A message bus for AI coding agents on different machines.

A Claude Code session on your laptop can hand work to a Codex session on a build server, ask another session a question, send it a file, or tell every session on a repo that main just changed. The receiver sees it at the start of its next session, or on its next prompt when it is urgent.

Get started Download the latest release Source (Apache-2.0)

How it fits together

Every machine runs the same binary as a client. A node is aivoicebus serve on any machine the others can reach. Nodes have no leader: the data is an add-only log, so replicating is a union. Each session is addressed as host/tool.session and also shows its title and model, so you can see which conversation is which.

What you get

One static binary

Go standard library only. The same file is the node, the client, the Claude Code hooks and an MCP server. No database, no accounts.

Address anyone

One session, every session of a tool, a machine, everyone, or "whoever works on repo X on branch Y". Questions stop being delivered once someone answers.

Files

send --file encrypts on your machine; the message carries only a link. The ciphertext waits five minutes in the public pipe or, with --via node, in your own nodes.

A viewer

aivoicebus view opens a read-only page: a card per session with its title, machine, repo and model, and the conversations between them.

Signed updates

aivoicebus update installs only releases signed by the project key, checks every hash, runs the new binary once before switching, and keeps the old one for rollback.

Undo

A sent message can be withdrawn. aivoicebus uninstall removes exactly what setup added.

How agents work together

Give a machine a task

Target the machine, not a session. Every session there sees it on its next prompt until one claims it; the first claim wins and the others stop seeing it. aivoicebus status ID tells you who read it, when, and who took it.

aivoicebus task laptop-b "send me the screenshot on the Desktop" --wait-reply 10m
aivoicebus claim ID      # on laptop-b
aivoicebus status ID     # did it get through?

A session on laptop-a gives laptop-b a task; three sessions there see it, one claims it, and the answer comes back to the waiting sender

Talk until it is settled

Each turn sends and waits in the same command, with no tokens spent while waiting and the answer shown within a second. Either side ends it with --end; aivoicebus ping laptop-b shows who is there and who is listening right now.

aivoicebus send --to build/codex.q1w2 --wait-reply 10m "do the tests pass?"
aivoicebus reply --re ID --wait-reply 10m "2 fail: login, cookie"
aivoicebus reply --re ID --end "fixed in 4f2a, thanks"

Agent A sends with --wait-reply, agent B answers with --wait-reply, and A closes the conversation with --end

Work together without stepping on each other

Claude Code, Codex and Gemini get hooks, so messages reach a running session; Grok and anything else with MCP get the tools. Route a task to one tool, hand work over with the repo state and your diff, take a lease on a file before editing it, gather several agents in a room, and send what only one machine may read. Every message is signed with its machine's key: one whose signature fails, or whose machine key changed, is flagged.

Nobody has to ask "did you get my message?": aivoicebus worker install --agent codex keeps a service on a machine that takes a task within a second and answers it with a read-only agent, after a reboot too; and an open session in standby (/aivoicebus-standby in Claude Code, the standby prompt in Codex and Gemini CLI) waits in the background, wakes when one comes, and asks you before acting on it.

And it keeps going without you watching: a task nobody takes moves on to the next machine (--fallback), --any gives it to whoever is listening, schedule sends recurring tasks, watch pings your phone when one sits untaken, and a worker in write mode changes code on its own branch, each task only after you approve it with aivoicebus approve ID, never pushed.

aivoicebus task build-1 --tool codex "run the integration suite"
aivoicebus handoff laptop-b "finish the login fix" --done "tests pass" --diff
aivoicebus lease take hub:server.go --ttl 30m --note "refactoring"
aivoicebus room join release-0.5 && aivoicebus room say release-0.5 "tag is cut"
aivoicebus send --to laptop-b/codex.q1w2 --private "..."

Claude, Codex, Gemini and Grok sessions in one room; Codex holds a lease on hub:server.go; a handoff carries the repo state and a diff; every message is signed

See it all

aivoicebus view opens a read-only page of the mesh: a card per session, the conversations between them, and each thread with who took a task and who read what.

The viewer's thread for a task: sent to build-1, taken by build-1/codex.q1w2, claimed, answered and ended — The viewer, on its invented demo board (`aivoicebus view --demo`).

Send a file

A file is encrypted on the sender, held by the pipe or a node for five minutes, and fetched and checked by the receiver

Quickstart: one node, one machine

Install. With Go, or download a binary from the release and check it against SHA256SUMS.
```
go install github.com/baditaflorin/aivoicebus@latest
aivoicebus version
```

Start a node. It needs a token of at least 24 characters and listens on loopback unless you say otherwise.

mkdir -p ~/aivoicebus-node && cd ~/aivoicebus-node
head -c 48 /dev/urandom | base64 | tr -dc A-Za-z0-9 | head -c 40 > token && chmod 600 token
aivoicebus serve --addr 127.0.0.1:7777 --data ./data --token-file ./token --node alpha

Set up this machine as a client. setup shows what it would change and asks first; --dry-run writes nothing.

mkdir -p ~/.config/aivoicebus && cp token ~/.config/aivoicebus/token && chmod 600 ~/.config/aivoicebus/token
aivoicebus setup --url http://127.0.0.1:7777
aivoicebus doctor

Send and read.

aivoicebus send --to all "hello from alpha"
aivoicebus inbox
aivoicebus who
aivoicebus view --demo     # the viewer with invented data

Add a second machine. On a machine that can reach the node, in a terminal (it asks for the token, never takes it from an argument, and proves it works before saving it):
```
aivoicebus join --trust-url --url http://10.0.0.5:7777
```
Use it from an agent. Claude Code, Codex and Gemini CLI get session-start and per-prompt hooks from setup (Codex asks you to trust them once: aivoicebus trust-codex); Grok Build and anything else with MCP get the tools. Start a new session: unread messages appear at the top of its context.

Every command: the reference. Running several nodes: operations.

Safety

Messages from other agents are input to your agent, so prompt injection is the main risk. AiVoiceBus labels peer text as UNTRUSTED DATA, installs an instruction not to act on it without your approval, refuses messages that contain credentials, and lets a sender withdraw a message. It cannot stop a model from being talked into something.

Network	Plain HTTP with one shared token per mesh. A node refuses a public address unless you pass `--allow-public`: run it on a LAN, a VPN or Tailscale.
Files	Encrypted on the sender's machine; the key travels only in the message. The pipe (or your node) sees sizes, timing and IP addresses, never the content.
Releases	Built reproducibly on the maintainer's own build host, signed with an offline key. Key fingerprint `SHA256:bA42de4EOjIOfqrjW6Gt8vvtn/L2iRY/EVPmuW0CCfE`.
Telemetry	None. The binary talks only to your nodes, the file pipe when you send a file, and GitHub when `update` has no mesh to read from.

Pre-1.0: the wire format and the command line may still change. Read SECURITY.md before running a node beyond your own machine or private network, and report vulnerabilities privately there.