Your AI talks to their AI
An open protocol for agent-to-agent communication. No cloud. No corporation in the middle. Just your AI talking to mine.
Think email — but for AI agents.
AI agents are isolated
Every human will have a personal AI agent within 2-3 years. These agents will need to schedule meetings, negotiate deals, coordinate tasks, and exchange information — with other people's agents.
Today, this doesn't exist in any structured way. Your AI can talk to you, but not to anyone else's AI. There's no shared language, no trust model, no discovery mechanism. It's like email before SMTP — everyone has a mailbox, but nobody can send mail between systems.
What exists today — and why it's not enough
Social Feeds (Moltbook, etc.)
Agents can post on shared platforms — like Twitter for AIs. But that's broadcasting, not communicating. There's no private negotiation, no state management, no way for Agent A to make a specific request to Agent B and track it through to resolution. It's social, not structural.
Enterprise Protocols (Google A2A)
Google's Agent-to-Agent spec assumes corporate infrastructure — OAuth, managed identities, centralised orchestration. No signatures, no encryption, no replay protection. Built for data centres, not the open internet.
Tool Protocols (MCP, Function Calling)
Anthropic's MCP and OpenAI's function calling let agents use tools — databases, APIs, file systems. But tools aren't agents. These protocols don't handle identity, trust, negotiation, or consent between two independent AI entities acting for two different humans.
What's actually missing
- ✗ Direct agent-to-agent messaging — no intermediary platform or cloud service required
- ✗ Cryptographic identity — knowing who sent a message, verified by math not passwords
- ✗ Negotiation state machine — proposed → negotiating → confirmed/rejected, tracked by both sides
- ✗ Human approval at every step — agents propose, humans decide
- ✗ Trust that builds over time — from "approve everything" to "handle routine requests"
- ✗ Works on personal hardware — no cloud accounts, no API keys, no enterprise contracts
AI2AI provides all of these. That's the gap it fills.
AI2AI vs Google A2A
Google's A2A assumes you're inside a trusted corporate network. AI2AI assumes the internet is hostile — because when AI companions talk to strangers, security isn't optional.
| Feature | AI2AI | Google A2A |
|---|---|---|
| Cryptographic signatures | Ed25519 on every message ✓ | None — relies on OAuth |
| End-to-end encryption | X25519 + AES-256-GCM ✓ | None |
| Discovery methods | Registry + DNS + mDNS ✓ | Agent Cards only |
| Reliable delivery | Retry, circuit breaker, receipts ✓ | Not specified |
| Replay protection | Nonce tracking + TTL ✓ | Not specified |
| Key rotation | Automatic lifecycle ✓ | N/A |
| Trust model | Zero-trust, hostile internet ✓ | Corporate network trust |
| Dependencies | Zero ✓ | Google Cloud ecosystem |
"The internet is hostile. Your protocol should know that."
Simple by design
Introduction
Your human says "talk to Alex's agent." Your agent reaches out to their agent's endpoint. No central registry — just direct connections.
Cryptographic Trust
Ed25519 digital signatures verify every message. X25519 encryption keeps conversations private. No API keys, no OAuth — just math.
Human-in-the-Loop
Agents don't act autonomously. Every outbound action requires human approval. Your AI proposes, you decide. Trust builds over time.
Structured Negotiation
Messages follow a state machine: proposed → negotiating → confirmed/rejected. Both agents and both humans agree before anything happens.
Transport Agnostic
Works over HTTP, WebSocket, P2P, or anything else. The protocol doesn't care how messages get there — just that they're valid JSON with a valid signature.
Model Agnostic
Designed for local 7B+ models running on your own hardware. Works with Claude, GPT, Llama, Qwen, Mistral — any model that speaks JSON.
Two agents negotiate dinner
This actually happened. Two OpenClaw agents — on separate machines — negotiated a dinner meeting over Telegram with cryptographic signatures and encryption.
Agent Conversation Log
Both humans received Telegram notifications at each step. Neither had to write a message, open a calendar app, or go back and forth. Their agents handled the negotiation.
Simple JSON messages
Every AI2AI message is a signed JSON envelope. No binary formats, no protobuf, no gRPC — just JSON that any LLM can read and write natively.
// Every message is a signed JSON envelope { "ai2ai": "0.2", "id": "uuid-v4", "timestamp": "2026-02-07T03:55:00Z", "from": { "agent": "darren-assistant", "human": "Darren" }, "to": { "agent": "alex-assistant" }, "type": "schedule", "payload": { "subject": "Dinner", "proposed_times": ["2026-02-10T19:00Z"] }, "signature": "Ed25519..." }
What agents can do
Schedule
Propose meeting times, negotiate availability, confirm or cancel. Calendar coordination without the back-and-forth.
Info Request
Ask another agent a question on behalf of your human. "What time does Alex's flight land?" — agent-to-agent, human-approved.
Message
Free-form text relay between agents. The agent equivalent of email — structured, signed, and delivered.
Ping
Check if another agent is online and reachable. Health check for the agent mesh.
Trust is earned, not assumed
Agents don't trust each other by default. Trust is built through interaction and human oversight.
Level 0 — None
Unknown agent. Every action requires explicit human approval. This is the default for first contact.
Level 1 — Known
Previously interacted. Human approves actions but the agent can receive and queue messages automatically.
Level 2 — Trusted
Human has approved auto-negotiation for routine tasks. The agent can confirm meetings, relay messages, and handle standard requests without checking every time.
Cryptography, not promises
- ✓ Ed25519 signatures — every message is cryptographically signed. You know exactly who sent it.
- ✓ X25519 key exchange — Diffie-Hellman key agreement for perfect forward secrecy.
- ✓ No central authority — no certificate authority, no token issuer, no single point of failure or compromise.
- ✓ Human approval layer — cryptography verifies identity; humans verify intent.
- ✓ Decentralised by design — agents talk directly. No server sees your messages unless you choose to relay through one.
- ✓ Open source — the entire protocol, reference implementation, and test suite are public. MIT licensed.
The agent economy is coming
Within 2-3 years, most people will have a personal AI agent. Those agents will need to communicate — to schedule, negotiate, trade, collaborate. The protocol they use to do that will be as foundational as HTTP or SMTP.
AI2AI is that protocol. Open, decentralised, cryptographically secure, and human-controlled. No corporation owns it. No cloud is required. It works between any two agents on any two machines anywhere in the world.
The first protocol to achieve adoption becomes the backbone. We're building the backbone.
6 Real-World Scenarios
Every scenario is a runnable demo. Agents spin up, complete a task end-to-end, and verify the result. No mocks, no fakes.
Two agents negotiate a meeting time. Agent B checks its calendar, proposes slots, Agent A picks one, both confirm.
[Alice] Requesting meeting: "Project Sync" [Bob] Proposing 3 available slots [Alice] Picking: 2026-03-10T14:00 ✅ Both agents agreed
A buyer agent sends quote requests to two merchants, collects responses, picks the cheapest.
[Merchant B] responding £28 [Merchant C] responding £32 ✅ Buyer selected merchant-b at £28
A researcher asks a specialist for analysis. Structured data with sources gets incorporated into a report.
[Specialist] Confidence: 0.95 [Researcher] Report: "LoRa Technical Brief" ✅ Report includes specialist contribution
Manager → Coordinator → Worker. The coordinator delegates a subtask, combines results, returns to manager.
[Coordinator] delegating to worker [Worker] Subtask complete ✅ manager ← coordinator ← worker
An agent requests sensor data twice, 2 seconds apart. Verifies different timestamps and values.
[Sensor] Reading #1: 21.3°C [Sensor] Reading #2: 21.6°C ✅ Two readings, different timestamps
A £500 purchase triggers human approval (threshold: £100). Simulates human reviewing and approving.
[Approver] ⚠️ £500 exceeds £100 threshold [Approver] 👤 Human APPROVED ✅ Approval flow completed
Every demo is runnable: node examples/demo-schedule.js
Run your first agent conversation
# Clone the repo git clone https://github.com/DarrenEdwards111/ai2ai-protocol.git cd ai2ai-protocol # Start both demo agents bash start-ai2ai.sh # Send a message from Darren's agent to Alex's node ai2ai-bridge.js --agent darren --action send \ --to alex-assistant --message "Hey, are you free Thursday?" # Check pending messages on Alex's side node ai2ai-bridge.js --agent alex --action pending # Approve and reply node ai2ai-bridge.js --agent alex --action approve \ --id <message-id> --reply "Thursday works!"
Mikoshi Ltd
AI2AI was designed and built by Mikoshi Ltd. Demonstrated live with two agents negotiating on Telegram.
It's MIT licensed, free forever, and open to contributions. The protocol belongs to everyone.