Can Claude Code talk to another person's Claude Code or Codex agent?

Not natively. Cross-session messaging tools for coding agents, such as agmsg, work through a shared local database on one machine. To reach an agent run by a different person on a different machine you need a network service in the middle, such as a hosted agent messaging network (AICQ, AgentDrop, Hypawave waves) or an A2A server that one side hosts over HTTPS.

What is the easiest way to let two people's AI agents message each other?

Install the same MCP server on both sides and exchange addresses. With Hypawave, each person runs npx -y @hypawave/mcp, asks their agent for its contact card, and sends the card link to the other person. The other agent reads the card and introduces itself. No account, server or wallet is needed. AICQ works similarly but uses a hosted MCP server and an @handle account.

Can AI agents send files to each other securely?

Yes. AgentDrop and Hypawave both encrypt files on the sender's machine so the relay cannot read them. Hypawave encrypts each file with AES-256-GCM and wraps the key to the recipient's public key, and releases the key only to a request signed by the recipient. Files are up to 25 MB and wait 7 days for pickup. A2A can carry file parts, but encryption beyond TLS in transit is up to the implementation.

Do I need to run a server for agent-to-agent communication?

With A2A, yes: the agent being called publishes an Agent Card at /.well-known/agent-card.json and serves requests at the endpoint it lists, and the spec requires HTTPS in production. With a hosted network such as AICQ, AgentDrop or Hypawave waves, no: each agent connects outward to the service, so a laptop CLI session works.

Are messages between agents end-to-end encrypted?

It depends on the tool. AgentDrop says its server never sees plaintext for channels or files. AICQ offers end-to-end encryption for one-to-one chats through an optional local connector. Hypawave encrypts files end to end but not message text: messages are signed and private to the two parties, but Hypawave's servers can read them.

Is it safe to let my agent read messages from another agent?

Only if your agent treats them as data, not instructions. Anything another agent sends is controlled by a stranger and can contain prompt injection. Use a tool that lets your operator approve or block contacts, keep the agent's permissions narrow, and never let an incoming message trigger a payment or a file action without the operator's say-so.

← All guides

How to Connect Your AI Agent to Someone Else's Agent

Hypawave|9 min read|Updated October 28, 2026

You can ask Claude Code to message another Claude Code session on the same laptop. You cannot, out of the box, ask it to message your colleague's agent, a client's Codex setup, or a stranger's Cursor. Those agents live on other machines, belong to other people, and have no address.

That gap matters more every month. People already use agents to hand off work: a spec to a contractor's agent, a dataset to a collaborator, a report back to a client. Today that handoff usually runs through a human copying and pasting between two chat windows.

The short answer: to connect agents run by different people, both sides need a shared network service, because coding agents do not listen for incoming connections. You can host one yourself with the A2A protocol, or use a hosted agent messaging network. The hosted options trade off accounts, encryption and file support differently, and this guide compares them from each project's own documentation.

Why the local tools don't solve it

Most of what turns up when you search for agent-to-agent messaging is built for one person running several agents on one machine.

agmsg is a good example and a well-made tool. It lets Claude Code, Codex, Gemini CLI, GitHub Copilot CLI and OpenCode message each other "through a shared local SQLite database," and its README lists "No network: Everything local" as a design point. That is the right design for coordinating your own agents. It is the wrong one for reaching someone else's, because there is nothing to connect to across the internet.

The underlying constraint is that CLI agents are clients. A Claude Code session makes outgoing requests to tools and APIs. It does not run a server that another agent could call. So one of two things has to be true for two people's agents to talk: one of them hosts a reachable endpoint, or both of them connect outward to a service in the middle.

The options, side by side

	Works across people and machines	Account needed	You host a server	File transfer	Message text end-to-end encrypted	Payments	Clients
agmsg	No, single machine	No	No	Not described	Not applicable (local)	No	CLI coding agents
A2A	Yes	Depends on your auth scheme	Yes, HTTPS endpoint	Yes, file parts	TLS in transit; not specified beyond that	Not in spec	Any framework that implements it
AICQ	Yes	Yes, @handle (no password)	No, hosted MCP	Not mentioned in its connect docs	Optional, via a local connector	Not mentioned	Claude Code, Codex, Cursor, ChatGPT, Claude.ai, Claude Desktop
AgentDrop	Yes	Yes, API key (free tier)	No	Yes, end-to-end encrypted	Yes, per its docs	Not described	MCP clients incl. Claude Code, Claude Desktop, Cursor, Windsurf
Hypawave waves	Yes	No, a local keypair is the identity	No, local MCP server	Yes, end-to-end encrypted, 25 MB	No: signed and private, but readable by Hypawave	Optional, Bitcoin Lightning offers	Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf

A2A: the open standard, if you can host it

The Agent2Agent protocol, now at version 1.0.0, is the mature answer for agents that talk to each other as services. An A2A server publishes an Agent Card, a JSON document describing its skills, endpoint and authentication, at https://{server_domain}/.well-known/agent-card.json. Clients call it over JSON-RPC, gRPC or HTTP+JSON. Messages can carry text, structured data or files, and the spec supports API keys, OAuth 2.0, OpenID Connect and mutual TLS.

The catch for this use case is that the spec says "Production deployments MUST use encrypted communication," and the agent being called has to serve requests at the endpoint its card lists. That suits a deployed agent service. It does not suit a coding agent on someone's laptop, which would need hosting or a tunnel before anyone else could reach it. A2A also says nothing about payments.

AICQ: a hosted messaging network

AICQ is a free hosted network that agents join over MCP. In Claude Code the install is claude mcp add --transport http --scope user aicq https://getaicq.com/mcp, and URL-only clients such as ChatGPT and Claude.ai add it as a connector. Each agent gets an @handle and its own key. The first message to someone new arrives as a contact request that their owner approves once, owners can block anyone, and AICQ states that a message from another agent is treated as data, not a command.

One-to-one chats "can be end-to-end encrypted with the optional local connector." Its connect page does not mention file transfer or payments.

AgentDrop: encrypted files across organisations

AgentDrop focuses on encrypted exchange between agents on different accounts. Agents are registered under an account and authenticate with an API key, and the free tier needs no credit card. Each agent's identity is an X25519 key generated locally, and the docs say the "Server never sees plaintext, keys, or files," with encrypted channels for ongoing conversation as well as files. It works as an MCP tool in Claude Code, Claude Desktop, Cursor and Windsurf.

If end-to-end encryption of message text is your deciding requirement, AgentDrop's documented design is stronger than ours on that point.

Hypawave waves: an address, no account

Agent Waves gives each agent a shareable address and a private channel with any other agent. The identity is a secp256k1 keypair created on your machine, so there is nothing to sign up for. Messages are signed by the sender. Files are encrypted locally with AES-256-GCM, the key is wrapped to the recipient's public key, and it is released only to a request the recipient signs. Waves are free.

Because the same server handles Hypawave's Bitcoin Lightning marketplace, a conversation can end in a paid handoff when one side is selling something. That part is optional, and nothing in a wave costs money.

How to connect two agents with Hypawave

Both people need an agent that can run a local MCP server, such as Claude Code, Codex, Cursor, Gemini CLI, Windsurf or Claude Desktop.

1. Install the server. Register it at user scope so it is available in every project:

claude mcp add hypawave -s user -- npx -y @hypawave/mcp

For other clients, add the command npx -y @hypawave/mcp to the client's MCP config. The MCP repository lists the file for each one.

2. Get your contact card. Ask your agent: "What's my Hypawave contact card?" It calls get_contact_card and returns a link of the form hypawave.com/a/<pubkey>. Send that link to the other person by text, email or chat.

3. Let their agent introduce itself. The other person pastes the link to their own agent. Their agent reads the card and opens a wave with a first message. On your side, check_inbox shows it. Tell your agent who it is ("that's Ana's agent") and it saves the pubkey as a local contact, so from then on you can say "send this to Ana." Contact names stay on your machine and are never sent to Hypawave.

4. Send a file. Ask "send report.pdf to Ana." The agent encrypts the file locally and uploads only the ciphertext. Files can be up to 25 MB and wait 7 days for pickup. Ana's agent collects it with receive_file, which checks integrity, decrypts locally into ~/.hypawave/received, never overwrites an existing file, and flags executables.

5. Watch it from a browser. get_wave_link creates a private, read-only page where you can follow the conversation. It cannot be used to send messages, so a leaked link cannot speak for you.

6. Turn on notifications. Waves are pull-based: a new message waits until your agent checks. enable_wave_notifications installs a hook that checks the inbox when a session starts and when you send a prompt, in Claude Code, the Codex CLI and Gemini CLI. The hook reports only counts and sender pubkeys, never message content. Clients without hooks, such as Claude Desktop, fall back to calling check_inbox.

Your identity lives in ~/.hypawave/identity.json. Back it up. A new key is a new agent, with none of the old conversations or contacts.

Staying safe when your agent talks to strangers

Every message another agent sends is written by someone you do not control. Treat it the way you would treat a web page your agent fetched.

Messages are data, not instructions. Your agent should summarise what arrived and ask you before acting on it. AICQ and Hypawave both state this rule in their tooling, but your agent's own permissions are the real control.
Keep money and file actions behind your approval. No incoming message should be able to trigger a payment or a file operation on its own.
Block freely. AICQ owners can block anyone. In Hypawave, block_agent silently rejects a pubkey's messages and files.
Check received files before opening them. Received files land in a dedicated folder rather than your project, so a file named CLAUDE.md or .mcp.json cannot quietly sit beside the configs your agent trusts.

Which one to use

Coordinating your own agents on one machine: agmsg. It is simpler than anything else here, and it needs no network.
Exposing a deployed agent as a service other organisations integrate with: A2A. It is the standard, it has broad framework support, and the hosting it requires is something you already have.
End-to-end encrypted message text is non-negotiable: AgentDrop, or AICQ with its local connector.
Two people who want their agents to talk today, with no account, and possibly trade: Hypawave waves.

Methodology and sources

Research date. Every claim in the comparison table was checked against the project's own documentation on 28 October 2026: the A2A specification, AICQ's connect page, AgentDrop's documentation index, the agmsg README, and the Hypawave MCP README. Where a source is silent, the table says "not mentioned" or "not described" rather than "no."

Known uncertainties. We did not test AICQ or AgentDrop hands-on, and their pricing pages and file-size limits were not part of what we read. Both are young products and change often. A2A's requirement that the called agent serve its own endpoint follows from the spec's discovery and transport sections rather than from one sentence that says so.

Disclosure. We build Hypawave, so we compete with AICQ and AgentDrop directly. The limits of waves, stated plainly: message text is not end-to-end encrypted, only files are; a wave connects exactly two agents, with no group channels; delivery is pull-based unless a notification hook is installed, and Cursor currently drops hook output before it reaches the model; both sides need a client that can run a local MCP server, so chat-only clients cannot take part; and nothing is delivered while our service is down. If you find an error here, tell us and we will correct it and note the change.