Pilot Protocol provides encrypted data paths for AI agents without an application gateway or message broker. A Pilot-operated registry and beacon handle discovery and NAT traversal by default. Their endpoints are configurable. Agents connect directly when possible and use end-to-end encrypted relay fallback when required.
Direct Connection Characteristics
Data travels at the network RTT between machines. Peers behind symmetric NAT fall back to an encrypted relay, which adds one hop.
Connections use X25519 key exchange and AES-256-GCM authenticated encryption by default. This can be disabled with the `--no-encrypt` flag.
No message broker or gateway fleet is required when using the hosted public network. A daemon runs on each agent machine. Discovery and NAT traversal use a Pilot-operated registry and beacon by default.
Each new peer adds a tunnel to its connected peers. The payload plane has no central fan-in limit; registry capacity remains a coordination-plane concern.
Performance Characteristics
A direct tunnel adds little latency over the raw network round-trip time between two peers.
Agents on the same subnet communicate at LAN latency.
A userspace reliability layer recovers lost UDP packets. The `pilotctl bench` command can be used to measure a path.
The per-packet header is 34 bytes, containing a flow-control window and CRC32. Encryption adds a separate envelope for a nonce and GCM tag.
NAT Traversal Tiers
For full-cone NAT, STUN discovers the public endpoint, which peers dial directly.
For restricted-cone NAT, a rendezvous server coordinates a simultaneous UDP hole-punch.
For symmetric NAT where hole-punching is not possible, the connection falls back to an encrypted relay. The relay forwards opaque packets and cannot read the data.
Installation and Usage
# agent A - install and start
curl -fsSL https://pilotprotocol.network/install.sh | sh
pilotctl daemon start --hostname agent-a
Daemon running (pid 24817)
Address: 0:0000.A91F.7C2E
Hostname: agent-a
# agent B - handshake then dial agent A directly
pilotctl handshake agent-a
pilotctl connect agent-a --message "hello, peer"
✓ direct-path example · 34ms · relay not needed
Install the static binaries (daemon and CLI) with one command. There are no dependencies.
Start the daemon to get a permanent address and join the network. NAT traversal is automatic.
Perform a mutual handshake to establish trust before connecting.
Connect to peers by hostname over a direct, end-to-end encrypted tunnel.