amp
Agent Messaging Protocol — initiate consented, end-to-end-encrypted, stateful conversations across trust boundaries.
fg-amp gives any participant — agent, human, or service — the ability to initiate a
private, stateful conversation with any other participant, without a shared platform,
a prior relationship, or a trusted intermediary. Delivery infrastructure (relays) only
ever handles ciphertext.
The gap it fills
Adjacent protocols each solve a different problem:
| Protocol | What it gives you | What it lacks for this job |
|---|---|---|
| MCP | Agents get tools | Not a conversation between peers |
| A2A | Agents get a task API | Client-server RPC, TLS-only; remote agents cannot initiate |
| DIDComm | The right envelope | No agent semantics |
| Matrix / XMTP | Real messaging | The wrong identity models |
AMP fills the "spontaneously contact a stranger agent and hold a private, stateful conversation" gap — and composes with the rest rather than replacing them. Inside an AMP session you can carry natural language, structured JSON, A2A tasks, MCP interactions, or x402 payments.
Security model in six points
- Self-certifying addresses.
amp:key:<base58>is the Ed25519 public key — no registry decides who you are. - Agent keys vs owner keys. Agents hold hot, rotatable keys; owners hold cold keys that stay off the wire, linked by signed delegation chains.
- Consent before conversation. A code-enforced
ContactPolicydecides who gets through — deliberately not an LLM decision. - Encrypted from the first knock. Sealed handshakes, then a per-message double ratchet for session traffic.
- Untrusted relays. Relays host only encrypted mailboxes and a signed-card directory; they never see plaintext.
- Domain-separated signatures. Every signature names the artifact type it covers, so artifacts can never be confused for one another.
The caveat that matters most
A valid sender signature proves who sent a message — never that its content is safe to act on. Applications MUST treat message content as untrusted, prompt-injectable input regardless of a verified sender. AMP authenticates the pipe; it cannot vouch for what flows through it.
Known limits (stated, not hidden)
- Sybil resistance is rate-limiting only — identities are free to mint.
- Routing metadata is cleartext —
from,to, andsession_idare visible to relays, so the relay sees the social graph (sealed-sender routing is roadmap). - Groups are a full mesh with no cross-member message ordering; MLS for large groups is roadmap.
- Envelope cap is 1 MiB with no chunking — large payloads go out-of-band via
amp.ref/1pointers. - One identity = one key — multi-device requires sharing a key (roadmap).
Position in the stack
- agent-id — who an agent is (identity, keys, delegation)
- amp — how agents talk (this library)
- agent-knowledge — what a group of agents knows
Status
Distribution fg-amp v0.11.0 · import package fg_amp · wire version amp/0.1 ·
Python ≥ 3.11 · fully typed (py.typed) · 31 test files including golden wire vectors,
ratchet-under-loss, relay hardening, and conformance suites. The wire is frozen at
amp/0.1 until the v1.0 freeze; where code and spec/vectors.json disagree, the golden
vectors are authoritative for byte-level constructions.
Licensing is proprietary (LicenseRef-Proprietary) — no open-source license granted yet.
→ Start with Getting started · Concepts · API reference · Examples