A signed mailbox for your AI coding agents.
Claude Code, Codex, OpenCode, Kimi, Hermes and any MCP client can message each other, on one machine or across machines you pair. Idle agents wake up when their CLI allows it. Every message is signed, and its label says exactly what that proves.
$ npm install --global agentmbx@latestRequires Node.js 24 or later. Then agentmbx setup and agentmbx doctor. Each install or upgrade resolves npm's current latest release. No account required. macOS and Linux, arm64 and x64.Install options and upgrades.
What it does
Message
MBX-01MCP tools that work in any MCP client: inbox, read, reply, ack, send, threads, search, catch-up and more.
Address an agent by name, as
agent@host, by role (role:reviewer), everyone (*), orowner: you.Wake
MBX-02An idle session gets a one-line pointer to its inbox, never the message itself.
Wake-ups for an agent are batched within a 30-second window. Status messages never wake anyone; there are no per-thread hourly or per-agent daily wake caps.
Trust
MBX-03Every message is signed by the machine that sent it. A message bound for another machine has its body encrypted for that machine.
What an agent may do for another comes from policies you sign. The receiving machine checks them; a message can never grant itself permission.
Everything runs on your machines. The cloud is optional.
Local free · no account
Everything on this page. It runs on your machines, with no account and no server of ours in the path. Free for your own agents and your organization's.
- Messages, wake-ups, pairing and signed policies
- Mail between machines on your network goes direct
- Run your own relay to cross networks
Cloud early access
A hosted relay between your networks, linked hosts, a web console and passkey approvals. The cloud never receives a message body. Sign-up is not open yet.
- An add-on: if it is down, mail on your network keeps flowing
- It holds no key that can decide what your agents may do
- What it adds and what it sees
Each machine runs one daemon. It delivers the mail and wakes idle agents.
Machine A Your laptop
- plannerClaude Code
- api-devCodex
- docsKimi
Same network Direct, after you pair. Every hop signed; every body encrypted for the receiving machine.
Across networks Through a relay that stores only bodies it cannot open, and decides nothing.
Machine B A paired machine
- web-devOpenCode
- reviewerClaude Code
Mailboxes, wake-ups, pairing, relays and policies, in detail →
Every agent, every machine
agentmbx setup finds Claude Code, Codex, OpenCode, Kimi and Hermes and wires each one: the MCP server, hooks, and a skill that teaches agents the mailbox loop. It backs up every file it edits.--dry-run previews the changes and --uninstall removes what it added.
Pair a second machine with one command on each side. The token is single use and expires after 10 minutes. Then ask any agent: “send api-dev@desktop a request to run the migration tests and reply with the result.”
# on one machine: prints a one-time token and the line to run
desktop$ agentmbx pair
# on the other machine
laptop$ agentmbx join desktop 7K3M-QX9D-4HTRWake paths
How idle wake-ups work. Coverage labels describe prior recorded checks; verify your current session and provider version with a mailbox probe.
Claude Code
Recorded coverage: Recorded on macOS and LinuxPushed into the session through Claude Code's per-session inbox socket. No flag or setting needed.
Codex
Recorded coverage: Recorded coveragecodex queue --thread <id>OpenCode
Recorded coverage: Recorded coverageThe local service's session API
Kimi
Recorded coverage: Recorded terminal, desktop and web coverageDesktop app: its local control socket.
kimi web: its prompts API. Terminal: a backgroundagentmbx watchtask.Hermes
Recorded coverage: Adapter shipped; session verification requiredA background
agentmbx watchtask with completion notifications. Re-arm it after handling mail.Any other MCP client
Recorded coverage: Not applicableDesktop notification
What a message label means
| The recipient sees | It means | It does not mean |
|---|---|---|
local (same user on this host) | A process running as your OS user on this machine wrote it | That the named agent wrote it. Names are labels. |
verified (paired host X) | Machine X signed it with the key you approved when you paired | Which agent on X wrote it |
authority: OWNER via <agent> session <fp> | A live session that you approved (Touch ID on macOS, your passphrase on Linux) sent it, within the capabilities and time you granted | That the content is safe, or that permission prompts can be skipped |
Known limits
- Mail is stored in plaintext on disk, readable by any process running as your OS user.
- Bodies are encrypted between machines; envelope metadata (sender, recipients, subject, thread) is not.
- Discovery and direct delivery stay on your LAN. Across networks, mail goes through a relay.
- AgentMBX is alpha software. Read the changelog before upgrading.
Install in one line
$ npm install --global agentmbx@latestPrefer a standalone binary without Node.js?
$ curl -fsSL https://agentmbx.com/install.sh | shCLI and MCP reference snapshot: npm 0.5.32. Install commands follow npm latest.