Direct peer-to-peer for AI agents.

A direct peer-to-peer data path. No API gateway. No message broker. A thin registry handles discovery, then agents connect directly: encrypted, NAT-traversing, zero config.

Install in one line Read the architecture

Why direct

Hub-and-spoke is a bottleneck.

Through a broker2 hops + a queue

Every message goes in to the gateway or broker and back out, through its queue.

Direct, with Pilot0 hops in between

A thin registry handles discovery. Then the packet goes straight to the peer, and each new peer adds one tunnel.

Latency

Zero-hop data path

On a direct path, packets travel the exact network RTT between the two machines. Symmetric-NAT peers that can’t hole-punch fall back to an encrypted relay, which adds a hop.

Security

End-to-end encrypted

X25519 key exchange and AES-256-GCM, on by default (disable with --no-encrypt if you must). Nothing in the middle can read your data.

Ops

Hosted coordination by default

No broker or gateway fleet to run on the public network. Discovery and NAT traversal use the Pilot-operated registry and beacon; those endpoints are configurable.

Scale

Linear by construction

Each new peer adds one tunnel to whoever it talks to. The payload plane has no central fan-in limit; registry capacity remains a coordination-plane concern.

The numbers

No middleman, no middleman overhead.

Latency

≈ RTT

A direct tunnel adds little over the raw network round-trip between the two peers.

LAN

Low

Same-subnet agents talk at LAN latency. Pilot stays out of the way.

Loss

Low

The userspace reliability layer recovers lost UDP packets; measure your own path with pilotctl bench.

Header

34 bytes

Per-packet header: flow-control window and CRC32.

What rides with every packet · not to scale

Header: 34 bytes: flow-control window + CRC32.
Envelope: Encryption adds a small, separate envelope: nonce + GCM tag.
Payload: AES-256-GCM, readable only by the two peers.

Any NAT

Three tiers of traversal.

The daemon works its way down the ladder by itself, direct, then hole-punch, then relay, without having to classify the NAT it’s behind.

Cloud VMs with static IPs can skip STUN with --endpoint host:port.

Up and running

Four steps. About a minute.

No Docker. No Kubernetes. No YAML. Just a binary and a hostname.

agent@node-a ~ direct p2pexample

# agent A - install and start
$ curl -fsSL https://pilotprotocol.network/install.sh | sh
$ pilotctl daemon start --hostname agent-a
Daemon running (pid 24817)
  Address:  0:0000.A91F.7C2E
  Hostname: agent-a

agent@node-b ~ direct p2pexample

# agent B - handshake then dial agent A directly
$ pilotctl handshake agent-a
$ pilotctl connect agent-a --message "hello, peer"
✓ direct-path example · 34ms · relay not needed

Example session. Addresses, timings and process IDs will differ on your machines.

Go direct. Peer-to-peer by default.

curl -fsSL https://pilotprotocol.network/install.sh | sh

Install now Read the deep dive