pact-gateway — the open-source PACT node

Two people, two nodes, one line between them.

Alice's agent

owner MCP

Alice's nodeon Alice's machine

both certificates checked, sealed end to end

Bob's agent

owner MCP

Bob's nodeon Bob's machine

Each person's address and certificate travel once, in a contact card, the vCard format your phone already reads. After that the two nodes talk directly.

No server in this picture has to be trusted by both people. Bob's node decides what Alice's agent may do, Alice's decides what Bob's may do, and each holds its own keys.

What makes it different.

Sealed end to end

A tunnel or edge sees which key a message is for, when, and how big. Never who sent it, never what it says.

A switch for every contact

Every tool sits behind a per-contact switch, and a caller only sees the tools switched on for them.

A certificate, not an account

Your identity is a root in your own wallet. Change hosts and your contacts still know you.

Reachable from behind anything

Any of these carries it. None of them is a relay that would see every sender, recipient and time.

One binary

No cluster, no broker, no queue.

Every call on the record

A hash-chained audit trail that records refusals as loudly as successes, and cannot be quietly edited.

Attacks it refuses, by default.

Each of these 27 was built by the live intrusion battery, sent to a running node, and refused. One control message that must get through did, so a node that refused everything would fail the run. Measured on 2026-09-20, against this node and against PACT Cloud.

StrangersForged chainsReplays and timingTamperingThe control, let through

Strangers who aren't your contacts 4

A stranger naming a certificate nobody holds
The same stranger’s message, sent twice
A stranger calling a tool only contacts may call
A stranger asking which tools you have

Forged identity chains 7

A lone certificate with no root behind it
No certificate at all
A chain with a certificate too many
The chain in the wrong order
A root pretending to be its own host
A host certificate pretending to be the root
An intermediate posing as the root

Replays and bad timing 7

A certificate that is not valid yet
An expired certificate
A message an hour old
A message five and a half minutes old
A message dated five and a half minutes ahead
A message asking to be remembered for a year
Timestamps written as text

Tampering and downgrades 9

A signature that was altered
A message sealed to a key this node never held
A header field the protocol does not define
The wrong encryption suite for the recipient’s key
One byte moved from the key into the ciphertext
The retired first-generation format
A version that does not exist yet
A message with no id
A reply dressed up as a request

And in the node itself.

Each of these is held by a named test in the node's gate, which runs before every push.

A contact cannot post into another contact's conversation
A contact cannot rename itself once you have pinned it, and the name you gave it is out of every peer's reach
A blocked contact learns nothing a stranger would not
A replayed message is acknowledged, never run twice
Per-contact hourly limits hold on the real listener, not just in unit tests
The audit trail detects tampering, and stays verifiable after old entries are archived
A carrier that terminates TLS cannot forge the other node's answer, or tell whether you know the sender
The parsers that meet untrusted input first are fuzzed on every push

What it does not claim.

Stated plainly, as the specification does, because trade-offs do not disappear by going unmentioned.

Edges see metadata: Which node is called, how much and when. Sealed content stays ciphertext; the fact of a conversation does not.
No forward secrecy at the envelope layer: A stolen host key opens messages recorded while it was current, bounded by that certificate's life: at most 398 days, shorter if you renew.
Lose your root, lose that identity: It lives in your wallet and nowhere else, so nobody can mint you another. Losing a host's key is different: your wallet issues a new one.
Card trust is channel trust: A card handed over a hostile channel is a hostile card. The fingerprint is the thing to check.

Your data stays on your machine.

Where a self-hosted node keeps things is simple: where you run it.

Contacts, conversations and the audit trail live in SQLite on your disk, or in a Postgres you run
Secrets are sealed at rest; the sealing key is on the same machine, so disk encryption is yours to turn on
No telemetry: the node contacts nothing you did not configure. No phone-home, no crash reporter, no build flag that turns one on
Export your contacts and chats at any time, in a file you keep

Run it.

Docker with Compose. The source is being released; people invited to it run it today, and the portal's setup token appears in the log.

# fetch the identity module, then start the node
make identity-proxy
docker compose up -d
docker compose logs pact-gateway | grep -A2 "setup"

# then check what an outside caller would see
pact-gateway doctor

You have	Use
A public IP	`direct`
A tailnet	`tailscale`, with Funnel for the public side
A VPS you already run	`frp`, or the ingress role on your own domain
An account, nothing else	`ngrok` or `cloudflare`
No inbound path at all	a tunnel above, or a host holding a certificate you issue

Run it yourself, or let us run it.

pact-gateway

Self-hosted Source release coming

The open-source node, Apache-2.0.

One static binary; SQLite by default, Postgres when you want it
Passkey-only portal, and an owner MCP for your own agent
Invites, contact book, per-contact switchboard, hash-chained audit trail
No telemetry, ever. Your keys and data never leave your machine

Get notified at release

PACT Cloud

Managed Private beta

The same protocol, run for you, under a certificate your wallet issues.

A reachable address in minutes, EU or US
Integrations with consent per tool
Backups, and an export of your contacts and chats, so you can leave
Your root never leaves your wallet

About PACT Cloud

Questions, answered straight.

Is PACT open?

Yes, both halves. The protocol is specified openly at pact-protocol.com. pact-gateway, the reference node, is Apache-2.0 and is published the moment the last owner-only checks are done.

What stops spam?

Structure, not filters. There is no directory, contacts are approved by a person on each side, and an unknown caller can only redeem an invite you issued or ask to be a contact. Nothing else is reachable.

Does it need a server with a public IP?

No. A tailnet, frp, ngrok or Cloudflare works, and so does letting a host hold a certificate you issue. What it will not use is a relay.

Can I move to PACT Cloud later, or back?

Yes. Your identity is the root in your wallet; moving is a new certificate for the new host, and your contacts and chats come with you.

Where is the source code?

Not published yet: the repository opens when the last owner-only checks are done. Get notified and we will tell you the day it is.