Agent communication without public URLs.
Envoq gives AI agents a local Sidecar and hosted MCP interface for brokered communication. Agents connect outbound over WSS, discover peers by tenant, send signed control messages, and negotiate large transfers without public webhooks.
Built for traffic between machines that never sleep
Envoq handles the hard parts of agent networking: identity, delivery, NAT traversal, and bulk data, so your agents just send and receive.
Signed broker delivery
REST and webhook traffic is authenticated before routing. Agents still validate every payload before acting.
No public agent URLs
The Sidecar keeps an outbound WSS path to the broker, so CLI agents can receive work without exposing localhost.
Retry-backed delivery
Redis Streams, exponential backoff, circuit breakers, and DLQ events make failures visible instead of silent.
Verified large transfers
Large artifacts use brokered manifests, WebRTC/libp2p negotiation, and SHA-256 verification instead of pushing bytes through the hub.
Scoped API keys
Live keys are stored in Aurora with Clerk metadata fallback for beta accounts.
Agent directory
Agents discover peers in the same tenant instead of copying IDs by hand.
Ops event stream
Tunnel drops, DLQ moves, and circuit opens emit machine-readable operations events.
Thread archive
Broker records preserve message metadata and hashes for audit-friendly conversation history.
Use REST directly or let the Sidecar speak MCP
Install a standalone binary without Node.js, use npm or npx when that is already in your toolchain, then connect through live REST routes, hosted SSE MCP tools, or a local Sidecar.
- No Node.js requiredmacOS and Linux users can install with curl; Windows users can download the release executable.
- No ngrok homeworkSidecars connect outbound to Envoq, so agents do not need temporary public URLs.
- Resilient by designBackoff, DLQ, circuit breaker events, and tunnel lifecycle events are built in.
curl -X POST https://api.envoq.tech/api/v1/agents \
-H "Authorization: Bearer $ENVOQ_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "antigravity",
"tunnel_endpoint": "wss://api.envoq.tech/api/v1/connect",
"public_key": "ed25519:...",
"capabilities": ["code", "mcp", "file-transfer"]
}'
# -> 201 Created { "agent_id": "agt_..." }From boot to verified delivery in four steps
Create a key
Generate a scoped API key from the console for the agent or sidecar.
Register agents
Agents publish capabilities, public keys, and tunnel intent to the tenant directory.
Route work
Messages queue through the broker and reach active sidecars over WSS or signed webhooks.
Transfer safely
Large artifacts move by manifest, P2P negotiation, and checksum verification.
A valid broker envelope is not permission to execute
Envoq authenticates delivery, preserves audit metadata, and routes messages. Agents still enforce sender allowlists, schema validation, checksums, and sandboxing before acting.