For · P2P

Direct peer-to-peer for AI agents.

Direct peer-to-peer data path. No API gateway. No message broker. A thin registry handles discovery — then agents connect directly, encrypted, NAT-traversing, zero config.

Install in one line →Read the architecture
Why direct

Hub-and-spoke is a bottleneck.

Latency
Zero-hop data path
On a direct path, packets travel the exact network RTT between the two machines — no gateway, no broker queue sitting in between adding tens of milliseconds. Symmetric-NAT peers that cannot hole-punch fall back to an encrypted relay, which adds a hop.
Security
End-to-end encrypted
X25519 key exchange, AES-256-GCM authenticated encryption, on by default (disable with --no-encrypt if you must). Nothing in the middle can read your data.
Ops
Hosted coordination by default
No message broker or gateway fleet to run when using the public network. The daemon runs on each agent machine; discovery and NAT traversal use the Pilot-operated registry and beacon. Those endpoints are configurable.
Scale
Linear by construction
Each new peer adds one tunnel to whoever it talks to. The payload plane has no central fan-in limit; registry capacity remains a coordination-plane concern.
The numbers

No middleman, no middleman overhead.

Latency
≈ RTT
A direct tunnel adds little over the raw network round-trip between the two peers.
LAN
Low
Same-subnet agents talk at LAN latency — Pilot stays out of the way.
Loss
Low
The userspace reliability layer recovers lost UDP packets; measure your own path with pilotctl bench.
Header
34 bytes
Per-packet header (flow-control window + CRC32). Encryption adds a small separate envelope (nonce + GCM tag).
Any NAT

Three tiers of traversal.

01
Full-cone NAT
STUN discovers your public endpoint. The peer dials it directly. No punch needed. Works across most consumer and cloud NAT.
02
Restricted cone NAT
The rendezvous coordinates a simultaneous hole-punch on both sides. The first outbound packet opens the return path, typically establishing quickly.
03
Symmetric NAT
Hole-punching impossible. Pilot auto-falls-back to an encrypted relay. The relay forwards opaque packets - it cannot read your data.
Up and running

Four steps.
About a minute.

agent@node ~ direct p2p
0.8s
# agent A - install and start
$ curl -fsSL https://pilotprotocol.network/install.sh | sh
$ pilotctl daemon start --hostname agent-a
Daemon running (pid 24817)
  Address:  0:0000.A91F.7C2E
  Hostname: agent-a
 
# agent B - handshake then dial agent A directly
$ pilotctl handshake agent-a
$ pilotctl connect agent-a --message "hello, peer"
✓ direct-path example · 34ms · relay not needed
No Docker. No Kubernetes. No YAML. Just a binary and a hostname.
  • 01
    Install
    One command. Static binaries (daemon + CLI), no dependencies.
  • 02
    Start the daemon
    Gets a permanent address. Joins the network. NAT traversal is automatic.
  • 03
    Trust
    Mutual handshake before any connection. You decide who can reach you.
  • 04
    Dial
    Connect by hostname. Direct tunnel, encrypted end-to-end.

Go direct. Peer-to-peer by default.

Install now →Read the deep dive