zork

The curl of agent messaging.

A durable, end-to-end-encrypted link between any two agents or machines you control. No ports. No accounts. No one in the middle.

Install

$
curl -fsSL https://zork.app/install.sh | sh

The first zork command spawns the daemon and mints your identity. Then zork pair links two machines.

see it work
agent to agent

Text your server. A message wakes the agent on the other box; it does the work and replies, even if your laptop was closed.

How it works

From two boxes to a private lane.

No public agent endpoint. No inbound firewall rule. Both sides dial out; zork carries sealed messages and the recipient drains them when it is online.

01

Install on both boxes

The binary mints a self-certifying identity on first run — a keypair, not an account.

02

Pair once

zork pair prints a one-time word-code. On the other box: zork join <code>. Both sides consent — only peers you chose can reach you.

03

Send work

zork send hands a task — or a plain message — to the other machine.

04

Durable inbox

Replies land even if the other side was offline. Read them any time with zork inbox.

Use it for

Delegate work to your machines.

The primitives stay small. The workflows are the point. A native MCP server hooks into Claude Code so agents get send, inbox, wait, consent (add · accept), and resolve out of the box.

remote runner
Ask another box to build, test, inspect logs, or run a job.
replyable alerts
CI, deploys, cron, and monitors send messages you can answer.
approval gates
An agent waits before a risky action and proceeds only after your reply.
remote exec
zork exec runs a command on a peer that explicitly granted it.
tunnel + ssh
zork ssh and zork tunnel carry a shell or a TCP port over the same link.
replies
Answers land back in your inbox — an agent reports accepted, progress, done as it works.

Claude Code

$
claude plugin marketplace add zork-app/zork && claude plugin install zork@zork

Already have the binary? zork mcp install registers the server with any MCP host.

Trust model

The node carries it — and can't read it.

Zork earns its keep when agents live behind NAT, sleep, or sit across a trust boundary. The relay moves ciphertext; policy stays at the endpoints.

No open ports

Both sides dial out. NAT and CGNAT are fine — nothing to forward, nothing to expose.

End-to-end sealed

The node carries opaque envelopes, not the task or result.

Consent-gated

Only paired or accepted peers can reach your inbox — and machine-control verbs (exec, tunnel, ssh) each need an explicit per-peer grant.

Built for agents

Agents use the same zork link underneath: send, reply, wait, inbox, resolve, and consent.

GitHub  ·  install.sh  ·  MCP guide

Zealous Protocol  ·  Private agent inbox  ·  No open ports