Build on the Envoq broker beta

Quickstart

Install the standalone CLI or use npm, create an API key in the console, then call the REST API from your agent service. Demo keys are clearly prefixed and are not accepted by production broker endpoints.

# 1. Install the Envoq CLI
curl -sL https://envoq.tech/install.sh | bash

# npm remains supported when Node.js is already available:
# npm install -g envoq
# npx envoq init

# 2. Create an API key in the Envoq console
export ENVOQ_API_KEY="evq_live_..."
export ENVOQ_BASE_URL="https://api.envoq.tech/api/v1"

# 3. Register this agent and receive/persist its Agent ID
curl -X POST "$ENVOQ_BASE_URL/agents" \
  -H "Authorization: Bearer $ENVOQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "antigravity",
    "tunnel_endpoint": "wss://api.envoq.tech/api/v1/connect",
    "public_key": "ed25519:...",
    "capabilities": ["code", "mcp", "file-transfer"]
  }'

# 4. Discover peer agents in the same tenant
curl "$ENVOQ_BASE_URL/agents/directory" \
  -H "Authorization: Bearer $ENVOQ_API_KEY"

# 5. Send a brokered control message
curl -X POST "$ENVOQ_BASE_URL/messages" \
  -H "Authorization: Bearer $ENVOQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "agent_research_07",
    "type": "task.dispatch",
    "payload": { "prompt": "Summarize Q2 telemetry" }
  }'

AI overview

Agents can integrate through a local MCP Sidecar for private CLI runtimes or through hosted streaming MCP and REST for cloud runtimes. The dedicated overview includes MCP client configs, init wizard usage, and sidecar-vs-cloud guidance.

Authentication

Dashboard sign-in uses Clerk passwordless email codes. Authenticated users can create and delete API keys backed by Aurora storage through the EC2 API. Live keys are prefixed with evq_live_. Demo-mode keys use theenvoq_demo_prefix and are shown only for UI evaluation.

Agents & identity

An agent record binds an agent ID to public verification metadata, capabilities, and tenant ownership. Targets can be signed HTTPS webhooks or outbound WSS sidecar sessions throughapi.envoq.tech. Agents can callGET /api/v1/agents/directoryto discover peers registered under the same tenant API key.

Sending messages

Messages are wrapped in a signed envelope and routed to the target agent. Offline or failing targets are retried with backoff and can land in a dead-letter queue for inspection.

await fetch(`${process.env.ENVOQ_BASE_URL || "https://api.envoq.tech/api/v1"}/messages`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ENVOQ_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    from: "agt_antigravity",
    to: "agent_research_07",
    type: "task.dispatch",
    payload: { prompt: "Summarize Q2 telemetry", priority: "high" },
  }),
})

Reverse tunnels

Agents that cannot expose inbound ports will keep an outbound WSS connection open. The beta REST route records tunnel intent and returns a connect URL; WSS termination runs through the dedicated broker runtime atapi.envoq.tech.

curl -X POST https://api.envoq.tech/api/v1/tunnels \
  -H "Authorization: Bearer $ENVOQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "agent_id": "agt_antigravity" }'

# Control-plane registration returns a tunnel id.
# Reverse WSS termination runs on api.envoq.tech.

Large transfers

Large payload support is designed around brokered manifests rather than routing bytes through Envoq. The sidecar architecture negotiates WebRTC data channels, can reserve a libp2p circuit relay for NAT traversal, and falls back to HTTPS/cloud transport when a direct path is unavailable. Receivers verify SHA-256 checksums before accepting an artifact.

The console currently demonstrates this transfer lifecycle with beta/demo data while production relay capacity is rolled out.

MCP server

AI agents can use Envoq without hand-writing curl commands by connecting to the hosted SSE MCP endpoint or by running the local Sidecar MCP server. Hosted MCP exposesregister_envoq_agent,list_envoq_agents,send_envoq_message,open_envoq_tunnel, and create_envoq_transfertools. The distributable Sidecar exposes the richerenvoq_*tool set for local status, policy, discovery, sidecar file serving, libp2p/WebRTC transport, and transfer reconciliation.

Use npx envoq initto merge MCP client configs for Claude Desktop, Cursor, or Windsurf without overwriting unrelated servers.

{
  "mcpServers": {
    "envoq": {
      "url": "https://api.envoq.tech/api/v1/mcp/sse",
      "headers": {
        "Authorization": "Bearer evq_live_..."
      }
    }
  }
}

REST API

REST endpoints mirror the broker resources exposed in the console.

Webhooks

Webhook deliveries include signature, timestamp, nonce, and delivery identifiers. Receivers should reject stale timestamps, repeated nonces, and payloads that fail local schema validation.

x-envoq-signature: hmac-sha256=<digest>
x-envoq-timestamp: 2026-06-26T00:00:00.000Z
x-envoq-nonce: nonce_01HX...
x-envoq-delivery-id: dlv_01HX...

Errors