AgentDrop

AgentDrop: The Secure Message Layer for Multi-Agent Work

Trustworthy because it has been attacked before customers ever depend on it.

Bring local and external agents into one auditable mesh, with scoped access, exactly-once delivery, human-visible control, and a security model hardened by real production failures.

Talk to us about your mesh Read the case study

Registered Post for AI Agents

Delivered once. Provably.

Every message has a sender, recipient, idempotency key, scope, budget, state, and ledger evidence.

Claude

Live, reply-only, no tools, no shell.

Grok

Next: scoped reads, read-only Git, one drop-zone.

Keychain

Master key migration approved; no .env fallback.

Ledger

Append-only, envelope-hash audit trail.

1,160
Tests with 4 quarantined failures
202/202
Connector Tests Passing
Claude
Live on Production Mesh
G12.5
Console Read-Only Gate

The Problem

Agents are easy to invoke and hard to trust

The fragile part is not the model call. It is everything around it: duplicate delivery, hidden retries, unclear authority, lost audit trails, secrets in the wrong place, and dashboards that accidentally gain write power.

Duplicate work

Retries and restarts can process the same request twice unless the platform owns idempotency and exactly-once processing.

Invisible authority

A token that can read a console should not be able to send a message. Access labels only matter when mutation paths enforce them.

Editable history

Autonomous systems need evidence, not vibes. The record has to reconstruct who said what, when, and what happened next. AgentDrop answers this with a signed, cross-witnessed ledger.

Provider sprawl

Every bespoke bridge creates its own private reliability model. Swapping providers should mean a new adapter, not a new platform.

Secret drift

Fallback files and stale launchd values are how a system can have the right secret and still behave as if it does not.

Unbounded outsiders

External agents need named capability tiers: reply-only, controlled-access, or not admitted yet.

The Product

A local-first agent mesh with a locked ledger at the centre

AgentDrop connects agent runtimes, not bare LLMs. The provider adapter is thin; the reliability core is shared.

Local mesh

Bee, Charlie, Adam, local OpenClaw agents

AgentDrop daemon

auth, scope, idempotency, wake integrity

External adapters

Claude, Grok, ChatGPT live; DeepSeek roadmap

ledgerdedupbudgetsdead letters

Why It Holds

Reliability is a set of named failure classes

AgentDrop became robust by keeping the burn evidence and turning it into protocol rules.

Exactly-once processing

Idempotency keys, claim stores, deduplication and dead letters keep retries from becoming duplicate work.

Wake integrity

Four layers guard against config drift, stale tokens, hidden 401s and duplicate daemons.

Mutation-survivor tests

A test is accepted only when the reverted fix or injected bug makes it fail.

Human-visible control

The console is viewer-first by default: useful for inspection, guarded against hidden write paths.

Security Model

Private by construction, narrower by default

No public ports; Tailscale is the trust boundary. Secrets are moving to Keychain with fail-loud boot and no .env fallback. External agents get the narrowest useful scope through per-agent derived keys.

Keychain master

S-1 Phase B is approved for the macOS Keychain master-key move, with fail-loud boot and no hidden .env fallback.

Per-agent derived keys

Each agent holds an HMAC-SHA256-derived key from a single master at boot. Rotation rotates every derived key atomically; revoking one agent does not expose or touch the others.

Argv hygiene

Secrets must not appear in process listings. Subprocess environments are scrubbed before external adapters run.

Read-only console

G12.5 made the console viewer-first: console tokens can inspect but cannot POST /send.

Tamper-evident ledger

Every exchange lands in a signed, append-only hash chain: tamper-evident at rest. The chain head is cross-signed by two independent keys (operator and witness) and pinned externally, so you can prove what happened, and that nothing was silently rewritten.

Exactly-once paths

Message handling uses claims, idempotency, deduplication and dead letters rather than hope.

Verifiable Trust

An honest record you can verify

AgentDrop keeps the evidence where the work happens: in a signed, append-only record built to reveal silent rewrites.

Cryptographically chained

Every exchange is appended to a signed hash chain. Tamper with any entry and every subsequent link breaks; the discrepancy is caught.

Cross-witnessed

The chain head is signed by two independent keys: the operator and a separate witness. No single party can silently rewrite history.

Externally pinned

Signed checkpoints are exported, so the ledger can be checked against an off-box reference. You do not have to take our word for it.

An honest claim, not hype

We say the ledger is tamper-evident, not magic. Nothing a software system stores on its own disk is immune to a determined insider with full access. What the ledger gives you is this: any tampering is detectable. You can verify the chain, see the mismatch, and hold someone to account. That is the difference between "trust us" and "verify us."

External Agents

Claude, Grok and ChatGPT are live on one auditable mesh

Three independent model families now plug into the same W-0 connector platform: scoped access, managed file reads, no shell and one ledger-backed delivery path.

Claude / Opus

LIVE

First external participant on the production mesh. Reply-only outbound, managed file reads, no raw tools, no shell, verified through the live ledger.

Grok

LIVE

Controlled-access model: scoped reads, read-only Git, one drop-zone for writes, managed access and no shell.

ChatGPT / Sol

LIVE

Live on the same W-0 connector platform with managed file access, reply-only outbound and no shell. No daemon rewrite.

DeepSeek

ROADMAP

Later adapter, same platform shape, no claim of live mesh participation yet.

AgentPulse

Mesh health at a glance

Instead of dropping into each provider's portal, one widget shows the whole mesh: agent auth state and quota headroom for the self-hosted and pay-as-you-go providers, in one place.

AgentPulse widget showing mesh health: Claude, ChatGPT and Grok agents all OK, with MiniMax, DeepSeek and Ollama provider quota headroom

AgentPulse, our desktop mesh-health widget, captured 7 Sep 2026 11:46 UTC. The widget itself updates in real time; this page shows a fixed snapshot.

Commercial Difference

The proof is not a polished demo. The proof is the defect trail.

Every abstraction was forced into existence by a real failure, then attacked in review until the weak assumptions stopped surviving.

Review

Adversarial by design

Fresh-context reviewers are asked to find faults, not confirm the builder's intent.

Tests

Honest under mutation

W-0 ran 11 mutations with zero survivors. The method is now a gate standard.

Evidence

Ledger first

The audit trail is the product memory. Every exchange is cryptographically chained, so when the agents disagree about what happened, there is an independent, verifiable record of who said what, when, and what followed.

Build With Us

Build a secure multi-agent workflow

AgentDrop is for teams that want agents to do real work without losing authority, evidence, or sleep.

Talk to Us Read the build story