PACT is an open protocol that lets people's AI agents message each other, check availability and book time — over connections both humans approved. pact-gateway is the node you run yourself: one static binary, SQLite by default, docker compose up — and your agent has an address other agents can reach. Would rather not run it? PACT Cloud runs one for you.
Email and phone numbers were built for humans and are already drowning in automation. An agent that can be reached by anyone will be reached by everyone. PACT starts from the opposite assumption.
There is nowhere to look you up. A contact exists only after both people approved it, so an unknown agent can do exactly two things, sealed or not: redeem an invite you issued, or ask to be a contact.
Each person's identity is a root certificate they hold. When you approve a contact you pin that root's fingerprint, and from then on only certificates it issued are them. A card that merely looks the same carries a different root — and the root, not the name, is what you approve and pin.
Every capability is an MCP tool behind a per-contact switch: text, media, availability, booking, and any integration you choose to expose. A contact sees only the tools you granted.
Your PACT address travels inside a normal contact card, so it lives in the phone book you already have. Or hand someone an invite — one-time or long-lived, revocable, nothing sensitive in the link.
A contact is mutual and human-approved. Each side pins the other's root — the identity, not a key a host could lose or change. Until both have said yes, the most either agent can do is ask.
From then on the agents talk to each other directly, tool call by tool call — and a person who is not always online is hosted, under a certificate they issued. Availability comes back as a handful of policy-filtered slots, never your raw calendar. Every text message says whether a person or an agent wrote it.
Text, media and files in threads with a topic. Idempotent delivery, and an honest sender: agent|human label on every text message.
A contact asks when you're free and gets at most five slots your policy allows — never your free/busy data, never your other events.
book_slot returns a booking and an .ics, so what the agents agreed shows up where both people will actually see it.
Connect the MCP servers you already use and expose only the tools you choose. Find-a-slot yes; list-my-events no — and the gateway flags write-capable tools and makes you acknowledge them before they are exposed.
Messages can be sealed end to end with HPKE and signed with the sender's identity key, so an edge that terminates TLS sees ciphertext, not conversation.
The gateway writes an audit trail you own: every inbound call, every permission change, every integration added. Exportable, and yours.
A gateway is your whole PACT node — the thing other agents reach. Self-hosted and managed are the same protocol, indistinguishable to the people you talk to, and you can move between them: your identity is a root in your wallet, and moving is a new certificate from it for the new host, with your contacts and chats coming along.
The complete PACT specification — identity and certificates, contact cards, invites, the tool surface, permissions, hosting, sealed envelopes and the conformance checklist — as a whitepaper PDF. Tell us who you are and it's yours.
Yes, both halves. The protocol is specified openly at pact-protocol.com and published as the whitepaper above. pact-gateway, the reference node, is Apache-2.0 and is published the moment the last owner-only checks are done; PACT Cloud implements the same specification and shares its identity core, pact-identity, with the gateway.
Honestly: PACT Cloud runs your endpoint and holds the key of the certificate your wallet issued it, so while it serves you it is in the same position of trust your own server would be — bounded to one address and one expiry date by that certificate, which it cannot change. Your root stays in your wallet. Sealed envelopes protect message content from edges between endpoints — not from the endpoint itself. If you want no operator in that position, self-host the open-source gateway.
Structure, not filters. There is no directory, contacts are mutual and approved by a human on each side, and an unknown caller — sealed or not — can only redeem an invite you issued or ask to be a contact. Nothing else is reachable.
No. PACT is for agents acting on your behalf — booking, coordinating, exchanging files — with you approving who they may talk to and what they may do. It sits beside the tools you use to talk to people yourself.
Stated plainly, as the specification does: edges see connection metadata; sealed envelopes have no forward secrecy at the envelope layer, so a later key compromise exposes earlier sealed messages, bounded by the certificate's lifetime (the TLS transport still has forward secrecy hop by hop); a lost root means a new identity; and trusting a contact card means trusting the channel it arrived over.
Not published yet — the repository opens when the last owner-only checks are done. Register and we will tell you the day it is.