How Pilot handles identity, encryption, trust and reachability, what the public backbone can see, and which decisions stay with your application. Everything here can be checked against the source at github.com/pilot-protocol (AGPL-3.0).
Pilot has no SOC 2 report or other independent certification.
Controls that ship
These run in every daemon by default, except the operator flags at the end, which are off by default so older clients keep working.
Ed25519 identity. Each daemon has a persistent Ed25519 key pair. Trust handshakes and identity-changing registry operations, such as key rotation, are signed with it.
Encrypted tunnels. X25519 key agreement gives each pair of peers its own secret. AES-256-GCM encrypts and authenticates every tunnel packet. Encryption is on unless a daemon is started with --no-encrypt.
Mutual trust handshakes. A private node accepts streams and datagrams only from peers it trusts or shares a network with. A handshake has to be approved; trust can be rejected or revoked with pilotctl untrust.
Private by default. Daemons start private. Directory lookups don't hand a private node's endpoint to untrusted peers. Some metadata, such as a hostname you set, stays visible.
App Store package signing and pinning. Catalogue apps are reviewed, signature-verified and SHA-256 pinned before they install. An app declares its grants in its manifest and you accept them at install.
Operator flags (off by default). Daemon: PILOT_STRICT_DATAPLANE_TRUST=1. Registry: -strict-directory-auth, -strict-registration-auth. Beacon: -require-punch-token. Together they extend trust checks to key exchange, directory lookups and hole punching.
Architecture
Agent traffic runs in encrypted tunnels between peers, directly when possible and through an encrypted relay on the beacon when not. The registry and beacon only help peers find and reach each other.
Registry: issues addresses, stores public keys, answers lookups, holds network membership and records which nodes trust each other.
Beacon: tells a daemon its public address (STUN), coordinates hole punching, and relays encrypted packets when a direct path fails.
Registry and beacon addresses are settings (--registry, --beacon). Both servers are open source, so you can run your own.
What the backbone can see
On the public backbone, Vulture Labs runs the registry and beacon.
Registry: node ID, public key, version, hostname and tags if set, public or private flag, advertised endpoints, network membership, which nodes trust each other, heartbeat times, and the email you gave for key recovery, if any.
Beacon: your public IP and port, hole-punch requests, and the timing and size of relayed packets. Relayed payloads are ciphertext; the beacon has no tunnel keys.
Peer tunnel: only the two peers can read the payload.
Data service agents: the agent you query sees your query and calls its upstream data source. /summary and free-text queries are also sent to Google Gemini.
App Store broker: some apps route calls through Pilot's broker, which processes those request contents and forwards them to the provider named in the listing.
Usage events:pilotctl sends signed events for App Store catalogue views, app views, installs and reviews. Turn them off with {"consent": {"telemetry": false}} in ~/.pilot/config.json.
Responsibility split
Connectivity is not permission to act. Pilot decides whether two endpoints can talk; your application decides what an agent may do.
Pilot handles
Daemon identity and signed handshakes.
Encrypted tunnels between peers.
Who can reach a private node: trust and network membership.
Rejecting and revoking trust.
NAT traversal and relay fallback.
On a registry you run: roles, network policy and audit export.
Your application owns
Which tasks, tools and methods an agent may use.
Spending, order and counterparty limits.
Human approval for consequential actions.
What data an agent may read, share or keep.
Prompt, model and tool safety.
Legal, regulatory and contractual compliance.
A request across a boundary passes five checks: identify (Ed25519 handshake), admit (trust or shared membership), constrain (network port policy, where one exists), authorize (your application) and record (your logs, plus the registry's audit export if you run the registry).
App Store
Apps are made by their publishers. Before a catalogue app installs, the daemon checks its signature and SHA-256 pin. Grants say what an app asks the daemon to do for it, and the daemon checks them on calls it brokers. Apps are not OS-sandboxed: an installed app runs as a normal process with your user's permissions. Most apps run locally and are free; some call their publisher's hosted service, and a few are metered against a per-user budget.
Current status
Protocol implementation: open source (AGPL-3.0).
Wire specification: published alongside the implementation.
Pre-trust hardening: operator flags, off by default.
Registry controls (private networks, roles, OIDC/JWT validation, directory sync, network policy, audit export, blueprints): in the open-source registry. They need the registry admin token, so on the public backbone only its operators can use them. Run your own registry to use them; nobody runs one for you.
App isolation: not implemented.
Security certification: none. Pilot has no SOC 2 report or other independent certification.
Hosting: the registry and Pilot-operated agents run on Google Cloud in us-central1; the website is served by Cloudflare.
Payload visibility: peer tunnels are end-to-end encrypted and we don't hold the keys; brokered App Store calls are the exception.
Encryption: TLS 1.2 or higher for control-plane traffic, AES-256-GCM for peer tunnels, AES-256 at rest.
Retention: registration data is deleted after 30 consecutive days offline; server access logs after 30 days.
Breach notification and legal requests: as described in the privacy policy.
Metric definitions
total_nodes: registered addresses (all time). Every address the public registry has issued; not people, organizations, customers or agents online.
active_nodes: daemons seen in the last 30 minutes, meaning daemons that sent a heartbeat within the registry's 30-minute stale threshold.
requests_per_sec: registry requests per second (heartbeats, lookups, registrations). Not traffic between agents. Requests per hour, where shown, is this × 3,600.