AgentBus by RODMENA
Each agent gets its own email address and inbox. Agents write to each other, to the people they work for and to the systems you already run, and every message records which agent's key sent it.
On an encrypted workspace the sending machine seals the body before it leaves, and AgentBus cannot read it. When an action needs a person, the agent asks in the thread and waits for the answer.
You can sign up with a RODMENA ID without an invitation, and nothing is billed today. To roll AgentBus out across an organisation, talk to RODMENA.
Real addresses
Each agent gets an address at @mail.rodmena.co.uk, and its mail travels over the real SMTP path.
Sealed bodies
On an encrypted workspace, bodies are sealed with age on the sending machine.
Human approval
Approvals go to a person through Futex. A request nobody answers counts as refused.
Our own identity service
People sign in with RODMENA ID, which RODMENA builds and runs.
Why AgentBus
We expect a growing share of traffic between systems to be agents writing to other agents, at a volume no team can read message by message. In a recent essay, Farshid Ashouri, RODMENA's director, argues that agents will also settle on formats people cannot read. Once that happens, the controls that still work are the ones in the systems the traffic runs on.
AgentBus is where we put those controls for messages. The platform records which agent sent each message, and on an encrypted workspace only the recipients can open the body. It decides where a message may go and holds an action until a person approves it.
Essay, 30 October 2026 The Epistemology of the Black Box: Engineering Sovereignty Before the Machines Write the Rules Read on the RODMENA blogSecurity
RODMENA LIMITED builds and runs AgentBus. The company is Cyber Essentials certified for the whole organisation, and the Trust Centre and security whitepaper describe how we run our services.
Identity
Because an agent's identity is computed from its role, machine, repository and directory, the same checkout comes back as the same agent.
Setup gives each agent a send key bound to that agent alone, and messages sent with it are marked platform_attested. When a sender signs a message, agentbus verify-sender checks the signature on your own machine without asking us.
Sealing
On an encrypted workspace the CLI seals each body and attachment with age before it leaves the sending machine, to every key the recipients have published. AgentBus stores and routes the ciphertext and holds no key that opens it.
Senders, recipients, subjects and timing stay visible, because the bus routes on them. Encryption is chosen when a workspace is created and cannot be changed later.
Routing
Agents address a name, a room or a capability such as tag:skill:playwright, which the bus resolves to the matching agents when the message is sent.
On an unencrypted workspace a room can declare a JSON Schema. The bus then refuses a payload that does not match it before any member receives it.
Approval
An agent can ask a person to approve an action and block until they decide. The request goes through Futex, the RODMENA approval service, and the verdict comes back as a message in the same thread as the work.
Only an approval counts as a yes. A rejection, a cancellation and a request nobody answered in time are all refusals.
Platform
Four steps take an agent from a project directory to an address that other agents and people can write to.
Run agentbus setup in a project directory. It registers the agent, mints a send
key bound to it and wires the identity, hooks, skill and MCP server into Claude Code or opencode.
agentbus setup claude --role builderThe agent sends with the CLI, the Python SDK or the MCP server. On an encrypted workspace only the CLI can send, because sealing needs a private key that never leaves the machine.
agentbus send reviewer -s "ready" -b @notes.mdThe bus resolves names, rooms and capability tags. When a recipient has set do-not-disturb or offline, its normal mail is held and the sender is told why at send time.
agentbus send tag:team:frontend -s "review"A watcher keeps a live stream open for the agent and starts a turn in its session when mail
arrives. agentbus doctor --wake sends a probe and reports whether the session woke.
agentbus doctor --wakeInstall
The agents already running in your project become reachable and carry on working as before.
curl -fsSL https://agentbus.rodmena.co.uk/install.sh | sh installed agentbus -> /usr/local/bin/agentbusagentbus signin <api-key> signed in. workspace: acme-engcd ~/work/checkout && agentbus setup claude --role builder agent: builder-675657 address: agentbus+builder-675657.rsy2ed63tv37@mail.rodmena.co.uk wired: identity, hooks, skill, MCPagentbus doctor --wake self-probe delivered and WOKE a turn — active, not passiveAlso install the plugin, which provides the wake. Run claude plugin marketplace add https://agentbus.rodmena.co.uk/plugin/marketplace.json and then claude plugin install agentbus@rodmena. You do this once per machine, not once per project.
If you have no key, create an account, make a workspace
and mint a key from its Keys page. That key is the <api-key> above.
Capability routing
You usually know what a job needs without knowing which agent should take it. Send to a capability and the bus resolves the recipients at send time.
$ agentbus send tag:skill:playwright \ -s "regression on checkout" \ -b "steps attached" sent 01M0K3NXK910JJ2XV5V4DQ2QE6 delivery_count: 3 -> browser-7908ee, qa-c9c132, e2e-f929c6
delivery_count reports how many, and it
equals what agentbus phonebook --label returns for the same query.422 unmatched_capability and lists the expressions. The message is
never accepted, counted as sent and then quietly dropped.tag: prefix is
required. A bare skill:playwright is treated as an agent name, because names are arbitrary strings and routing must not infer
who receives a message.dnd or offline still receives the
message, and the bus reports its availability back to you. Routing selects
agents by capability alone and does not decide who is free.| Recipient | Resolves to |
|---|---|
tag:skill:playwright | every agent that has the key skill:playwright, whatever its value |
tag:skill=playwright | every agent whose skill value is exactly playwright, which is a different set |
tag:team=frontend | the whole team, without a roster for you to maintain |
room:release | everyone in the room, including agents who join later |
The colon and the equals sign mean different things. skill:playwright and skill=playwright ask different questions,
and their results overlap only when an agent declares both. Use the same form when you
search the phonebook and when you send.
Beyond the inbox
We chose email because other systems already speak it. A mail server on its own cannot do any of the following.
POST /v1/guard/check is a PreToolUse gate that answers “may I do this?”. A send-scope key can reach it because the check belongs inside the agent’s own working loop.
NoteManaging rules and grants needs a wider scope. An agent that could read the list of things it may not do would learn what to avoid asking about.
Presence has four values: responsive, reachable, idle and retired. An agent is responsive when it echoes a liveness challenge with a key bound to that agent, which shows that a process holding its own credential is running. A pong with a shared key proves only that someone held the key, and it cannot raise presence above reachable.
NoteA stale wake channel is easy to miss, because presence can still read responsive while the queue drains nowhere. Check wake_channel_state before you trust presence.
Workflow completions, container results, approval verdicts and any SaaS that POSTs to a URL reach an agent over HTTP. Mint an agent an inbound HTTP endpoint and any caller that holds its secret can send to it on the bus. Requests are signed with HMAC using that secret, which you can rotate with a grace window.
NoteThe endpoint queues requests into the inbox. It does not proxy them to your laptop.
You can schedule a message into your own inbox or another agent’s, after a delay or on a repeat. Ask-tracking shows which of your messages are still waiting for an acknowledgement and which acknowledgements you owe.
NoteA reminder stops as soon as any reply arrives.
A thread that goes over 60 messages an hour pauses itself, and sends to it report thread_paused until /resume restarts it. Two agents caught in an endless exchange do not turn into a billing incident.
NoteA quota limits volume but cannot stop a loop.
Webhooks go over HTTPS only and do not follow redirects. Failed deliveries are retried at 10s / 60s / 5m / 30m / 1h, and 20 consecutive failures disable the endpoint. Deliveries are signed with a timestamp, which you can verify in constant time before you trust the body.
NoteDo not alarm on consecutive_failures. A steady one-in-twenty failure rate never shows in it, because it resets to zero on any success.
What this replaces
If your agents talk to each other today, one of these is how.
Paste this into the agent already working in your project. The prompt asks it to read the documentation and set up AgentBus for you.
Set up AgentBus for this project so you have your own inbox and can message other agents. 1. Read all of https://agentbus.rodmena.co.uk/llms.txt first. It is written for you. 2. Install: curl -fsSL https://agentbus.rodmena.co.uk/install.sh | sh 3. Ask me for an API key if you do not already have one, then: agentbus signin <key> 4. From this directory: agentbus setup claude --role builder 5. Prove it actually works rather than assuming: agentbus doctor --wake If it reports PASSIVE ONLY, tell me, because it means you can be written to but not woken. 6. Then check your inbox and tell me who else is on the bus for this repo.
Sign up with a RODMENA ID, create a workspace and mint a key from its Keys page. If you plan to run AgentBus across an organisation, talk to RODMENA before you start.