Open source
Open source
Public today
The repositories
Four repositories: the protocol with its specifications and reference implementation, the reference relay, and two clients.
Protocol site: atsms.at (identity did:web:atsms.at, Bluesky @atsms.at).
- Apache-2.0
3numlabs/atsms
Encrypted group messaging on AT Protocol identities, with no server ordering anything. Specifications and TypeScript reference implementation.
- Apache-2.0
3numlabs/atsms-worker
Reference relay for ATSMS: store-and-forward for sealed envelopes on Cloudflare Workers. Carries bytes it cannot read.
- Apache-2.0
3numlabs/atsms-demo
Browser client for ATSMS: encrypted DMs, groups and calls, using the Bluesky account you already have. A proof of concept.
- Apache-2.0
3numlabs/atsms-cli
Terminal client for ATSMS: a small REPL over the @atsms/client SDK, short enough to read in one sitting.
The reference Gateway Node (the bridge to the phone network), the agent runtime that answers bridged calls, and the protocol site's own deployment are built and running but not yet published. They come out as one release once the operator-deployment wrapper is separated from the reference code. The operator playbook, the document that explains how to stand up an operator end to end, is being written.
A proof of concept, not a product. The cryptography has not had an independent security review. We have built it carefully and the core is a port of published research, checked automatically against the original implementation, but nobody outside the project has audited the composition. That review is a requirement before any of this carries traffic that matters. Until then, treat it as something to study, not something to rely on.
- Nothing is published to npm. The
@atsmsscope is reserved and empty. - What we already know is wrong: KNOWN-ISSUES.md
- The brief we would hand a reviewer: review-scope.md
Where we need help
Three kinds of second opinion
If you build on AT Protocol
If you want open encrypted messaging in your app, we would like your help maturing the specifications. Interfaces get better when a second implementer finds the places where they are ambiguous.
If you are a cryptographer
We would like your help auditing ATSMS. The composition is the novel part: sealed sender over a concurrent group key agreement. The repository carries our known-issues list and a brief covering what we think is worth attacking.
If you run telecom infrastructure
Read the operators page. The reference Gateway Node is the part of the stack that needs a second pair of hands with a carrier interconnect.
Most of the code in the ATSMS repositories was written by an AI, under direction, and we say so in the repository rather than leaving anyone to work it out from commit history. The project was designed so that you do not have to trust its authors, whether they are people or models: the port is checked byte-for-byte against the upstream implementation, the specifications are normative, and the review that would earn trust has not happened yet for either kind of author. The full note: AI.md.
Security issues: see security. Everything else: an issue on the relevant repository, or [email protected].
Build on it, run it, or audit it.
The specifications, reference nodes and clients are public. If you build on AT Protocol, run telecom infrastructure, or review cryptography, we would like to hear from you.