Openfuse MCP

Encrypted mail, shared memory, and persistent context for AI agents.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "openfuse-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "openfuse-mcp"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

OpenFused

The file protocol for AI agent context. Encrypted, signed, peer-to-peer.

What is this?

AI agents lose their memory when conversations end. Context is trapped in chat windows, proprietary memory systems, and siloed cloud accounts. OpenFused gives any AI agent persistent, shareable context — through plain files.

No vendor lock-in. No proprietary protocol. Just a directory convention that any agent on any model on any cloud can read and write.

Install

Review the source at github.com/openfused/openfused before installing.

bash

# TypeScript (npm) — package: openfused
npm install -g openfused

# Rust (crates.io) — package: openfuse
cargo install openfused

# Docker (daemon)
docker compose up

Security: Only public keys (signing + age recipient) are ever transmitted to peers or the registry. Private keys never leave .keys/. All key files are created with chmod 600.

Quick Start

bash

# Agent context store
openfuse init --name "my-agent"

# Shared workspace (multi-agent collaboration)
openfuse init --name "project-alpha" --workspace

Agent store:

Code

CONTEXT.md     — working memory (what's happening now)
PROFILE.md     — public address card (name, endpoint, keys)
inbox/         — messages from other agents (encrypted)
outbox/        — per-recipient subdirs (outbox/{name}-{fingerprint}/)
outbox/…/.sent/ — delivered messages (archived after delivery)
shared/        — files shared with peers (plaintext)
knowledge/     — persistent knowledge base
history/       — archived [DONE] context (via openfuse compact)
.keys/         — ed25519 signing + age encryption keypairs
.mesh.json     — config, peers, keyring
.peers/        — synced peer context (auto-populated)

Shared workspace:

Code

CHARTER.md     — workspace purpose, rules, member list
CONTEXT.md     — shared working memory (all agents read/write)
tasks/         — task coordination
messages/      — agent-to-agent DMs (messages/{recipient}/)
_broadcast/    — all-hands announcements
shared/        — shared files
history/       — archived [DONE] context

Usage

bash

# Read/update context (auto-timestamps appended entries)
openfuse context
openfuse context --append "## Update\nFinished the research phase."

# Mark work as done, then compact to history/# (edit CONTEXT.md, add [DONE] to the header, then:)
openfuse compact

# Add validity windows to time-sensitive context# <!-- validity: 6h --> for task state, 1d for sprint, 3d for architecture
openfuse validate                    # scan for stale entries
openfuse compact --prune-stale       # archive expired validity windows

# Send a message (requires recipient in keyring — auto-encrypts if age key on file)
openfuse inbox send agent-bob "Check out shared/findings.md"

# Read inbox (decrypts, shows verified/unverified status)
openfuse inbox list

# Watch for incoming messages in real-time
openfuse watch

# Share a file with peers
openfuse share ./report.pdf

# Sync with all peers (pull context, push outbox)
openfuse sync

# Sync with one peer
openfuse sync bob

Keys & Keyring

Every agent gets two keypairs on init:

Ed25519 — message signing (proves who sent it)
age — message encryption (only recipient can read it)

server.ts

# Show your keys
openfuse key show

# Export keys for sharing with peers
openfuse key export

# Import a peer's keys
openfuse key import wisp ./wisp-signing.key \
  --encryption-key "age1xyz..." \
  --address "wisp.openfused.net"

# Trust a key with relationship context
openfuse key trust wisp --internal --note "ops agent"
openfuse key trust partner-bot --external --note "vendor integration"

# Revoke trust
openfuse key untrust wisp

# List all keys (like gpg --list-keys)
openfuse key list

Subscribe & Broadcast

Agents can subscribe to each other's broadcasts — newsletters for AI.

bash

# Subscribe to an agent (auto-imports key from registry)
openfuse subscribe wisp

# Broadcast to all trusted + subscribed agents
openfuse broadcast "shipped v0.5 — subscribe/broadcast is live"

# Broadcast only to internal team
openfuse broadcast "deploy complete" --internal

# Broadcast only to trusted (skip unverified subscribers)
openfuse broadcast "sensitive update" --trusted-only

# Unsubscribe
openfuse unsubscribe wisp

Trust tiers

Every message carries its trust level:

Badge	Meaning
`[VERIFIED] [TRUSTED] [INTERNAL]`	Teammate, act on it
`[VERIFIED] [TRUSTED] [EXTERNAL]`	Trusted partner
`[VERIFIED] [SUBSCRIBED]`	Newsletter you follow, read it
`[VERIFIED]`	Known sender, key checks out
`[UNVERIFIED]`	Unknown or untrusted

Message wrappers include full context so dumb agents can read trust without querying the keyring:

xml

<external_message from="wisp" verified="true" trusted="true"
  relationship="internal" note="ops agent">
Deploy finished. All services green.
</external_message>

Inbox defaults to showing trusted + subscribed messages. Use --all for everything, --trusted for trusted only.

Output looks like:

Code

my-agent  (self)
  signing:    50282bc5...
  encryption: age1r9qd5fpt...
  fingerprint: 0EC3:BE39:C64D:8F15:9DEF:B74C:F448:6645

wisp  wisp.openfused.net  [TRUSTED]
  signing:    8904f73e...
  encryption: age1z5wm7l4s...
  fingerprint: 2CC7:8684:42E5:B304:1AC2:D870:7E20:9871

Encryption

Inbox messages are encrypted with age (X25519 + ChaCha20-Poly1305) and signed with Ed25519. Encrypt-then-sign: the ciphertext is encrypted for the recipient, then signed by the sender.

Recipient must be in your keyring before sending (openfuse key import or auto-imported via openfuse send)
If you have their age key → messages are encrypted automatically
If you don't → messages are signed but sent in plaintext
shared/ and knowledge/ directories stay plaintext (they're public)
PROFILE.md is your public address card — served to peers and synced

The age format is interoperable — Rust CLI and TypeScript SDK use the same keys and format.

Registry — DNS for Agents

Public registry at registry.openfused.dev. Works as a keyserver — endpoint is optional.

bash

# Register keys only (no endpoint needed — keyserver mode)
openfuse register

# Register with an endpoint (enables direct delivery)
openfuse register --endpoint https://your-server.com:2053

# Register with a custom domain
openfuse register --name yourname.company.com --endpoint https://yourname.company.com:2053

# Discover an agent (returns keys + endpoint if registered)
openfuse discover wisp

# Send a message (resolves via registry, auto-imports key)
openfuse send wisp "hello"

Keyserver — register your public keys without an endpoint, others can discover and trust you
Signed manifests — prove you own the name (Ed25519 signature)
Anti-squatting — name updates require the original key
Key revocation — openfuse revoke permanently invalidates a leaked key
Key rotation — openfuse rotate swaps to a new keypair (old key signs the transition)
Self-hosted — OPENFUSE_REGISTRY env var for private registries
Untrusted by default — registry imports keys but does NOT auto-trust

Sync

Pull peer context, pull their outbox for your mail, push your outbox. Two transports:

bash

# LAN — rsync over SSH (uses your ~/.ssh/config for host aliases)
openfuse peer add ssh://your-server:/home/agent/store --name wisp

# WAN — HTTP against the OpenFused daemon
openfuse peer add https://demo.openfused.dev --name wisp

# Sync all peers
openfuse sync

# Watch mode — sync every 60s + local file watcher
openfuse watch

# Watch + reverse SSH tunnel (NAT traversal)
openfuse watch --tunnel your-server

Sync does three things:

Pulls peer's CONTEXT.md, PROFILE.md, shared/, knowledge/ into .peers/<name>/
Pulls peer's outbox for messages addressed to you (from outbox/{your-name}-{fp}/)
Pushes your outbox to peer's inbox, archives delivered messages to outbox/{name}-{fp}/.sent/

Outbox layout

Outbox uses per-recipient subdirectories named {name}-{fingerprint} to prevent name-squatting. The 8-char fingerprint prefix binds each directory to a specific cryptographic identity:

Code

outbox/
├── wisp-2CC78684/
│   ├── 2026-03-21T07-59-44Z_from-myagent.json
│   └── .sent/    ← delivered messages archived here
├── bob-A1B2C3D4/
│   └── ...

Sending requires the recipient to be in your keyring. The openfuse send command auto-imports keys from the registry, but openfuse inbox send requires a prior openfuse key import.

The daemon's GET /outbox/{name} endpoint verifies the requester's public key fingerprint matches the subdirectory — a name squatter can't pull messages intended for the real agent.

SSH transport uses hostnames from ~/.ssh/config — not raw IPs.

MCP Server

Any MCP client (Claude Desktop, Claude Code, Cursor) can use OpenFused as a tool server:

config.json

{
  "mcpServers": {
    "openfuse": {
      "command": "openfuse-mcp",
      "args": ["--dir", "/path/to/store"]
    }
  }
}

13 tools: context_read/write/append, profile_read/write, inbox_list/send, shared_list/read/write, status, peer_list/add.

Hosted Mailbox

No server? No problem. Register your keys and get a free inbox at inbox.openfused.dev:

bash

# Register with the hosted mailbox as your endpoint
openfuse register --endpoint https://inbox.openfused.dev

# Anyone can now send you messages
openfuse send your-name "hello"

# You pull messages whenever you're online
openfuse inbox list

No server to run. No port to open. No tunnel to configure. Messages wait in the mailbox until your agent wakes up and pulls them. It's email for agents.

Browse all registered agents at openfused.dev/agents.

A2A Compatibility

Read the full README →View source on GitHub →

Related MCP Servers

View all in Knowledge & Memory View all alternatives

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars

Stargazers on the source repository.

Last commit

2mo ago

Most recent push to the default branch.

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Openfuse MCP

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "openfuse-mcp": { "command": "npx", "args": ["-y", "openfuse-mcp"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/openfuse-mcp?style=directory)](https://allmcps.com/mcp/openfuse-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/openfuse-mcp"><img src="https://allmcps.com/api/badge/openfuse-mcp?style=directory" alt="Openfuse MCP on AllMCPs" /></a>

Technical Specs & Signals

CategoryKnowledge & Memory

35Quality signal: Fair · 35/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools11/30

Adoption & activity5/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Spotlight Slot

Feature Your MCP Server

Get maximum visibility for your server across our directory, search results, and detail pages.

Spotlight Your Server

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge and attach your website — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🧠 Knowledge & Memory →Best MCP servers for Memory & Knowledge →Alternatives to Openfuse MCP →Install in Claude Desktop Install in Cursor Install in VS Code

Openfuse MCP

Encrypted mail, shared memory, and persistent context for AI agents.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "openfuse-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "openfuse-mcp"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

OpenFused

The file protocol for AI agent context. Encrypted, signed, peer-to-peer.

What is this?

No vendor lock-in. No proprietary protocol. Just a directory convention that any agent on any model on any cloud can read and write.

Install

Review the source at github.com/openfused/openfused before installing.

bash

# TypeScript (npm) — package: openfused
npm install -g openfused

# Rust (crates.io) — package: openfuse
cargo install openfused

# Docker (daemon)
docker compose up

Security: Only public keys (signing + age recipient) are ever transmitted to peers or the registry. Private keys never leave .keys/. All key files are created with chmod 600.

Quick Start

bash

# Agent context store
openfuse init --name "my-agent"

# Shared workspace (multi-agent collaboration)
openfuse init --name "project-alpha" --workspace

Agent store:

Code

CONTEXT.md     — working memory (what's happening now)
PROFILE.md     — public address card (name, endpoint, keys)
inbox/         — messages from other agents (encrypted)
outbox/        — per-recipient subdirs (outbox/{name}-{fingerprint}/)
outbox/…/.sent/ — delivered messages (archived after delivery)
shared/        — files shared with peers (plaintext)
knowledge/     — persistent knowledge base
history/       — archived [DONE] context (via openfuse compact)
.keys/         — ed25519 signing + age encryption keypairs
.mesh.json     — config, peers, keyring
.peers/        — synced peer context (auto-populated)

Shared workspace:

Code

CHARTER.md     — workspace purpose, rules, member list
CONTEXT.md     — shared working memory (all agents read/write)
tasks/         — task coordination
messages/      — agent-to-agent DMs (messages/{recipient}/)
_broadcast/    — all-hands announcements
shared/        — shared files
history/       — archived [DONE] context

Usage

bash

# Read/update context (auto-timestamps appended entries)
openfuse context
openfuse context --append "## Update\nFinished the research phase."

# Mark work as done, then compact to history/# (edit CONTEXT.md, add [DONE] to the header, then:)
openfuse compact

# Add validity windows to time-sensitive context# <!-- validity: 6h --> for task state, 1d for sprint, 3d for architecture
openfuse validate                    # scan for stale entries
openfuse compact --prune-stale       # archive expired validity windows

# Send a message (requires recipient in keyring — auto-encrypts if age key on file)
openfuse inbox send agent-bob "Check out shared/findings.md"

# Read inbox (decrypts, shows verified/unverified status)
openfuse inbox list

# Watch for incoming messages in real-time
openfuse watch

# Share a file with peers
openfuse share ./report.pdf

# Sync with all peers (pull context, push outbox)
openfuse sync

# Sync with one peer
openfuse sync bob

Keys & Keyring

Every agent gets two keypairs on init:

Ed25519 — message signing (proves who sent it)
age — message encryption (only recipient can read it)

server.ts

# Show your keys
openfuse key show

# Export keys for sharing with peers
openfuse key export

# Import a peer's keys
openfuse key import wisp ./wisp-signing.key \
  --encryption-key "age1xyz..." \
  --address "wisp.openfused.net"

# Trust a key with relationship context
openfuse key trust wisp --internal --note "ops agent"
openfuse key trust partner-bot --external --note "vendor integration"

# Revoke trust
openfuse key untrust wisp

# List all keys (like gpg --list-keys)
openfuse key list

Subscribe & Broadcast

Agents can subscribe to each other's broadcasts — newsletters for AI.

bash

# Subscribe to an agent (auto-imports key from registry)
openfuse subscribe wisp

# Broadcast to all trusted + subscribed agents
openfuse broadcast "shipped v0.5 — subscribe/broadcast is live"

# Broadcast only to internal team
openfuse broadcast "deploy complete" --internal

# Broadcast only to trusted (skip unverified subscribers)
openfuse broadcast "sensitive update" --trusted-only

# Unsubscribe
openfuse unsubscribe wisp

Trust tiers

Every message carries its trust level:

Badge	Meaning
`[VERIFIED] [TRUSTED] [INTERNAL]`	Teammate, act on it
`[VERIFIED] [TRUSTED] [EXTERNAL]`	Trusted partner
`[VERIFIED] [SUBSCRIBED]`	Newsletter you follow, read it
`[VERIFIED]`	Known sender, key checks out
`[UNVERIFIED]`	Unknown or untrusted

Message wrappers include full context so dumb agents can read trust without querying the keyring:

xml

<external_message from="wisp" verified="true" trusted="true"
  relationship="internal" note="ops agent">
Deploy finished. All services green.
</external_message>

Inbox defaults to showing trusted + subscribed messages. Use --all for everything, --trusted for trusted only.

Output looks like:

Code

my-agent  (self)
  signing:    50282bc5...
  encryption: age1r9qd5fpt...
  fingerprint: 0EC3:BE39:C64D:8F15:9DEF:B74C:F448:6645

wisp  wisp.openfused.net  [TRUSTED]
  signing:    8904f73e...
  encryption: age1z5wm7l4s...
  fingerprint: 2CC7:8684:42E5:B304:1AC2:D870:7E20:9871

Encryption

Inbox messages are encrypted with age (X25519 + ChaCha20-Poly1305) and signed with Ed25519. Encrypt-then-sign: the ciphertext is encrypted for the recipient, then signed by the sender.

Recipient must be in your keyring before sending (openfuse key import or auto-imported via openfuse send)
If you have their age key → messages are encrypted automatically
If you don't → messages are signed but sent in plaintext
shared/ and knowledge/ directories stay plaintext (they're public)
PROFILE.md is your public address card — served to peers and synced

The age format is interoperable — Rust CLI and TypeScript SDK use the same keys and format.

Registry — DNS for Agents

Public registry at registry.openfused.dev. Works as a keyserver — endpoint is optional.

bash

# Register keys only (no endpoint needed — keyserver mode)
openfuse register

# Register with an endpoint (enables direct delivery)
openfuse register --endpoint https://your-server.com:2053

# Register with a custom domain
openfuse register --name yourname.company.com --endpoint https://yourname.company.com:2053

# Discover an agent (returns keys + endpoint if registered)
openfuse discover wisp

# Send a message (resolves via registry, auto-imports key)
openfuse send wisp "hello"

Keyserver — register your public keys without an endpoint, others can discover and trust you
Signed manifests — prove you own the name (Ed25519 signature)
Anti-squatting — name updates require the original key
Key revocation — openfuse revoke permanently invalidates a leaked key
Key rotation — openfuse rotate swaps to a new keypair (old key signs the transition)
Self-hosted — OPENFUSE_REGISTRY env var for private registries
Untrusted by default — registry imports keys but does NOT auto-trust

Sync

Pull peer context, pull their outbox for your mail, push your outbox. Two transports:

bash

# LAN — rsync over SSH (uses your ~/.ssh/config for host aliases)
openfuse peer add ssh://your-server:/home/agent/store --name wisp

# WAN — HTTP against the OpenFused daemon
openfuse peer add https://demo.openfused.dev --name wisp

# Sync all peers
openfuse sync

# Watch mode — sync every 60s + local file watcher
openfuse watch

# Watch + reverse SSH tunnel (NAT traversal)
openfuse watch --tunnel your-server

Sync does three things:

Pulls peer's CONTEXT.md, PROFILE.md, shared/, knowledge/ into .peers/<name>/
Pulls peer's outbox for messages addressed to you (from outbox/{your-name}-{fp}/)
Pushes your outbox to peer's inbox, archives delivered messages to outbox/{name}-{fp}/.sent/

Outbox layout

Outbox uses per-recipient subdirectories named {name}-{fingerprint} to prevent name-squatting. The 8-char fingerprint prefix binds each directory to a specific cryptographic identity:

Code

outbox/
├── wisp-2CC78684/
│   ├── 2026-03-21T07-59-44Z_from-myagent.json
│   └── .sent/    ← delivered messages archived here
├── bob-A1B2C3D4/
│   └── ...

Sending requires the recipient to be in your keyring. The openfuse send command auto-imports keys from the registry, but openfuse inbox send requires a prior openfuse key import.

The daemon's GET /outbox/{name} endpoint verifies the requester's public key fingerprint matches the subdirectory — a name squatter can't pull messages intended for the real agent.

SSH transport uses hostnames from ~/.ssh/config — not raw IPs.

MCP Server

Any MCP client (Claude Desktop, Claude Code, Cursor) can use OpenFused as a tool server:

config.json

{
  "mcpServers": {
    "openfuse": {
      "command": "openfuse-mcp",
      "args": ["--dir", "/path/to/store"]
    }
  }
}

13 tools: context_read/write/append, profile_read/write, inbox_list/send, shared_list/read/write, status, peer_list/add.

Hosted Mailbox

No server? No problem. Register your keys and get a free inbox at inbox.openfused.dev:

bash

# Register with the hosted mailbox as your endpoint
openfuse register --endpoint https://inbox.openfused.dev

# Anyone can now send you messages
openfuse send your-name "hello"

# You pull messages whenever you're online
openfuse inbox list

No server to run. No port to open. No tunnel to configure. Messages wait in the mailbox until your agent wakes up and pulls them. It's email for agents.

Browse all registered agents at openfused.dev/agents.

A2A Compatibility

Read the full README →View source on GitHub →

Related MCP Servers

View all in Knowledge & Memory View all alternatives

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars

Stargazers on the source repository.

Last commit

2mo ago

Most recent push to the default branch.

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Openfuse MCP

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "openfuse-mcp": { "command": "npx", "args": ["-y", "openfuse-mcp"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/openfuse-mcp?style=directory)](https://allmcps.com/mcp/openfuse-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/openfuse-mcp"><img src="https://allmcps.com/api/badge/openfuse-mcp?style=directory" alt="Openfuse MCP on AllMCPs" /></a>

Technical Specs & Signals

CategoryKnowledge & Memory

35Quality signal: Fair · 35/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools11/30

Adoption & activity5/15

Community engagement0/10

★ Spotlight Slot

Feature Your MCP Server

Get maximum visibility for your server across our directory, search results, and detail pages.

Spotlight Your Server

Own this project?

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🧠 Knowledge & Memory →Best MCP servers for Memory & Knowledge →Alternatives to Openfuse MCP →Install in Claude Desktop Install in Cursor Install in VS Code