A4A is a new open protocol that lets personal AI agents message each other privately

The copy-and-paste problem

As dev.to reported, the authors of A4A start from a common frustration. Many people now work with a personal AI agent such as Claude Code, Cursor, OpenAI Codex or GitHub Copilot. Inside one laptop these tools can read and write code, run commands and call outside services.

The trouble starts when your agent needs to give something to a colleague's agent: a summary, a task, a file, an API description. There is no direct route between the two. So a person acts as a courier. They copy the output, paste it into Slack, Telegram or Discord, wait for the colleague to paste it into their own agent, and then repeat the whole thing in reverse when a question comes back.

A4A, short for Agent for Agent, is the team's attempt to remove that manual step. They describe it as an open, decentralized protocol plus a network of relay servers, built for personal agents talking across the internet.

Why existing standards don't cover it

The obvious question is whether Anthropic's MCP (Model Context Protocol, the connector standard that lets an agent use tools) or Google's A2A already solve this. The authors say they sit at different layers. MCP links an agent to a tool or resource. A2A links an agent to a service, and it expects a reachable web address.

Personal agents break that assumption. A freelancer's laptop has no fixed public address and no always-on server, and it goes quiet when the lid closes. The authors argue that messages between such agents must work in a leave-it-for-later style, using only outbound connections. They also argue that the servers in the middle should see only scrambled data.

A4A is therefore pitched as a complement. It handles person-to-person agent traffic, while MCP and A2A handle the other relationships.

How the messages stay private

Each agent creates its own pair of cryptographic keys the first time it runs, with no sign-up on a website. The public half, which starts with apub1, works like an email address you can share by link or QR code. The private half stays on the user's device. Every message is digitally signed, so forging a sender or altering a message in transit is meant to be impossible.

The message contents are encrypted using a scheme borrowed from the Nostr community, a decentralized messaging project. A second layer deals with metadata. The real, signed message is sealed and then wrapped in an outer envelope signed by a one-time throwaway key with a randomized timestamp. A relay sees only that some anonymous key delivered an encrypted blob to a given recipient. That stops relays from mapping which agents talk to each other.

Files get similar treatment. The sender makes a fresh random 256-bit key per file, encrypts it locally, uploads the scrambled file to storage, and sends the key inside an encrypted message. The storage server holds only noise.

Relays, offline laptops and owner control

Agents connect outward to several relays at once. When sending, the software looks up the recipient's preferred relays and pushes the encrypted message to at least 3 of them. If the recipient is online, delivery takes about 40 ms within a region and a signed receipt comes back. If the laptop is asleep, relays queue the message for up to 7 days and deliver it on reconnect.

At launch the team runs 8 seed relays across 4 regions: Europe, the US, the CIS (a group of former Soviet states) and Asia-Pacific. The relay software is written in Rust and is open source, and the authors say anyone can run a private company relay or a public community one using Docker.

Letting autonomous agents message across the internet needs limits, so the protocol includes some:

• Delegation: an owner signs a certificate letting an agent act only for certain task types, up to a maximum budget and until an expiry time.
• Revocation: a compromised or misbehaving agent key can be cancelled across the relays within seconds.
• Agreements: two agents can co-sign the scope, deadline and price of a task before starting, and optionally anchor a fingerprint of those terms in the Bitcoin blockchain.

What to make of it

A4A comes with a Python SDK and a ready-made MCP server. The authors say it plugs into existing coding assistants without waiting for vendor partnerships. A one-line installer sets up an identity and registers tools such as sending a message and checking an inbox. It also produces a contact link you can send to a teammate. Code is described as open source under MIT or Apache-2.0 licenses.

The caveats are significant. This is a self-published post about the authors' own project. Nothing in it points to an independent review of the cryptography, a security audit, or any users beyond the builders. A protocol only becomes useful when enough people and tools adopt it, and that has not happened yet.

The idea itself is still worth understanding. As agents begin acting on their own, how they message each other, who can read it and who can switch them off becomes a practical question for any team.