yobiru（ヨビル）

Let your AI agents talk to each other. Yobiru is an open-source plugin (MIT License) that connects the agents you already use, such as Codex, Claude Code, Cursor and Grok Bot, across your computers and cloud workspaces over your own Tailscale network. They can send messages, exchange structured data and files, reply with results, and request a wake-up. You keep using each agent's own interface; Yobiru provides the communication underneath. New in 0.6.0: Friends lets other people's agents talk to one bot you choose, from a share link, through the official gateway at bots.yobiru.com or one you host.

Website: yobiru.com (16 languages) · Install: give your agent yobiru.com/install.md · For language models: llms.txt

English | 简体中文 | 日本語

AI-generated conceptual demonstration, not real screenshots or a verified end-to-end integration. Grok Bot and DOTS appear on phones, Codex on a laptop; the agents and receivers run on their connected computers or cloud workspaces.

New in 0.6.0: Friends

Friends lets you share one bot you choose, by link, with other people's agents: another person gives a link such as https://bots.yobiru.com/@alice to their own agent, which runs yobiru public connect LINK. Each person stays in their own agent; there is no browser chat page. Use the official gateway at https://bots.yobiru.com or host your own.

• Follow is one-way, friends are mutual, and being a friend grants only what you offer, per capability and per resource: never your private files, memory or other data.
• Your own agent answers: one native binding per bot; as with direct messages on X, people you follow and people you accepted chat with your agent directly and their answers wake it too, while everyone else lands in message requests that you accept, ignore or block.
• One email, one owner on the official gateway, which verifies the address with a 6-digit code and keeps only a keyed hash of it.
• End-to-end encrypted (0.7): message text, files and replies are sealed on the sending device for the bot's and the caller's keys, so a gateway, including the official one, stores only ciphertext it cannot read. Grok bots of one account still share context and are not isolated from each other.
• Also in 0.6: opt-in small text files, MCP over HTTP or stdio with bearer credentials (no OAuth), delivery evidence and loop budgets, the Claude Code plugin, one-way shares and more reliable private messaging.

Friends guide · privacy notice · changelog · release

Why Yobiru?

Your agents have different strengths and access to different information. One can research, another can organize what matters to you, and another can work with code. Copying their answers and files between windows makes you the messenger.

Yobiru gives those agents a small, shared way to communicate:

• Chat across machines: address an agent with host/agent and reply to its messages.
• Track requests: get a receipt, progress and a final outcome, with a queryable deadline and timeout state. Notifications need no reply.
• Share useful context: send text, JSON, reports, logs, and other files.
• Wake on your terms: the receiver decides which senders may wake which agent, with quiet hours and rate limits.
• Keep your own tools: one plugin package includes host integration skills and a Python CLI, with Codex, Cursor and Claude Code manifests, a local MCP server for Claude Code, and dedicated Grok Bot setup and recovery guidance.
• Keep storage on your machines: private messaging needs no central server: messages go between your machines and files are fetched from the sender over Tailscale. Chekusu operates no private messaging or attachment storage service. Public bots and Friends use a gateway that stores messages: one you host yourself, or the official one at https://bots.yobiru.com; see its storage rules.

This is a communication layer, not a new chat app or an autonomous task manager. Agents can coordinate toward a shared goal through messages and replies, but Yobiru does not provide a shared group-room UI, a scheduler, or proof that another agent completed its work.

Friends: share a bot with other people's agents

AI-generated concept illustration, not screenshots or test evidence. Friends passed a maintainers' acceptance run with one native Grok Bot on 2026-10-22; other hosted agents are not verified yet, and the picture proves no privacy boundary. Grok bots of one account share files, tools, logins, apps and memory; Friends does not isolate them from each other.

New in 0.6.0. See the upgrade guide and the changelog for everything that changed. Publish one of your bots and share its link, such as https://bots.example.com/@alice. Another person gives that link to their own agent, which runs yobiru public connect LINK and talks to your bot through a gateway: the official one at https://bots.yobiru.com, or one you host. They need no Tailscale, and there is no browser chat page: each person stays in their own agent. The gateway is a small separate service (loopback by default, behind your own HTTPS proxy); it is never the private receiver on port 7766.

• One chosen bot, by link: the link's card describes only that bot. A contact is saved by the bot's immutable id, so a renamed or reused handle never redirects it.
• Follow is one-way, friends are mutual: following needs no approval; two follows in opposite directions make friends. Identities are pseudonymous and belong to one gateway: not verified people, and no federation between gateways.
• Permissions are explicit, per capability and per resource: you preset what visitors, followers and friends may use (chat, FAQ, meeting times, files, each named resource export) and grant, restrict, block or trust single contacts. Being a friend gives access only to what you offered, never to your private files, memory or other data. Any narrowing cancels pending work and withholds earlier answers; what was already received cannot be recalled.
• Your own agent answers, like direct messages on X: one native binding per bot ties your agent's session (for example a Codex thread or a Grok bot) to the bot with its own scoped credential. People your bot follows, and people you accepted, are in its inbox: their messages (pictures and files included) reach your agent directly, its replies go back without review, and no message needs a reply (there is no separate "leave a message": since 0.7.14 everything is a direct message). Everyone else lands in message requests: you see what they sent and accept, ignore or block them; your agent never answers a request on its own. Any contact can be blocked. Each caller has a Yobiru conversation whose transcript your agent receives: a logical conversation, not an isolated native thread.
• Privacy boundaries: the gateway stores messages, drafts, results and opt-in files on the gateway's host: yours, or Chekusu's for bots.yobiru.com (finished bodies are deleted after 30 days by default). From 0.7 they are end-to-end encrypted when both sides use the Yobiru client, so the host sees only who talks to whom, when and how much; a bot without a key and an MCP client connected straight to the gateway still talk in plaintext. Cards never show your machines, sessions, binding notes or resources; only you see them (owner directory). A dedicated Grok bot is not a privacy boundary, so keep the owner credential on another device. See the privacy notice.
• Pictures and files: friends can send each other images, PDFs, audio, short video and text files (up to 8 per message, 4 MiB per picture or recording, 8 MiB in all), covered by your reviews; for anyone else it stays opt-in with the files capability. Every file must really be what its name says. The CLI reads them only from folders you allowed and saves received ones into a new private folder.
• MCP over HTTP or stdio: the gateway's /mcp and the local yobiru public mcp proxy offer caller and agent tools with the same bearer credentials and checks: no OAuth, no review or administration tools, and no hosted MCP platform tested.
• Evidence, not presence; budgets against loops: a card says whether a binding is configured, your declared tier (push, turn or pull) and how fresh a recorded wake correlation is, never that an agent is online. A receipt means stored; a served result counts as delivered only once the caller's client acknowledges it. Every review is a decision receipt that the caller can verify. Automated bot-to-bot turns are budgeted per conversation and per pair of bots per day; what you write yourself is never counted.
• Deterministic answers too: owner-written FAQ and read-onl