Whitepaper · PDF

The PACT protocol, in full.

The normative specification for Personal Agent Communication & Trust: how agents identify each other, how contacts are exchanged and approved, what tools a contact may call, how a person moves between hosts without losing anyone, and how calls stay sealed where an edge terminates TLS.

Version 2.2.0Format PDF, A4Status Released specification

PACT

Personal Agent Communication & Trust

Protocol Specification · Whitepaper

Version 2.2.0
pact-protocol.com

What's inside

Architecture
Identity, certificates and mTLS
Contact cards (vCard)
Invites
Adding contacts
The agent MCP server and its tools
Messaging and threads
Permissions
Hosting
Deployment
Security notes and what was left out
Errors, limits, conformance
Sealed envelopes
Certificates
Worked examples and test vectors

Get the whitepaper

Tell us who you are and the PDF downloads immediately. Tell us what interests you, and we will write when pact-gateway ships or a PACT Cloud beta place opens — nothing else.

Name *

Work email *

Company or project

Role

What interests you most?

Roughly how many people?

What would you use it for?

We store what you enter, the country Cloudflare reports, and when you download — to send you the whitepaper and beta updates, and nothing else; never shared. Reply to any email from us and we'll delete it. Privacy.

Your whitepaper is ready.

We will email you about what you chose, and nothing else.

Download the PDF →

The link works from this browser for seven days.

An open network, or a closed one.

Almost every difference between PACT and other agent protocols comes down to one choice. A2A and ANP assume a stranger may find and call your agent. PACT assumes nobody reaches you until both of you have said yes.

Open network: A2A, ANP

Agents publish what they are and can do, and anyone can find and call them. That needs discovery, capability advertising and negotiation with strangers, and every stranger is a caller.

Closed network: PACT

There is no directory. A relationship starts from a card or an invite and exists once both people approve it. A stranger reaches a guest tier of two tools, ten calls an hour by default.

How PACT compares.

PACT is the only protocol in this survey that holds together an identity the person owns, a consent gate, a per-caller capability surface and instant revocation, with encryption that survives a terminating edge. It also loses rows, and they are shown.

Property	PACT	A2A	MCP	ANP	DIDComm v2	Matrix
Identity the person owns, not the host	✓	◐	✕	✓	✓	✓
Both people consent before any contact	✓	✕	✕	✕	◐	◐
Keys exchanged and pinned	✓	◐	✕	✓	✓	✓
What a caller may do is computed per caller	✓	✕	◐	✕	✕	◐
Revoke a contact instantly	✓	✕	✕	◐	✓	✓
End-to-end encrypted past a terminating edge	✓	✕	✕	✓	✓	✓
Forward secrecy	✕	✕	✕	✓	✕	✓
Open discovery of strangers	⊘	✓	◐	✓	◐	✓
Store-and-forward relay	⊘	◐	◐	◐	✓	✓
Ecosystem adoption	✕	✓	✓	◐	◐	✓

✓ has it◐ partial✕ missing⊘ declined by design

Declined is not missing. A directory, open discovery and a relay are what a network needs when it has no consent gate. PACT replaced them with one human act, so it scores them ⊘ on purpose: adding them would delete the premise.

Where it genuinely trails. Forward secrecy at the envelope layer is deferred, with the path recorded in the specification. Adoption is early: two implementations, both from one project, against large ecosystems for A2A and MCP.

From the project's landscape survey of 2026-09-22, read against each protocol's own specification.

What the protocol refuses.

The specification decides what an endpoint must refuse, and conformance holds both implementations to it. The live intrusion battery built 27 attacks from those rules: forged or malformed identity chains, replays and wrong times, tampered and downgraded envelopes, and strangers reaching past the guest tier. Both implementations refused all 27, and one control message that must get through did. Measured on 2026-09-20.

A chain is exactly two certificates, leaf then root; a lone self-signed certificate is refused

A refusal to a stranger is indistinguishable from a refusal to someone you blocked

A replayed envelope is acknowledged, never run twice