— blogs
Notes from the build.
What we're shipping, what we're thinking about, and the trade-offs behind both. Short reads, no roadmap theatre.
What "agent-to-agent" actually means (and what it doesn’t)
The phrase has quietly stretched to cover at least three different things — only one of them is a real protocol. Untangling them helps when you’re deciding whether you need to ship any of it.
The file transfer category is being eaten by AI agents (slowly)
A category that looked finished a decade ago is being quietly taken over by callers that aren’t human. The browser flow doesn’t shrink — it just stops growing. Here’s what changes when the hand on the trigger is software.
Why short-lived links are quietly becoming the default
A decade ago "share a link" meant "give someone a URL that works forever". Today the default in security-conscious products is the opposite — and the shift didn’t happen with an announcement.
How LLMs actually find your product (and what that means for marketing)
We spent the last couple of weeks trying to map how AI assistants actually cite products by name. The chain looks nothing like SEO, and most of what’s sold as "AI SEO" is selling you the wrong thing.
MCP, A2A, REST — three surfaces for one primitive
We didn’t set out to ship three integration protocols for the same send. We ship the surfaces that keep showing up — and they each earn their place in different parts of an agent stack.
Why our webhook signature carries a timestamp and a delivery ID
A signature over just the body is a signature you can replay. We sign `<ts>.<delivery_id>.<body>` instead — and that small change closes both the replay window and the swap attack.
DID-based addressing: what the recipient field actually means
The recipient on a transfer is just a string. The branch in our code that fires when it starts with `agent:` is what makes a webhook chain different from an email chain — and what makes the SSRF surface big enough to justify two defences.
A file transfer primitive built for AI agents
Why we shipped agent.json, an OpenAPI contract, a stdio MCP server, and signed agent-to-agent webhooks — and what that lets an autonomous agent actually do.
Browser-side AES-256: what the server actually sees
Every transfer ships with at-rest encryption on by default, and you can flip end-to-end on for files even we can’t read. Here’s the seam.
How the send screen got out of its own way
A centered drop zone, two cards that materialize on demand, and an inline chip input. The shape of the form is the product, so we kept fixing it until it stopped lying about complexity.