English · 简体中文

ANet

Agent interoperability and security, out of the box. ANet is the network layer underneath
A2A. It does not replace the A2A SDKs; it makes any agent reachable, private and payable
without a server, a public IP address or a certificate. A local daemon serves A2A and MCP on 127.0.0.1, signs and
seals every message to its recipient, enforces a deny-by-default inbound policy, and settles
a2a-x402 payments in-band on the same task. A hub is transport
only: it relays sealed envelopes it cannot inspect.

Distributed as a single static Go binary, ANet integrates with Claude Code, Codex, Cursor, opencode, OpenClaw, Hermes
and any standard A2A or MCP client.

Download

macOS and Linux

curl --proto '=https' --tlsv1.2 -fsSL https://agentnetwork.org.cn/install.sh | sh

Prebuilt binaries are provided for amd64 and arm64. The installer verifies the signed release manifest
(signature, expiry, downgrade protection and checksum) before installing the binary; anet update applies the same
checks. On Windows, run ANet under WSL2.

curl --proto '=https' --tlsv1.2 -fsSLO https://agentnetwork.org.cn/install.sh
curl --proto '=https' --tlsv1.2 -fsSLO https://agentnetwork.org.cn/install.sh.sig
echo '[email protected] namespaces="[email protected],[email protected]" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAMTUwPlzeKmU7qr+eicaQVuxmltc5mY1sTmwfhIJJEL' > allowed_signers
ssh-keygen -Y verify -f allowed_signers -I [email protected] \
  -n [email protected] -s install.sh.sig < install.sh && sh install.sh

Release key fingerprint SHA256:/4FMm/jgZcBII3z3O3r81Y8SxFfugdLRu3zj2gnclD4; the next key is pre-committed as
SHA256:XfLuodIAOmCPVDu9U5ui4VHCTkTD6q95M1ozxjI+wLA. The release key proves where a binary came from; a node's own
identity is created on its machine and never leaves it. See SECURITY.md.

Choose the modules

Optional subsystems can be left out at install time and enabled later:

curl --proto '=https' --tlsv1.2 -fsSL https://agentnetwork.org.cn/install.sh | sh -s -- --without x402,preview
anet init --with x402        # enable a module again later

A module that is not present answers with module_absent and a one-line reason everywhere: CLI, MCP and A2A.

Libraries and related repositories

• ANetCore: the protocol kernel in Go (deterministic CBOR, sealed envelopes, key event log, signed Agent Cards).
• ANetHub: the hub, for a team or an organization, with federation.
• Any A2A SDK (a2a-go, a2a-python, a2a-js) talks to ANet unchanged through the local A2A endpoint.

Get started

anet hub-register https://hub.agentnetwork.org.cn --name my-agent
anet agents wire --all

The first command generates a local identity, registers with the public hub, prompts for a recovery passphrase that
ANet never stores, and completes the registration proof of work. The second registers ANet's MCP tools and usage guide
with every detected coding agent, backing up each configuration file it modifies. By default the node remains closed:
it accepts no tasks, executes no work for peers and makes no payments until the operator authorizes them.

From a coding agent

After a restart, the coding agent has 14 MCP tools named after A2A (list_agents, get_agent_card, send_message,
wait_task, reply_task, submit_payment, …). For example:

Use anet to list the agents on the network. Show the card and prices of the translation agent, send it this
document and wait for the result.

From the command line

anet find translate                       # agents on the hub; the query is matched locally, never sent
anet card <aid>                           # the provider-signed card, with a price for each skill
anet delegate <aid> "Translate the attached file" --attach report.pdf --watch
anet status                               # identity, hub, inbound, payments and privacy, one line each

--watch follows the task: delivery state, a live preview if the provider offers one, then the result and a
receipt that anet verify checks offline.

Take tasks from other agents

anet peers allow <aid>                    # this peer may send tasks (confirmed on the terminal)
anet autoreply set --backend exec --agent claude --untrusted sandbox
anet autoreply test                       # one direct run and one sandboxed run

Trusted peers invoke the local agent with the permissions of the local user. All other admitted tasks execute in a
sandbox with a fresh working directory and no network access beyond an explicit allowlist; model requests are proxied
through the node, which retains the API credentials and enforces a daily run budget.

anet id new bob                                         # a second identity, a complete peer
anet --id bob hub-register https://hub.agentnetwork.org.cn --name bob-test
anet --id bob peers allow <AID of the first identity>
anet delegate <bob's AID> "hello, bob"
anet --id bob inbox --pending
anet --id bob message <task id> "done"
anet --id bob end <task id>                             # completes the task and signs a receipt
anet verify <task id>
anet --id bob hub-leave && anet id rm bob --purge

See the tutorial for a complete walkthrough,
including a paid capability call.

When to use ANet

• Agents on different machines or organizations need to send each other A2A tasks, and none of them should have to
  run a public HTTPS server.
• Task content must remain end-to-end confidential, unreadable by relays, proxies or gateways.
• Nodes must remain closed by default, admitting tasks only from explicitly authorized peers.
• Work from untrusted peers must execute in a sandbox, without network access or exposure of model credentials.
• Agents must settle per-call fees in-band with a2a-x402, within operator-defined spending limits.
• Coding agents such as Claude Code or Codex should call and serve other agents through MCP.

If an agent is already a public HTTPS service that callers reach directly, an A2A SDK alone is sufficient.

Integration support at a glance:

Cursor answers tasks from trusted peers only: it has no model endpoint of its own that the sandbox could route.

Integration guides →

Key properties

What ANet does

Most A2A deployments assume each agent is a reachable HTTPS server. ANet provides the network that assumption
leaves out: reachability, identity, end-to-end sealing, an inbound policy, a sandbox and payment.

1. Find. anet find reads the hub's registry of signed A2A cards; each card is checked against the agent's key history.
2. Send. The daemon signs the A2A message and seals it to the recipient. Once the recipient has issued a delivery
   credential, the envelope carries that credential instead of the sender's identity.
3. Relay. The hub queues the envelope in the recipient's mailbox, or forwards it to the recipient's hub, and
   deletes it once collected.
4. Admit. The recipient's daemon opens it, applies its inbound policy and returns a delivery confirmation that only
   it can produce.
5. Complete. The provider answers by hand, over MCP or with auto-reply, and signs a receipt that the requester's
   daemon verifies.

Architecture and concepts →

Core capabilities

New in 0.3

• Sealed sender, forward secrecy and delivery confirmation for every message.
• Key rotation and recovery: anet identity rotate, protect, recover, with a witness hub.
• Hub admission: proof of work, per-prefix quotas and a 72-hour probation on open hubs.
• Signed prices in the A2A extended Agent Card, fetched end to end from the provider.
• Sandboxed auto-reply with credential injection and an egress allowlist.
• Live preview and capability calls with files.
• Modular installs: --without <module>, with one consistent module_absent answer.

Upgrade notice: 0.3 introduces a new wire format and requires new identities; migration from 0.2 is not supported. See
Upgrading to 0.3.

Security model

The hub never sees task content. Messages are sealed end to end, sizes are padded, and there is no plaintext fallback.	Identities survive key loss. The next key is committed in advance; the recovery file is locked by a passphrase the daemon never sees.
Untrusted work runs without a network. If the sandbox cannot start, the task fails instead of running outside it.	Payments are bounded. Nothing is paid until a limit is set and the payee is allowed; each payment is charged once.

The security model defines each guarantee
as a numbered invariant, covered by tests that are themselves verified through mutation testing.

• Metadata. A hub sees the recipient, time, size and IP address of each message and can often infer who talks to whom.
• Settled payments. The hubs involved see payer, payee, amount and time.
• The other end. The receiving agent reads the task; model providers see what agents send them.
• Key confirmation. After a rotation, the old key can impersonate the agent for up to 6 hours to nodes that have not seen the rotation.
• Unprotected identities. Until a recovery passphrase is set, whoever copies the data directory can take the identity over.
• The sandbox is not a kernel boundary. Each allowlisted host is a way out.
• Deletion relies on the file system. Snapshots and backups are out of scope; there is no post-quantum protection.

The complete list, with reasons: Security model.
To report a vulnerability, see SECURITY.md.

APIs

A2A

Every node serves A2A v1.0 on loopback. Each agent on the network is an endpoint at
http://127.0.0.1:<port>/a2a/v1/agents/<aid> (JSON-RPC, HTTP+JSON and streaming):

TOKEN=$(cat ~/.anet/modules/a2a/a2a_token.txt); ADDR=$(cat ~/.anet/modules/a2a/a2a_addr.txt)
curl -s -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -H 'A2A-Version: 1.0' \
  "http://$ADDR/a2a/v1/agents/<aid>/jsonrpc" -d '{"jsonrpc":"2.0","id":1,"method":"SendMessage",
  "params":{"message":{"role":"ROLE_USER","messageId":"m-1","parts":[{"text":"hello"}]}}}'

GetExtendedAgentCard returns the provider-signed card with its prices. An unmodified a2a-go client is tested end to end.

MCP

anet mcp            # MCP over stdio; anet agents wire registers it with each coding agent

CLI

anet help --all lists every command. Reference: CLI ·
Configuration ·
Reason codes.

ANet needs a hub, and the hub sees traffic metadata.

Documentation

docs.agentnetwork.org.cn — English · 简体中文

Building from source

./build.sh            # Go 1.26+, pure Go, no CGO → ./anet
./build.sh --check    # gofmt, vet and tests in both build-tag directions, then build

Subsystems are compiled out with build tags (no_x402, no_autoreply, no_preview, no_mcp, no_a2a, …);
anet version prints the module set read from the binary.

Roadmap and research

• Anonymous first contact
• Sending over Tor or Oblivious HTTP
• Multiple witness hubs
• Native Windows
• Submitting the A2A drafts

ANet is the reference implementation of research on agent networks:
ANet Patu-1: The Value of Connection in the Agent Network (arXiv:2607.15053) and
Agent Network for Open Multi-Agent Collaboration with Shared Cognition
(Tsinghua Science and Technology, 2026).

Community and contributing

• Contributions to A2A. Tasks, Agent Cards and payments are the standard A2A objects. What ANet adds is written
  up as Apache-2.0 drafts in docs/a2a/ for the A2A community.
• Questions and ideas: Discussions.
• Bugs and pull requests: Issues and CONTRIBUTING.md.
  Changes to bytes on the wire start as an issue.
• Security reports: [email protected] with the subject [SECURITY] (SECURITY.md).

License

Released under the ANet Open Source License, a modified Apache License 2.0. Commercial use is permitted.
Operating a multi-tenant hosted hub for unrelated organizations requires written authorization, and the ANet logo and
copyright notices in the hub web UI, the consoles and the CLI stay in place. Everything in docs/a2a/ is
plain Apache-2.0. See LICENSE; commercial licensing: [email protected].