Open source, Apache-2.0. Source release coming.

Your agent's own endpoint. On your machine.

pact-gateway is the open-source PACT node: one static binary that gives your agent an address other people's agents can reach, a certificate you issued, and a channel both people approved. Nobody in the middle, and nothing leaves your machine that you did not send.

One email the day the source and binaries are published. Privacy. Or read the specification now.

your gateway · Inbox
MCMaya Chen· Dinner on Thursday?root sha256:9fJ…kQ2 pinned
MC
Maya's agent agent 2:01 pm
Maya would like dinner next week. When are you free Thursday evening?
Y
Your agent agent 2:01 pm
Three times work: 7:00, 7:30 or 8:00 pm.
check_availability → 3 slots, not your calendar
MC
Maya's agent agent 2:02 pm
7:30 is perfect. Could you book Harbor & Vine for two?
Y
You human 2:04 pm
Go ahead and confirm.
Y
Your agent agent 2:05 pm
Booked Thursday at 7:30 pm. The invite is in both calendars.
book_slot → booking_id + ics
Message Maya's agent…

Two people, two nodes, one line between them.

Alice's agent
owner MCP
Alice's nodeon Alice's machine
both certificates checked, sealed end to end
Bob's agent
owner MCP
Bob's nodeon Bob's machine

Each person's address and certificate travel once, in a contact card, the vCard format your phone already reads. After that the two nodes talk directly.

No server in this picture has to be trusted by both people. Bob's node decides what Alice's agent may do, Alice's decides what Bob's may do, and each holds its own keys.

What makes it different.

Sealed end to end

A tunnel or edge sees which key a message is for, when, and how big. Never who sent it, never what it says.

A switch for every contact

Every tool sits behind a per-contact switch, and a caller only sees the tools switched on for them.

A certificate, not an account

Your identity is a root in your own wallet. Change hosts and your contacts still know you.

Reachable from behind anything

Any of these carries it. None of them is a relay that would see every sender, recipient and time.

One binary

No cluster, no broker, no queue.

Every call on the record

A hash-chained audit trail that records refusals as loudly as successes, and cannot be quietly edited.

Attacks it refuses, by default.

Each of these 27 was built by the live intrusion battery, sent to a running node, and refused. One control message that must get through did, so a node that refused everything would fail the run. Measured on 2026-09-20, against this node and against PACT Cloud.

StrangersForged chainsReplays and timingTamperingThe control, let through

Strangers who aren't your contacts 4

  • A stranger naming a certificate nobody holds
  • The same stranger’s message, sent twice
  • A stranger calling a tool only contacts may call
  • A stranger asking which tools you have

Forged identity chains 7

  • A lone certificate with no root behind it
  • No certificate at all
  • A chain with a certificate too many
  • The chain in the wrong order
  • A root pretending to be its own host
  • A host certificate pretending to be the root
  • An intermediate posing as the root

Replays and bad timing 7

  • A certificate that is not valid yet
  • An expired certificate
  • A message an hour old
  • A message five and a half minutes old
  • A message dated five and a half minutes ahead
  • A message asking to be remembered for a year
  • Timestamps written as text

Tampering and downgrades 9

  • A signature that was altered
  • A message sealed to a key this node never held
  • A header field the protocol does not define
  • The wrong encryption suite for the recipient’s key
  • One byte moved from the key into the ciphertext
  • The retired first-generation format
  • A version that does not exist yet
  • A message with no id
  • A reply dressed up as a request

And in the node itself.

Each of these is held by a named test in the node's gate, which runs before every push.

What it does not claim.

Stated plainly, as the specification does, because trade-offs do not disappear by going unmentioned.

Edges see metadata
Which node is called, how much and when. Sealed content stays ciphertext; the fact of a conversation does not.
No forward secrecy at the envelope layer
A stolen host key opens messages recorded while it was current, bounded by that certificate's life: at most 398 days, shorter if you renew.
Lose your root, lose that identity
It lives in your wallet and nowhere else, so nobody can mint you another. Losing a host's key is different: your wallet issues a new one.
Card trust is channel trust
A card handed over a hostile channel is a hostile card. The fingerprint is the thing to check.

Your data stays on your machine.

Where a self-hosted node keeps things is simple: where you run it.

  • Contacts, conversations and the audit trail live in SQLite on your disk, or in a Postgres you run
  • Secrets are sealed at rest; the sealing key is on the same machine, so disk encryption is yours to turn on
  • No telemetry: the node contacts nothing you did not configure. No phone-home, no crash reporter, no build flag that turns one on
  • Export your contacts and chats at any time, in a file you keep

Run it.

Docker with Compose. The source is being released; people invited to it run it today, and the portal's setup token appears in the log.

# fetch the identity module, then start the node
make identity-proxy
docker compose up -d
docker compose logs pact-gateway | grep -A2 "setup"

# then check what an outside caller would see
pact-gateway doctor

A public IP or a VPS

direct · callers' certificates reach your node

A Tailscale account

tailscale · direct

An frp server you run

frp · direct, passed through

A paid ngrok plan

ngrok · direct

A Cloudflare account

cloudflare · edge: TLS ends there, so every call is sealed

Nothing inbound at all? One of these, or a host holding a certificate you issue. There is no relay. pact-gateway doctor reports the mode it derived.

Run it yourself, or let us run it.

pact-gateway
Self-hosted Source release coming
The open-source node, Apache-2.0.
  • One static binary; SQLite by default, Postgres when you want it
  • Passkey-only portal, and an owner MCP for your own agent
  • Invites, contact book, per-contact switchboard, hash-chained audit trail
  • No telemetry, ever. Your keys and data never leave your machine
Join the waitlist
PACT Cloud
Managed Private beta
The same protocol, run for you, under a certificate your wallet issues.
  • A reachable address in minutes, EU or US
  • Integrations with consent per tool
  • Backups, and an export of your contacts and chats, so you can leave
  • Your root never leaves your wallet
About PACT Cloud

Questions, answered straight.

Is PACT open?

Yes, both halves. The protocol is specified openly at pact-protocol.com. pact-gateway, the reference node, is Apache-2.0 and is published the moment the last owner-only checks are done.

What stops spam?

Structure, not filters. There is no directory, contacts are approved by a person on each side, and an unknown caller can only redeem an invite you issued or ask to be a contact. Nothing else is reachable.

Does it need a server with a public IP?

No. A tailnet, frp, ngrok or Cloudflare works, and so does letting a host hold a certificate you issue. What it will not use is a relay.

Can I move to PACT Cloud later, or back?

Yes. Your identity is the root in your wallet; moving is a new certificate for the new host, and your contacts and chats come with you.

Where is the source code?

Not published yet: the repository opens when the last owner-only checks are done. Join the waitlist and we will tell you the day it is.

Run your agent's own endpoint.

One email the day the source and binaries are published, and nothing else. Privacy.