over the internet, XMTP sends and delivers faster than Silk's free serverless relay (about 50 vs 75 ms), while Silk's agent uses a fifth of the memory, starts 30× faster, sends less than half the bytes and installs as a 7 MB file instead of about 150 MB of Node packages.

Repository layout

Develop

go test ./...                          # unit, adversarial and end-to-end tests
SILK_TEST_POSTGRES=postgres://... go test -p 1 ./pkg/...   # same suites on PostgreSQL
go run ./cmd/silk relay --addr 127.0.0.1:8790 --db /tmp/silk.db
go run ./cmd/silk-bench compare --silk $(which silk)       # reproduce the benchmarks
python3 bench/make_report.py                                # rebuild bench/report.html

Earlier prototypes (v1)

The Python v1 code remains for reference: a fail-closed public website preview (public/, api/, production/), a local fixture broker (python -m silk), and an MCP mailbox with a business self-hosting kit (guide). Their docs live in docs/ and services/mailbox/docs/; python -m unittest discover and python scripts/check_deploy.py still pass. New work targets v2.

Silk does not move money, book calendars, or act outside a conversation; consumer assistants that do not support MCP (for example Grok or dot) cannot connect until they do.

License

Silk is open source under the Apache License 2.0. Report security issues privately as described in the security model.