Your agents. Your network.
Your rules.

IronMesh is a layer, not a competitor.

It sits under the agent frameworks and protocols you already use — giving them a transport that survives a router reboot, a dead ISP, or no internet at all.

Three ways to run IronMesh.

Pick the one that matches what you're building. Each opens a fast-path into the docs.

Every agent protocol assumes you're online.

We looked for a way to make AI agents talk to each other on a local network. There was nothing.

If you need the internet to be optional.

Two axes matter for this decision: offline-first (can your agents keep running without the cloud?) and mesh-shape (can they reach each other without a broker?). Pick the axis that matches your deployment.

Security isn't a feature. It's the architecture.

NaCl / libsodium crypto — the same library as Signal and WireGuard. Not homebrew. Not "encrypt later." Not "TLS is enough."

Install, run, first encrypted message.

No account. No config file. Every line of output below is from a real run on a stock Python install — play / pause to watch it at your own pace.

Three peers talking. Zero cloud.

The operator console — embedded in every node, reachable at http://127.0.0.1:8766 with a per-session bearer token. The same handshake diagram from the spec, lit live for the selected peer. Encrypted A2A dialogue turn-by-turn in the feed. CSP-locked to same-origin so the page renders with the router unplugged.

Live capture: laptop (Windows) ↔ Raspberry Pi 5 (Ollama) ↔ NAS (Ollama hermes3:3b). A2A dialogue: three turns, ended on goal-achieved.

End-to-end source authentication + invite tokens + domain-separated HELLO signatures.

v0.9.5 is a security-hardening and onboarding release. The inner end-to-end source signature is now verified on receive in a bound form — a relay can no longer redirect, replay-relabel, or re-attribute a message crossing it — and single-use invite tokens (ironmesh invite create, with QR transport) let a new node join without the mesh passphrase ever leaving the inviter. It also introduces the ironmesh/0.9 protocol line: the HELLO signature now carries a dedicated domain-separation context, and on the Reticulum transport a HELLO is cryptographically bound to the RNS link it arrives on — closing a cross-protocol signature-reuse surface and coupling the IronMesh identity to the link session. The at-rest storage key moves from a single unsalted SHA-256 to Argon2id + HKDF, so a leaked disk image no longer allows a fast offline dictionary attack on the passphrase; existing databases re-encrypt automatically on first start.

Every wire change is additive and version-gated with a legacy fallback — the new HELLO signature scheme and RNS link binding activate only when both peers advertise ironmesh/0.9+. The v0.9.5 daemon announces ironmesh/0.9, and peers still advertising ironmesh/0.8 keep interoperating, so every v0.8.x and v0.9.x peer remains interoperable. Rounding it out: per-peer / per-identity buffering caps on RNS links, a hash-pinned lockfile with a blocking mypy gate and CI check-actually-ran guards, a first-run golden-path key resolver with encrypted-by-default keys, and a docs-accuracy pass. 1420 tests green across the Ubuntu + Windows + macOS matrix. No operator action required — drop-in upgrade.

Full card-by-card breakdown of the domain-separated HELLO signature, RNS link binding, buffering caps, Argon2id storage KDF, and the supply-chain gate lives in the release notes rather than on this page. Read the full release notes on GitHub ›

Pre-audit hardening + Ed25519/X25519 dual-use migration + signed capability advertisements.

v0.9.4 was a combined release: the originally-planned v0.9.3 security point release (strict TLS, trust-store at-rest encryption, global rate cap, trust CLI) shipped alongside a substantial pre-audit hardening pass. Phases 1 and 2 of the Ed25519/X25519 dual-use migration landed together — the v3 master-seed keystore + the HELLO x25519_public_b64 advertisement with an Ed25519 binding signature. Signed CAPABILITY_ANNOUNCE closed the relay-impersonation gap, plus a frame-length ceiling, JSON depth guard, replay upper bound, CVE-2020-10735 mitigation, narrowed exception handling, and fail-closed TOFU. Wire format stayed at ironmesh/0.8, additive only. Full write-up: v0.9.4 release notes.

The per-card breakdown of the master-seed keystore, HELLO X25519 advertisement, signed CAPABILITY_ANNOUNCE, at-rest trust-store encryption, and the hardening bounds lives in the v0.9.4 release notes rather than on this page. Read the full release notes on GitHub ›

1.0 prep mega-release. Conformance, OTel, capability-aware routing, handshake skip on identified Links.

v0.9.2 was the largest pre-1.0 ship: a wire-stable feature-flag system, a server-driven Stage-1 skip path on identified Reticulum Links (three round-trips saved on LoRa), shared-secret group broadcast for cross-host fan-out, capability-aware routing (Agent.send_to_capability(...)), OpenTelemetry spans on every public Agent surface, a formal threat model and conformance test suite, and the v1.0 stability promise. Wire format moved to ironmesh/0.8 with additive-only fields — every v0.8.x peer continues to interoperate. Full write-up: v0.9.2 release notes.

The per-feature breakdown — wire-stable feature flags, the Stage-1 handshake skip on identified RNS Links, shared-secret group broadcast, capability-aware routing, OpenTelemetry spans, and the formal threat model — lives in the v0.9.2 release notes rather than on this page. Read the full release notes on GitHub ›

The handshake.

Mutual passphrase auth, signed ephemeral ECDH, channel binding. Three stages. Zero trust assumptions. The same diagram renders live inside the operator console — click any peer row and watch the stages go green in real time.

What three machines actually look like.

Zoomed out from the handshake. This is a typical IronMesh deployment — one laptop, one Raspberry Pi, one off-grid LoRa node. Each machine runs the same daemon; the transports between them differ. mDNS on the LAN, Reticulum over radio to the off-grid node.

Real numbers from the v0.9.4.x release gate.

Every number below comes from the release-hardening test suite. No projections, no “up to” claims. Runs fine on a Raspberry Pi Zero 2 W with 512 MB RAM. The performance figures were measured at the v0.9.4.x release gate; only the test count is refreshed for the security-hardening v0.9.5 release.

Objections, answered directly.

Before you install, the eight questions evaluators actually ask.

Four months. Twenty-one releases. No breaking changes.

Patch-level discipline: every v0.8.x peer stays interoperable, and the v0.9.x line stays additive-only — the wire protocol advanced from ironmesh/0.8 (v0.9.2) to ironmesh/0.9 (v0.9.5), version-gated so older peers keep negotiating the common feature set. Scroll through what each drop brought.

Built for people who don't trust the cloud.

Running IronMesh somewhere real?

v1.0 ships when the protocol is proven in real deployments, not on a calendar. A two-line note about your setup — where it runs, what it talks to, what broke — is the single most useful thing that moves the roadmap.