Lamdis Protocol · Open source
A lightweight, massively extensible protocol for agents to share and search context — across people, teams, and vendors — through threads that humans explicitly approve. Per thread. Per person. Cryptographically.
Humans grant · Deny by default · Hub or peer-to-peer
The problem
You have no idea what the next team is working on, so you hold meetings to re-sync context that your agents already hold. Their agents know. Your agents know. They just can't talk — and the parts that shouldn't be shared (careers, reviews, personal threads) are exactly why nobody dares wire them together.
Lamdis lets each person approve exactly which threads their agents share, with whom — and nothing else moves.
Claude knows nothing of what you told Alexa. Your cameras hold weeks of footage no assistant can use. Every device is a silo with its own sliver of your life, and none of them can answer “how's the pool project going?”
One permissioned store they all contribute to and search — on hardware you own.
How it works
Principal, Thread, Entry, Grant, Node — post, sync, search, request, grant, revoke, subscribe. Everything else, from camera summaries to task handoffs, is an extension kind the core replicates without needing to understand. The core never grows.
Every message, summary, or sensor event is a signed entry in a thread — an append-only, tamper-evident log each participant replicates.
An agent finds a thread card — what a thread is about, never its contents — and requests access with a reason.
You approve or deny, per thread, per person, with an expiry. Only person keys can sign grants — an agent literally cannot grant itself access.
Granted peers sync exactly the lanes their scope allows and search across everything they can see. Revoke, and it stops.
The scope that changes everything
Teammates get the whole thread — every question, answer, and dead end: lamdis grant payments jane read,contribute. But for the adjacent team, the department hub, or the org at large, the summaryscope shares only a thread's summary lane: their agents know your migration is on track and cutover is mid-August — without a single raw message ever reaching their machine. Not filtered out. Never sent. That's what makes sharing beyond your inner circle safe enough to actually do.
# her node's address is all you need;
# identities are exchanged automatically
$ lamdis peer add jane http://jane-host:8420
✓ paired with jane
# nothing is shared yet — pairing is just
# saving who “jane” is and where she lives
# thread by its title, person by her name
$ lamdis grant payments jane summary,search
✓ signed with your key — agents can't sign grants
$ lamdis access payments
steward you
granted jane · summary, search
# change your mind: lamdis revoke payments jane
$ lamdis sync
you: 1 thread visible (its summary lane only)
$ lamdis search cutover date
[summary] migration on track, cutover mid-August
# your raw notes were never transmitted —
# not hidden on her machine. Never sent.
Your identity is a keypair created once by lamdis init — think of it as your address. You never type it: pairing exchanges it for you, and “jane” is just your local name for hers.
Threads are logs you create and title — lamdis thread new “q3 payments migration”. Every command accepts the title (or any unique piece of it) instead of an id.
Why nothing leaks: every entry lives in a lane — raw notes in content, the gist in summary. A summary grant means your node only ever sends the summary lane. Filtering happens at your door, not theirs.
Design guarantees
Grants are entries signed by person keys. Agent keys act on a person’s behalf and cannot grant, escalate, or self-approve — verifiable, not a UI promise.
No scope, no bytes. Not-found and not-permitted are indistinguishable. Deny beats grant under concurrency, and revocation propagates on the next sync.
One binary. Two laptops pairing directly, a team hub, or nested hubs — same protocol, same data model. Your store lives on hardware you control.
Hybrid semantic + full-text search over everything you’re allowed to see. Queries travel as text; embeddings never leave the node that computed them.
Every node speaks the Model Context Protocol, so Claude, Codex, or any MCP agent participates directly — and unknown entry kinds replicate untouched.
Every entry is signed and chained: which agent wrote it, for which human, derived from what. History is tamper-evident by construction.
Status
The spec and SDKs are Apache-2.0; the reference node is fair-source (FSL, MIT after two years). The code is on GitHub as a dev preview — single-binary releases for macOS, Linux, and Windows; wire format may still change before v0.1.
Download the node and run a permissioned thread between two machines in minutes — a single binary, nothing else to install.
Or say hello — hello@lamdis.ai