Bridle

Bridle is an open protocol and CLI for connecting your coding agent to a coworker's. It lets one agent push context, queue a task, read another agent's state, or request that a command be run on the other side, with both people opting in and every action checked against a policy before it's delivered. The site's own shorthand is Tailscale for agents. Nothing crosses until both ends have joined and the receiver has granted the sender a scope. It's a small CLI with a hosted coordination service behind it, and the site is explicit that self-hosting is part of the design.

The problem it addresses is that agents today are islands. Your Claude Code session knows what you've been working on, your teammate's Codex session knows their half, and the handoff between them is you pasting summaries into Slack. Sharing a whole repo or environment to fix that is too much access. Bridle gives agents a narrow, typed channel instead, so a teammate's agent can receive exactly the files, notes or tasks you chose to send and nothing else. The alternative people reach for, a shared chat window or a pasted transcript, also loses the structure, so the receiving agent has to guess which parts were files, which were instructions and which were just commentary.

The protocol has exactly four verbs. context.push shares files and notes, task.queue puts background work in someone's inbox, state.read exposes an agent's status, and run.request asks for a command to be executed. Every message is a signed, typed JSON envelope evaluated against the recipient's policy before delivery, and higher-risk operations such as writes and deployments wait for approval on the receiving end. Because the payloads are structured data rather than conversational instructions, there's no channel for a prompt injection to ride in on. Limiting the protocol to four verbs is deliberate. A small vocabulary is what makes a policy meaningful, since there's a finite list of things a sender could ask for.

Using it is a handful of commands. Each person runs bridle up to join a private mesh, the receiver runs bridle grant to set what a sender may do, and then bridle send, queue and ask move work across. bridle inbox and bridle approve handle what arrives, and bridle audit records everything. Any agent that can run shell commands works through the CLI, which covers Claude Code, Codex, Cursor, CI runners and headless systems without vendor-specific integrations. The receiving side stays in control throughout. A scope says what a particular sender may do, an inbox shows what has arrived, and nothing that needs approval runs until someone says so.

Security is designed in rather than assumed. Payloads are sealed to the recipient with X25519 key exchange, HKDF-SHA256 and AES-256-GCM before they reach the coordination server, which routes messages and verifies signatures but can't read contents. Actions must carry a valid signature from a pre-approved key, and the protocol specification is published so someone else can build a compatible coordination server. The coordination layer stores messages in either a JSONL file or Postgres, and because the verbs are fixed and typed, a policy can be written once and reasoned about rather than re-evaluated for every free-text message.

It's for development teams that already run agents per person and want controlled handoffs between them, and for platform engineers wiring agents into CI without handing out shared credentials. It's still early. The spec is at version 0.1, the receive pipeline has had limited testing, live push delivery isn't there yet, and the open-source repository doesn't yet include a coordination server of its own, so self-hosting means building one against the spec. Teams already comfortable running Tailscale will recognise the shape, a small daemon per person, a mesh, and explicit sharing, applied to agents instead of machines. A dashboard at app.bridle.network shows activity for the hosted mesh.

The protocol and the CLI are free and open source under Apache-2.0, published on npm and GitHub. The hosted coordination service, Bridle Cloud, is free for now, with paid tiers planned later, and its dashboard and server aren't open source. For a team curious about agent-to-agent handoffs, the sensible move is to try the free mesh between two people on low-stakes tasks and watch the audit log before granting anything that can write or deploy. The CLI installs from npm as bridle-cli, and the protocol document in the repository is short enough to read in one sitting, which is a good way to judge whether the model matches how your team works.