# agentixmesh

> agentixmesh is a file-based delivery layer that lets AI agent sessions on
> the same machine exchange messages without a message's content becoming a
> command. It separates identity (a kernel-verified sender OS user id) from
> authority (what the receiving agent is obligated to do) — an incoming
> message is always inert DATA, never an instruction the receiving agent
> must obey.

## Scope and boundary

agentixmesh runs on a single machine. Its core is same-user collaboration —
one OS user running multiple Claude Code, OpenAI Codex CLI, or similar sessions on one host —
and, because delivery is just a maildir plus an inject step, the protocol is
harness-agnostic: any agent tool that can read and write files can take part.
Cross-user messaging between separate OS users on the same machine is validated
end-to-end (the sender's uid is kernel-verified; the message body is withheld
until a human releases it) and ships in the public repository; turning it on in
production stays a deliberate, human-gated step. Cross-machine delivery and the
higher-authority layer (leader-gate co-approval, group roles, consent-gated
monitoring) exist by design but are roadmap — not advertised as production
security.

## Cost

Checking the mesh for new messages costs zero LLM tokens — it is a file
read, controlled by mesh-poll (on/off/status). Tokens are spent only when
a message is delivered into an agent, and that is disclosed. Forwarding to
a human channel is free. "Free" here means LLM tokens; hosting and compute
are separate. Details: [How it works — token cost](https://agentixmesh.ai/en/how#token-cost)

## Concepts

- [Confused deputy](https://agentixmesh.ai/en/docs/concepts/confused-deputy/)
- [Agent trust layer](https://agentixmesh.ai/en/docs/concepts/agent-trust-layer/)

## More

- [How it works](https://agentixmesh.ai/en/how/)
- [The problem](https://agentixmesh.ai/en/problem/)
- [Trust model](https://agentixmesh.ai/en/trust/)
- [agentixmesh vs MCP](https://agentixmesh.ai/en/vs-mcp/) — adjacent layers, not rivals:
  MCP connects a model to its tools and context; agentixmesh is the trust
  boundary between already-running agent sessions. Use both together.

## FAQ

- [Does agentixmesh work with agent tools besides Claude Code?](https://agentixmesh.ai/en/faq/) — yes; harness-neutral, with Claude Code and OpenAI Codex CLI adapters (Codex end-to-end verification in progress).
- [What is agentixmesh?](https://agentixmesh.ai/en/faq/) — an agent trust layer that separates kernel-verified sender identity from authority.
- [Can a message trick an agent into running commands or leaking secrets?](https://agentixmesh.ai/en/faq/) — no message can force it; forgery is eliminated, prompt-injection is reduced but not removed.
- [Why not just use a message queue like Redis or RabbitMQ?](https://agentixmesh.ai/en/faq/) — a queue moves bytes; agentixmesh adds kernel-verified sender identity and inert-data framing.

## Source

Open source under the MIT license: https://github.com/TokonoMix/agentixmesh

## Family (related tools by the same team)

- [Tokonomix](https://tokonomix.ai) — cross-vendor LLM consensus and model
  routing: ask Claude, GPT and Gemini side by side with one key.
- [AgentsWeaver](https://agentsweaver.ai) — cross-machine, cryptographically
  signed agent mesh; the scale-up step beyond one machine.
- [DCP — Development Coordination Protocol](https://devcopro.org) — an open,
  vendor-neutral protocol for exchanging development-coordination events
  between AI agents and humans.
- [ZelixAI](https://zelixai.ai) — embeddable AI chat and RAG for websites
  (the assistant on agentixmesh.ai runs on it).