Questions & Direct Answers

Architecture & Features

Claude Code has agent teams now. Why would I want this?

Agent teams are teammates inside one session, on one machine, sharing a task list. Echo does not bridge or read that channel. If everything you run is one session on one machine, that may be all you need. Echo coordinates across machines, vendors, and separate sessions with shared tasks, leases, messages, and reservations. Those records are subject to expiry and broker retention; Echo does not keep agent processes running or guarantee automatic restart after a crash or reboot.

What do I actually have to run?

Today, a multi-machine self-hosted net uses an operator-managed NATS JetStream broker with TLS and credentials, plus echod on each host. The planned one-machine installer will manage a private loopback broker and echod for you; it is not publicly released. The hosted service is also planned, with no public enrollment yet.

What happens when the server is down?

Local work and cached inspection can continue. Outgoing messages queue on disk for delivery after the daemon reconnects, subject to retention and expiry. Task claims need the daemon and shared server to arbitrate ownership; a cached task list is not permission to start work. Leases can expire while a machine is disconnected.

What happens when a developer's laptop goes to sleep or loses WiFi?

Local queues survive a disconnect and the daemon reconnects when the network returns. Retained messages can then be delivered, subject to their expiry and the server's retention settings. Delivery time depends on connectivity and backlog. A worker must check its lease before resuming a task; reconnection does not restore expired ownership.

What happens if a process crashes, and what durability does echo.cc guarantee?

On Linux (Ubuntu, Debian, Fedora), local writes, moves, and removals synchronize directory metadata via fsync, propagating errors. Process-kill tests with a single-replica SyncAlways broker verified that five accepted messages survived abrupt broker and daemon termination, and consumer recreation replayed against seen records without re-inserting messages into the inbox. Simulated storage errors prevented broker acknowledgement until storage was restored. Native macOS was tested for local namespace operations only.

Tested local receipt subject to storage and retention settings does not ensure completed model execution: an agent crashing mid-turn leaves the message delivered, and replay can repeat tool side effects. Windows omits directory metadata sync, Windows audit export-before-prune durability remains open qualification work rather than a shipped capability, process tests do not establish survival across physical power loss or hardware cache eviction, multi-message inbox drain contains partial batch move errors by halting callers fail-closed, and durable staged receipts across post-rename uncertainty or prompt failures remain open qualification work rather than a shipped guarantee. See Storage Durability & Crash Recovery for full boundaries.

Can I use echo.cc across remote networks, Tailscale, or cellular hotspots?

It has been tested on a six-host fleet over WireGuard and Tailscale, including a Windows laptop on a cellular hotspot, which ran a 10-message benchmark. The agent CLI (ecc) works on local files, so a dropped network does not block a turn; the daemon (echod) reconnects and delivers queued mail that has not expired. Short benchmarks over Tailscale delivered 48 to 77 messages a second with median round trips of 3.7 to 7.0 ms. The connection is encrypted only when TLS is configured.

What does it cost me on a turn where nothing happens?

One directory read. No network call, and no text added to the context. That is the reason for the daemon: this runs on every turn of every session, so the quiet case had to be close to free.

Can another agent make my agent do something?

Not by default. Mail arrives labelled as information rather than as instruction, and whether a session acts on it is a choice you make per session, inside whatever sandbox and approval rules that session already has. In testing, a driven Codex session refused a relayed request, which is the behaviour we wanted. This is an observed test result for that runtime, not a universal guarantee for every agent.

What stops two agents answering each other all night?

A hop limit on every message, a send budget per member, a window that drops repeats, and a cut that stops a runaway pair on every machine at once rather than on the one that noticed.

What happens if two agents claim the same task?

One gets it. The decision is made in a single place with an atomic compare-and-set. The other is told who owns the lease. If that lease expires, another worker may take over. The old worker must stop editing: rejecting its stale completion does not stop its filesystem writes.

Why use Codex, agy, or Claude Code instead of calling model APIs directly?

For echo.cc, the advantage is reusing a complete coding agent. Given a task such as fixing a failing test, a coding agent can inspect the repository, edit files, run the test, and use the result to decide what to do next. A raw model API is one component of that workflow. Building an equivalent agent around it means owning the tool execution, context management, permissions, and continuation logic yourself.

Keep the working environment and the human workflow. The agent works with the checkout, installed tools, and project instructions you already use. Depending on the agent and configuration, it also brings saved sessions, skills, MCP connections, and approval controls. You can inspect and steer work through the agent's own interface. Exact capabilities and automation modes differ between Codex, agy, and Claude Code.

Let each layer do its job. Vendors maintain their coding runtimes; echo adds addressing, durable messages, presence, task leases, and file reservations across agents and machines. That lets us focus on coordination instead of maintaining another implementation of every vendor's coding loop. Echo uses hooks, MCP, and structured process interfaces where supported; for example, its Codex driver uses the app-server protocol. Adapters still need compatibility testing as agents change.

Choose direct APIs when you need to own the runtime. They can be a better fit for an embedded product, high-concurrency service, or workflow needing precise control over individual requests and tools. An SDK or API exposing a complete agent runtime can preserve many of the same benefits as a CLI. Coding CLIs themselves still call model services; they are not inherently cheaper, faster, or more capable than every API-based alternative. The practical gain for echo is less runtime engineering and continuity with the agents people already use.

Vendor background: Codex CLI capabilities and how Claude Code works.

Will it work with the agent I use?

Claude Code and Codex have hook adapters. Claude Code, Codex, and Google DeepMind Antigravity (agy) can also run as driven child processes through ecc run --drive. On Linux, ecc run accepts only --resource-aggregate-cgroup /echo.slice/echo-workers.slice and must start inside that preconfigured cgroup. Echo checks membership and finite limits, and guarded Linux runs also require a live root-owned guard socket. The guard is available in source but is not installed by setup and has not completed native VM qualification. Note that echo.cc has no driven adapter for the standalone Gemini CLI. A client that speaks MCP over stdio can join without shell hooks; Claude Code, Goose and OpenCode (a smoke test) have been exercised, and Cursor, Windsurf and Claude Desktop have not been qualified. Idle wake requires either hook integration or a driven CLI that accepts new turns on standard input; in source-qualified driven sessions, local admission checks halt turn delivery when a conversation or configured pool is quota-exhausted or uncertain, requiring operator reconciliation.

Which agent CLI works best as a coordinator?

There is no universally best coordinator: no single CLI or model family is superior across all roles, and echo.cc does not claim one. Current recorded dogfood evidence demonstrates that an OpenAI Codex coordinator on Linux can drive a Google DeepMind Antigravity (agy) worker across file holds, task leases, and verification loops. Each runtime brings distinct trade-offs: Codex provides JSON-RPC app-server adapter integration with unit-tested steering and sandbox controls (live-server mid-turn steering under burst load remains unqualified); Antigravity (agy) provides autonomous multi-turn tool loops with project permission binding; and Claude Code provides structured stream-json turns (interactive tool approvals are a property of interactive sessions, not headless driven worker runs). A matched comparison across all coordinator roles under identical tasks remains open. Choose runtimes based on your team's existing tooling, permission models, and platform support.

How does the MCP server work, and what tools does it expose?

Running ecc mcp starts a Model Context Protocol server over stdio, built on the official Go SDK. A client that speaks MCP over stdio connects without shell wrappers; Claude Code, Goose, OpenCode (a smoke test) and the Go SDK client have been exercised, and Cursor, Windsurf and Claude Desktop have not been qualified. Its tools cover identity (echo_whoami), presence (echo_ls), messaging (echo_send, echo_inbox, echo_read), file reservations (echo_hold, echo_holds, echo_release), tasks (echo_tasks, echo_task_add, echo_task_claim, echo_task_renew, echo_task_done, echo_task_block, echo_task_drop) and campaigns (echo_campaigns, echo_campaign). It also serves the context resources echo://whoami, echo://roster, echo://holds and echo://tasks, so a client can read net state into prompt context without a tool call. The client's tools/list call returns the argument schemas. A successful echo_task_claim returns the exact task.fence and task.attempt. Long jobs use echo_task_renew with that tuple; expired or replaced claims are refused. A repository-scoped claim also returns repository_reservation with the reserved scope; the holding field lists only local advisory holds. Check that the returned scope matches task.repo_scope. Pass the fence and attempt to echo_task_done with the task ID and evidence; stale tuples are refused.

Can I use echo.cc entirely through MCP without running terminal commands?

Yes, in a client that speaks MCP over stdio: add ecc mcp as a server in its MCP settings. The agent can claim shared tasks, see who is online, read mail, place file reservations and send messages through MCP tool calls, without terminal access or shell hooks. Idle wake still needs hooks or a driven CLI. Claude Code, Goose and OpenCode have been exercised; Cursor, Windsurf and Claude Desktop have not been qualified.

Does echo.cc work with frontier and local AI models?

ecc ask and ecc peer have provider code for OpenAI, Google Gemini, Anthropic and local Ollama instances, through one standard-library provider layer. Live qualification against each provider is still open.

Can I use DeepSeek, Groq, Mistral, or OpenRouter with ecc ask?

There is provider code for them. Besides OpenAI, Anthropic, Gemini and local Ollama instances, ecc ask and ecc peer can reach OpenRouter, DeepSeek, Groq and Mistral through their OpenAI-compatible APIs, and live qualification is still open. They detect their respective environment keys (e.g. DEEPSEEK_API_KEY, GROQ_API_KEY, OPENROUTER_API_KEY).

How do custom software and bots integrate with the net?

Invoke supported CLI commands from your language's process API or use ecc mcp. Inspection commands such as ecc tasks --json return structured output. Use the CLI or MCP mutations for messages, holds and tasks instead of writing an incomplete JSON envelope or editing replicated task state directly.

Is there a hosted version of echo.cc (cloud.echo.cc)?

The managed cloud service is planned and public cloud enrollment is not live yet. cloud.echo.cc describes the proposal; app.echo.cc is a static dashboard design preview. ecc login saves local connection settings; it does not issue credentials, verify access, or provision a service. Multi-machine self-hosting currently requires your own operator-managed NATS broker, TLS configuration, and administrator-provided credentials, while a planned single-machine managed loopback prototype remains in qualification.

What is pro.echo.cc vs cloud.echo.cc?

pro.echo.cc redirects to cloud.echo.cc, the planned managed-service offering. The public pages are previews, not evidence of available team accounts, SSO, dedicated deployments, or compliance certification.

How does file reservation interact with git and prevent collisions?

Different machines use separate local checkouts; joining a net never grants automatic filesystem access, repository access, or execution authority. A successful repository-scoped task claim reserves its repository-relative paths across hosts and worktrees; its response reports the scope as repository_reservation. echo_hold, echo_holds and the holding response field describe checkout-local advisory holds. Participating pre-tool edit hooks can refuse local-hold conflicts with ECHO_HOLDS=enforce. Check that repository_reservation matches task.repo_scope; if it is missing or unexpected, do not assume the shared lease was acquired. Holds are advisory records, not filesystem locks or a substitute for isolated worktrees and git review. Unchecked shell commands and other tools can still write to held paths.

For cross-machine code exchange, a proposed collaboration model defines sharing through operator-approved Git remotes pinned to immutable commit IDs, Git bundles as an offline fallback, and standalone history-free artifacts for non-Git or path-scoped sharing; path-scoped grants explicitly do not authorize Git history transfer. Foreign commits and artifacts are never automatically checked out, merged, or executed. Cross-team federation is a proposal and is not implemented.

What happens if an agent tries to edit a held file?

Supported pre-tool hooks warn by default and refuse checked conflicts when ECHO_HOLDS=enforce is set. The hook must be installed and cover the editing tool. ecc hold can record a reservation and warn about a conflict while returning success; ecc holds lists reservations and does not signal conflicts through a nonzero exit status. Custom gates must inspect the records and apply an explicit policy.

Does echo.cc guarantee my agents write correct code, or prevent architectural mistakes?

No. Atomic task claims and repository-scoped path leases coordinate compliant agents, but do not stop an old worker's filesystem writes. Local file reservations rely on participating edit hooks. Completion evidence is submitted by the worker: echo does not execute the supplied command or attest to its output. Check artifacts, source revisions and test results independently, and review the implementation.

How are messages and commands secured across untrusted networks?

Configure TLS and, where required, client certificates on the self-hosted broker and daemon; deployments may use token or mTLS alternatives. In our six-host internal fleet, the broker client port requires TLS 1.3 with a pinned, operator-run fleet CA and per-client JWT authentication, verified with 30/30 daemon smoke deliveries, and plaintext fallback is disabled on the broker (ECHO_ALLOW_INSECURE affects client policy only and cannot enable plaintext on a TLS-required broker). This provides server-authenticated transport encryption and client authentication, not mandatory mTLS, end-to-end topic encryption, or cross-tenant federation. Enforced messages require member-key signatures. Set ECHO_ENCRYPTION=required on every endpoint to seal signed direct messages for certified recipients with HPKE; topics are refused in this mode. The broker still sees routing metadata, and local queues remain plaintext. Encryption is under validation and awaits independent security review. Wire validation rejects dangerous terminal controls, but ordinary text can still carry prompt injection. Path and role checks govern participating echo operations, not arbitrary shell commands or OS file access.

How does granular team RBAC and cryptographic member identity work?

ecc cert issue creates Ed25519-signed member certificates with roles and path scopes (--allow and --deny). Enforcement requires ECHO_RBAC=enforce and a configured trusted authority. These checks apply to supported echo operations. They do not sandbox the agent process. Signed revocations take effect as each daemon receives and validates them; disconnected hosts cannot receive them immediately.

What is the organizational security model: single operator or team-ready?

A net administrator manages a shared trust root, member certificates, and revocations. Protect the authority private key separately from agent workspaces and provision broker credentials per machine. Certificate revocation and broker credential revocation are separate operations. Corporate directory sync, self-serve human invitations, automatic update installation, and federated organizational trust are not available. Different machines operate on separate checkouts; joining a net grants no automatic execution or repository access. Cross-team collaboration through approved Git remotes, immutable commits, fallback bundles, and history-free artifacts is a design proposal, not shipped functionality. Agents with the same OS permissions as the daemon may be able to read its files; use OS isolation where that boundary matters.

How does distributed tracing with OpenTelemetry work across agents?

CloudEvents envelopes support W3C traceparent and tracestate. Carrying trace context lets integrations correlate work. It does not by itself install an OpenTelemetry collector, export spans, or provide a trace visualization service.

How does echo.cc relate to the A2A (Agent-to-Agent) protocol?

The site publishes an agent-card manifest. A manifest alone does not implement an A2A task endpoint or demonstrate protocol conformance. Current integration paths are the local CLI and MCP server; echo transports its own CloudEvents records over NATS.

Is it open source, and what will it cost?

The source is not public yet. It will be published with the first release, and the licence for that release is not final; the repository carries FSL-1.1-MIT today, with a change to MIT specified in that licence. The proposed Cloud Team price is $20 per active agent seat per month; paid hosted service is not available to purchase. Final pricing and enterprise features remain uncommitted.

What happens to my email address?

It gets one message when there is something to install, and nothing else. It is not sold, shared or used to train anything, and one person reads the list. Your IP address is recorded to rate-limit the form and deleted by the first waitlist request that arrives over an hour later. The site sets no cookies and stores nothing in your browser. The whole privacy notice is here.