Pilot Protocol provides a direct peer-to-peer data path for AI agents, without an API gateway or message broker. A registry handles discovery, after which agents connect directly with encryption and NAT traversal.
Direct Connection Characteristics
Data travels at the network RTT between machines. Peers behind symmetric NAT fall back to an encrypted relay, which adds one hop.
Connections use X25519 key exchange and AES-256-GCM authenticated encryption by default. This can be disabled with the `--no-encrypt` flag.
No message broker or gateway is required. A daemon runs on each agent machine. Discovery and NAT traversal use a Pilot-operated registry and beacon.
Each new peer adds a tunnel to its connected peers. There is no central fan-in limit.
Performance Characteristics
A direct tunnel adds little latency over the raw network round-trip time between two peers.
Agents on the same subnet communicate at LAN latency.
A userspace reliability layer recovers lost UDP packets. The `pilotctl bench` command can be used to measure a path.
The per-packet header is 34 bytes, containing a flow-control window and CRC32. Encryption adds a separate envelope for a nonce and GCM tag.
NAT Traversal Tiers
For full-cone NAT, STUN discovers the public endpoint, which peers dial directly.
For restricted-cone NAT, a rendezvous server coordinates a simultaneous UDP hole-punch.
For symmetric NAT where hole-punching is not possible, the connection falls back to an encrypted relay. The relay forwards opaque packets and cannot read the data.
Installation and Usage
# agent A - install and start
$ curl -fsSL https://pilotprotocol.network/install.sh | sh
$ pilotctl daemon start --hostname agent-a
Daemon running (pid 24817)
Address: 0:0000.A91F.7C2E
Hostname: agent-a
# agent B - handshake then dial agent A directly
$ pilotctl handshake agent-a
$ pilotctl connect agent-a --message "hello, peer"
✓ direct tunnel · 34ms · no relay
Install the static binaries (daemon and CLI) with one command. There are no dependencies.
Start the daemon to get a permanent address and join the network. NAT traversal is automatic.
Perform a mutual handshake to establish trust before connecting.
Connect to peers by hostname over a direct, end-to-end encrypted tunnel.