Pre-alpha · v0.0.1-alpha.0

A tiny relay for the computers you already trust.

Move work between your own coding agents without opening a port or pasting a private token. Enroll each computer once, then send encrypted prompts, files, or notifications to a receiver you control.

Get started How it stays private

Enroll both machines. Keep one serving.

  1. 1

    Enroll each computer

    Browser approval names the machine and stores its device keys plus a renewable credential locally. No join codes, no pair tokens, no secret copied between machines.

  2. 2

    Keep one serving

    Run the receiver on whichever machine should accept notifications or agent handoffs. It connects outward — nothing listens on the public internet.

  3. 3

    Send a first message

    A local notification is the universal, always-safe target. Delivery straight into a coding agent is explicit and controlled by the receiving machine.

Install

Pre-alpha. The CLI works; flags will still change. Both paths install the same binary.

With npm

Nothing to install first if you already have Node.

npx agentrelay enroll --browser

v0.0.1-alpha.0 · macOS and Linux, arm64 and x86_64

With the installer

Drops the binary in ~/.local/bin.

curl -fsSL https://relay.ch5.me/install.sh | bash

Review it first if you'd rather — it's a plain shell script.

Then, on each machine

agentrelay serve

agentrelay send --cloud \
  --to your-handle/your-device-id \
  --deliver notify \
  --text "Pick up the next task."

One core, three local ways in.

The integration surface is intentionally ordinary. Each path delegates to the same local service and the same adapter checks, so adding a harness never means another transport.

CLI

agentrelay send

Direct terminal control.

MCP

agentrelay mcp

A standard stdio server exposing send, peers, destinations, and status to any MCP-capable harness.

A2A

agentrelay a2a

A bearer-protected loopback A2A 1.0 gateway — without exposing your computer to the network.

Adapters are useful, but never magic.

The receiver advertises what is actually available, probes bounded local state, and fails closed rather than silently substituting a different destination.

  • notify The safe baseline: a local notification and copyable payload.
  • claude Mailbox and hook based handoff where configured.
  • codex Explicit Codex delivery when the receiver allows it.
  • opencode HTTP delivery into an approved local session.
  • gemini Gemini CLI handoff through the adapter contract.

The receiver stays in control.

A tool that can inject work into your coding agent has to be legible about what it can and cannot do. Here is the whole shape of it.

No inbound anything

Devices connect outward to the relay. There is no router rule, no firewall hole, and no address for the public internet to reach.

Sealed before it leaves

Message bodies and attachments are encrypted to the recipient device and signed by the sender device before the relay ever handles them. It stores opaque ciphertext and routing metadata.

Keys stay local

Device private keys and renewable credentials live on your machine — in the macOS Keychain, or a 0600 file elsewhere. They are never uploaded.

The receiver decides

Relay is transport, not a cloud executor. Whether a notification, agent handoff, session, or workspace is allowed is decided by the machine receiving it.

Sharing is scoped and revocable

Giving another person access is deliberate: scoped to one device and one adapter, auditable, and revocable from the same screen that granted it.