AI agents can't trust each other
Not Anymore...

// 1. Acquire token via OAuth client-credentials flow
const tokenRes = await fetch('https://idp.example/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    grant_type: 'client_credentials',
    client_id: process.env.CLIENT_ID,
    client_secret: process.env.CLIENT_SECRET,
    scope: 'agent.send',
  }),
});
const { access_token } = await tokenRes.json();

// 2. Set up TLS client cert (mutual TLS)
const httpsAgent = new https.Agent({
  cert: fs.readFileSync('./agent.crt'),
  key:  fs.readFileSync('./agent.key'),
  ca:   fs.readFileSync('./ca-bundle.pem'),
});

// 3. Verify recipient exists, fetch its public key
const recipientMeta = await fetch(
  `https://registry.example/agents/${recipient}/jwks`
);
if (!recipientMeta.ok) throw new Error('Recipient not registered');
const { keys } = await recipientMeta.json();
const recipientPubKey = keys[0];

// 4. Encrypt message with recipient's public key
const encrypted = crypto.publicEncrypt(
  recipientPubKey,
  Buffer.from('Hello from agent!')
);

// 5. POST over mTLS with bearer token
await fetch(`https://peer.example/inbox`, {
  method: 'POST',
  agent: httpsAgent,
  headers: {
    'Authorization': `Bearer ${access_token}`,
    'Content-Type': 'application/octet-stream',
  },
  body: encrypted,
});

// Plus: token refresh logic, cert rotation,
// JWKS rotation, retry on 401, revocation checks...

// 1. Load identity from your env-file.
const { HexaEight, currentKgt } = require('@hexaeight/sdk');
const he = await HexaEight.connect({ envFile: './env-file' });

// 2. Derive the destination key. Works even if the
//    recipient hasn't been provisioned yet.
const ask = await he.fetchSharedKey('peer.example.com', currentKgt());

// 3. Encrypt. Move the bytes however you like.
const ciphertext = await he.encryptTo('peer.example.com', 'Hello!', ask);

// That's it. The recipient decrypts with their own password.
// No certs. No tokens. No key exchange. No coordination.
// Transport-agnostic — HTTP, MQTT, queue, USB, whatever.
// Identity-bound. Quantum-safe.
// Transport is auto-discovered from DNS TXT.
// Forward secrecy via 15-minute key rotation.
// Encryption to many recipients in one ciphertext.

Anywhere Node.js, Python, or .NET runs.

The founder's tagline, Authenticated Encryption Anywhere and Everywhere, is the literal product spec. One Mode 1 license, one machine, anywhere your language runtime ports. Concrete scenarios below.

Count the lines in your agent's auth code.
Then let your AI assistant write the HexaEight version.

Point Claude Code, Cursor, GitHub Copilot, or any coding agent at /llms.txt. It's a structured spec your agent can read and act on. The integration writes itself.