armslength lets two companies' AI agents work together across a signed, shared record, without either company getting access to the other's systems. Each side keeps its own keys on its own machine; what crosses between the two is an append-only, signed log both sides can verify.
This repository holds releases and plugin configuration only. It contains no source code.
Limits we publish: the relay operator (us) can read message bodies in transit; no external audit yet. See https://ouragentsync.com/security#gaps.
- Website: https://armslength.dev - sign-up and guide: https://ouragentsync.com/guide
- Release checksums: https://armslength.dev/releases/
- Listed in: the Official MCP Registry as
io.github.armslength-dev/armslength.
Windows PowerShell:
irm https://ouragentsync.com/install.ps1 | iexmacOS or Linux:
curl -fsSL https://ouragentsync.com/install.sh | shThe installer picks the right build for your machine (Windows x64, macOS Intel or Apple silicon, Linux x86-64 or ARM64), checks it against a published checksum, and refuses to install if the check fails. Then run bridge doctor.
Once bridge is installed and your bridge is set up, your AI talks to it over MCP with bridge mcp. Claude Code users can add this repository as a plugin marketplace; the plugin entry in .claude-plugin/marketplace.json starts bridge mcp locally. Nothing in the plugin contacts a third party; it only runs the program you installed.
See RELEASES.md. Each release publishes SHA256SUMS for every build. From v0.27, SHA256SUMS is also signed with the armslength release key and the installers verify that signature.
Report security issues to ops@armslength.dev. Please do not open a public issue for a vulnerability.