agent-transfer-protocol

  Agent A           ATP Server A          ATP Server B          Agent B
    |                    |                     |                    |
    |---[1. Submit]----->|                     |                    |
    |   (unsigned+cred)  |                     |                    |
    |              2. Credential Verify        |                    |
    |                    |                     |                    |
    |              3. DNS SVCB Discover        |                    |
    |              4. Domain-key Sign (ATK)    |                    |
    |                    |                     |                    |
    |                    |--[5. Transfer]----->|                    |
    |                    |   TLS 1.3 + POST    |                    |
    |                    |   (signed message)  |                    |
    |                    |                     |                    |
    |                    |               6. ATS+ATK Verify (DNS)   |
    |                    |               7. Sender Authenticated   |
    |                    |                     |                    |
    |<---[202 Accepted]--|                     |---[8. Deliver]--->|
    |                    |                     |                    |

Why ATP?

Agents need a standard way to communicate across the Internet: securely, without a central registry, using infrastructure that already exists.

Install

pip install agent-transfer-protocol

Requires Python 3.11+

Quick Start

# 1. Start a server
atp server start --domain example.com --port 7443

# 2. Register an agent (will prompt for password)
atp agent register mybot --server example.com
# Or non-interactively: atp agent register mybot --server example.com -p mypassword

# 3. Send a message (from another terminal)
atp send agent@remote.org \
  --from mybot \
  --password mypassword \
  --server example.com \
  --body "Hello!"

# 4. Check server status
atp status --server example.com

Try It: Two Servers Talking

Run two servers locally and send messages between them, no DNS needed:

# Terminal 1: Start Server A
atp server start --domain alice.local --port 7443

# Terminal 2: Start Server B
atp server start --domain bob.local --port 7444

# Register agents
atp agent register agent --server 127.0.0.1:7443 --no-verify -p alice_pass
atp agent register agent --server 127.0.0.1:7444 --no-verify -p bob_pass

# Terminal 3: Alice sends to Bob
atp send agent@bob.local \
  --from agent \
  --password alice_pass \
  --server 127.0.0.1:7443 \
  --no-verify \
  --body "Hello Bob!"

# Terminal 4: Bob receives
atp recv \
  --agent-id agent \
  --password bob_pass \
  --server 127.0.0.1:7444 \
  --no-verify

Python SDK

import asyncio
from atp.client import ATPClient

async def main():
    client = ATPClient(
        agent_id="mybot",
        password="mypassword",
        server="example.com",
    )

    # Send
    result = await client.send("target@remote.org", body="Hello from SDK")
    print(result)  # {"status": "accepted", "nonce": "msg-..."}

    # Receive
    messages = await client.recv()
    for msg in messages:
        print(f"{msg.from_id}: {msg.payload}")

    await client.close()

asyncio.run(main())

CLI Reference

Core Commands

Agent Management

Key Management (Server)

Ed25519 signing keys are auto-generated on first server startup. These commands are for manual control.

Operations

DNS

Run atp <command> --help for options.

Connection Options

• Default: verify TLS certificates. Invalid cert prompts for confirmation.
• --no-verify: skip certificate verification silently.
• Agent names without @ are auto-completed with the server domain.

Production Deployment

For production, configure DNS records. ATP generates them for you:

# Step 1: Generate the records
atp dns generate --domain example.com --ip 203.0.113.1

# Step 2: Add them to your DNS provider (Cloudflare, Route53, etc.)

# Step 3: Verify
atp dns check --domain example.com

# Step 4: Start with TLS
atp server start --domain example.com --cert server.crt --key server.key

See the DNS Setup Guide for details.

Security

ATP provides four layers of security, inspired by email's battle-tested approach:

Agents authenticate to their server with credentials (password). The server signs messages with its domain-level Ed25519 key before forwarding. Remote servers verify independently via ATS+ATK.

Documentation

Protocol Specification

ATP is defined as an IETF Internet-Draft (Standards Track):

Agent Transfer Protocol (ATP) draft-li-atp · March 2026 Xiang Li, Lu Sun, Yuqi Qiu, Nankai University, AOSP Laboratory

IETF Datatracker · Full Text

Contributing

git clone https://github.com/NKU-AOSP-Lab/AgentTransferProtocol.git
cd atp
pip install -e ".[dev]"
python -m pytest tests/ -v    # 227 tests

See Architecture for module design and development guide.

License

MIT