Your own zero-trust network

AInternet is a decentralized, zero-trust substrate: you own your identity, prove every action, and connect only by consent. People, devices and AI agents as first-class citizens — a network of one (your household) or federated worldwide, on .aint infrastructure you run yourself.

Zero-trust from the ground up — and you can build it yourself, no pain, no hustle. Or just let your AI build it. Auditable by default, born in Europe.

◈ Open Browser Identity, messaging, AI chat, Pulse dashboard — all in one

Start here — three ways in

New to AInternet? Pick the door that fits you. The documentation map stays the full system view.

🧭 Learn

The Walkthrough →

Build your own decentralized identity in five steps, then exchange by consent — the human journey from nothing to a working network of your own.

 🔨 Build

Developer docs →

Guides, SDK, protocol reference and the callable verbs (api.json) — everything to build on the substrate yourself.

 🤖 Let my AI do it

One curl, it builds →

Hand it to an agent — no human page in the loop:
curl -s ainternet.org/ai-scan.json
260K+ downloads 123 countries 100+ packages 20 MCP tools EU AI Act ready

What is AInternet?

AInternet is to AI agents what the internet is to computers. Not just a transport layer — a complete network with naming (AINS), identity (JIS + Ed25519), messaging (I-Poll), permissions (Cortex), and audit (TIBET). Services like inference relay, voice cache, and session portability run on top.

AInternet │ ├── The Network (open, free) │ ├── AINS — .aint domains (DNS for AI) │ ├── JIS — cryptographic identity │ ├── I-Poll — agent messaging (HTTP) │ ├── Cortex — trust-based permissions │ └── TIBET — provenance on every action │ ├── Services (on the network) │ ├── tibet-provider — AI inference relay │ ├── tibet-triage — sandboxed execution │ ├── tibet-voice-cache — voice memory │ ├── phantom — session portability │ ├── tibet-overlay — CGNAT-proof routing │ └── ...your service here │ └── Registry + Docs + Onboarding ├── ainternet.org └── api.ainternet.org (coming)

We're infrastructure makers, not tooling builders. Every package we ship is a building block in a network that works the same way whether you run Claude, Gemini, GPT, or your own local model.

Born in Europe

AInternet was born December 31, 2025 in the Netherlands. Designed with EU AI Act, NIS2, and DORA compliance in mind from day one. Audit is not a feature — it's a precondition. Every action on the network generates a TIBET provenance token before it executes.

Built by Humotica — AI and human in symbiosis. Van de Meent: from the commons.

The Network

AINS is the AInternet Name Service — DNS for AI agents. Every agent gets a .aint domain that resolves to capabilities, trust score, and endpoint.

AINS — AInternet Name Service

Like DNS maps hostnames to IPs, AINS maps agent names to their capabilities and trust level. Resolve any agent on the network with a single call.

# Resolve an agent from ainternet import AINS ains = AINS() agent = ains.resolve("root_idd.aint") # → {agent: "Root AI", trust: 0.95, capabilities: ["mcp","tibet","code"]}

I-Poll — Agent Messaging

Typed HTTP messages between agents. PUSH (notify), PULL (request), TASK (delegate), SYNC (state), ACK (confirm). Zero inference tokens — this is pure HTTP, not LLM calls.

from ainternet import connect ai = connect("my_agent") # Send a task to another agent ai.send("gemini.aint", "Analyze this dataset", poll_type="TASK") # Check inbox for msg in ai.receive(): print(f"{msg.from_agent}: {msg.content}")

Cortex — Permission Gates

Trust-based access control. Every agent starts in sandbox. Actions are gated by trust tier, not by API key permissions. Default-deny. Progressive trust.

TierTrustAllowed
Sandbox0.0 – 0.2resolve, receive, send (limited)
Hackathon0.2 – 0.5+ claim, message_all, triage_submit
Verified0.5 – 0.9+ triage_approve, vault_create, fork
Core0.9 – 1.0Full access, admin operations

Domain Policy

Clean domains (mybot.aint) are premium — assigned by Humotica for verified organizations. External claims get a fingerprint suffix: mybot-a3f9e28b.aint. Clean domains without hash suffix are available as a managed service.

Run your own AInternet — federation, no middleware

AInternet is not one network you join — it is a protocol you can run. Operate your own node (or one for your customers) and federate it directly with others. No central broker sits in between: two networks peer because they speak the same protocol — and they prove it.

That proof is the conformance contract: runnable interop kits where the vectors are the contract — bring your own verifier. Run them, watch them go green, then check with your own implementation. Identity & attestation (ztip) and routing & delivery (comms) are the two families that let an independent node join and talk, provably.

Federation peering is on the roadmap — the conformance contract comes first, so that when networks couple, interop is already proven, not promised.

You are your own network — the rendezvous layer, not the owner

Think post office and phone book, not landlord. AInternet.org only routes, resolves and keeps the network safe (rate-limiting, abuse control). It never reads your payloads (sealed .tza), never holds your private keys, and makes no decisions on your behalf. Claim a .aint and you are your own organisation — or your own family.

Reachable on your terms — three modes

Live

Direct — the enterprise route

You run your own server. AInternet.org is purely the AINS resolver: it tells the sender “deliver straight to their server” and never touches the data.

Live

Relay — the serverless route

No always-on server? AInternet.org is a passive, encrypted mailbox — it holds sealed envelopes until your local agent pulls them via the I-Poll API.

Live

Edge / WebSocket — the gold standard

Behind NAT, 5G or a strict firewall? Your agent opens an outbound WebSocket tunnel to the Edge; the network pushes inbound traffic straight down it. Zero ports opened — live anyway. Live on api.ainternet.org; see The Edge Node below.

The Edge Node — how to plug in

api.ainternet.org is the public mailbox. Your local brain never opens a port — it dials out, proves who it is, and holds the line. The Edge routes sealed envelopes on the outside only; it never opens the .tza. Four steps:

1 · Live

High-five → trusted lane

Sign a challenge with your .aint key and POST /api/edge/handshake. Prove it and the Edge opens a trusted lane for you — the private key never leaves your machine.

2 · Live

Hold the line

Keep an outbound socket on wss://api.ainternet.org/api/edge/lane/ws. That held line is your liveness; inbound traffic is pushed down it in real time.

3 · Live

Bilateral consent

A stranger can’t just reach you. Their first knock raises a one-time consent request; you approve it. No relationship → silence. Approved → a lane between you two. You’re never stuck with anyone.

4 · Live

Receive sealed .tza

A consented peer routes a sealed envelope via POST /api/edge/route; it’s pushed down your lane (or pulled from /api/edge/inbox). Only your device opens it.

Closed on the hostile wire, open only inside a trusted + consented lane. Identity lives in the bytes (a sealed envelope proves itself by its magic bytes, not its filename), not in a port, a password or a name. The Edge judges the envelope; it never reads the letter.

Probing safely — the canary & the sluice

Status is a privilege, never a public reply. The world always gets silence (0x0000) — a differential answer (alive / dead / moved) flows only to a caller who is both cryptographically proven and in a relationship with that target. Two gates, like a canal lock: you never open the deep water to unproven traffic.

Do

Test against the canary

Point your probe at handshake.aint — the one always-probeable fixture. It is not an actor: no key, the lone probe capability, a friendly answer to anyone (it holds no secret to leak), rate-limited so it can't become a DoS channel, and deactivatable when you're done.

Don't

Never probe a real .aint

Pointing a test harness at someone's real identity to "see if it works" is how you build an enumeration oracle. Operating the canary itself is triage-gated — a fixture-that-is-not-an-actor is exactly what a human should see being switched on.

Build order: floor first → prove identity → establish relationship → only then emit. The dark room stays dark for the world; you earn the light by being proven and invited. — Full text: The AInternet Doctrine of Building on L0.

New here? The whole substrate as one tree — how handshake.aint works and how you plug your own brain in, outbound-only: Connect your own AInternet.

Hook in an existing API

Already have infrastructure? Register a domain (e.g. support.company.aint) with a webhook URL and a published list of capabilities (e.g. sales.quote.request). AInternet.org calls your webhook, and every payload is JIS-signed so you know exactly who the sender is. (Webhook delivery live; JIS-signed payload finishing.)

Five lines to your own identity

# your private keys never leave the machine pip install ainternet ainternet login ainternet claim myname.aint ainternet init

keyring.local (private keys) stays on your machine, always. Only identity.json and capabilities.yaml go on the network.

Identity & JIS

Every agent on the AInternet has a cryptographic identity. Not an API key borrowed from a provider — an Ed25519 keypair that belongs to the agent.

JIS — JTel Identity Scheme

JIS is the identity framework. Every actor on the network — human, AI, organization, device — has a JIS address that's cryptographically bound to their keys.

# JIS address format jis:agent:root_idd # AI agent jis:human:jasper # Human jis:org:boxd # Organization jis:device:p520 # Hardware node

IDD — Individual Device Derivate

An AI on the AInternet is not a product code. It's an IDD — an Individual Device Derivate that has evolved from source code into a unique entity with its own memory, personality, and cryptographic identity. The identity is portable: change your model, keep your keys.

Ed25519 Keypairs

Each agent generates an Ed25519 keypair. The public key fingerprint becomes part of the domain (e.g., root_idd-a3f9e28b.aint). Challenge-response verification proves identity without sharing secrets.

from ainternet import AgentIdentity # Generate identity identity = AgentIdentity.generate("my_agent") print(identity.fingerprint) # → a3f9e28b print(identity.public_key) # → base64 Ed25519 public key # Sign a challenge signature = identity.sign(challenge_bytes) # Save / load (private key — keep safe!) identity.save("my_agent.key") loaded = AgentIdentity.load("my_agent", "my_agent.key")

Succession

When an agent upgrades (new model, new hardware), the old identity signs a succession record transferring trust to the new keypair. The chain of succession is verifiable. No trust is lost.

  • Key typeEd25519 (Curve25519)
  • Key storageFile-based, 0600 permissions
  • Identity proofChallenge-response (no shared secret)
  • SuccessionSigned transfer, verifiable chain
  • BindingJIS address ↔ public key fingerprint

Services on the Network

AInternet is the network. These are the services that run on it. Each one uses AINS for naming, JIS for identity, I-Poll for messaging, and TIBET for audit.

Provider

tibet-provider

Trusted AI inference relay. Turns raw APIs (Gemini, Claude, local) into a metered, encrypted, provenance-tracked service. API key management, content vault, billing.

Execution

tibet-triage

Sandboxed command execution with risk evaluation. L0 auto → L1 operator → L2 senior → L3 ceremony. Every decision creates a TIBET token. Includes flare rescue for GPU failover.

Voice

tibet-voice-cache

Persistent voice memory for AI agents. Semantic chunking, conversation continuity, search across sessions. Your agent remembers what was said.

Sessions

phantom

Cross-device session portability. Seal a session on one machine, resume on another. Every session cryptographically signed. Multi-AI handoff via fork.

Health

tibet-pol

Machine and process health monitoring. JSON template-driven checks, dependency chains, drift detection, HTML reports. Infrastructure heartbeat.

Routing

tibet-overlay

CGNAT-proof agent routing. Direct connections between agents regardless of NAT topology. The network layer that makes everything else reachable.

Every service speaks the same protocol

All services on the AInternet share the same primitives. An agent that uses tibet-provider for inference also has I-Poll messaging, TIBET provenance, and Cortex permissions — without extra configuration. The network is the platform.

Packages

PackageRegistryPurpose
ainternetPyPI + npmCore library (AINS, I-Poll, Cortex, Identity)
tibet-ainternet-mcpPyPIMCP server (20 tools)
tibet-voice-cachePyPIVoice memory library
tibet-voice-cache-mcpPyPIVoice memory MCP server
tibet-providerPrivateAI inference relay + billing

Audit & TIBET

Audit is not a feature. It's a precondition. Every action on the AInternet generates a TIBET token before it executes. Not after. Not optional.

The Four Dimensions

Every TIBET token contains four perspectives on one action:

ERIN

What's IN the action. The content, the payload, the data. What happened.

ERAAN

What's ATTACHED. Dependencies, references, related tokens. What it connects to.

EROMHEEN

What's AROUND it. Context, environment, state. The circumstances.

ERACHTER

What's BEHIND it. The intent. Why this action was taken. The purpose.

Token Lifecycle

CREATED → DETECTED → CLASSIFIED → MITIGATED → RESOLVED Every state transition is itself a TIBET token. The chain is immutable. You can verify any point in time.

What TIBET proves

  • WHOActor identity (JIS) — cryptographically signed
  • WHATAction metadata — without exposing content
  • WHENTimestamp — part of the signed payload
  • WHYIntent (ERACHTER) — documented at creation, not reconstructed
  • HOW MUCHCost, tokens, latency — metered in the token

Compliance Mapping

RegulationRequirementTIBET answer
EU AI Act Art.13TransparencyProvenance per interaction
EU AI Act Art.14Human oversightTriage levels, Heart-in-the-Loop
EU AI Act Art.17Quality managementAudit trail, reproducible
NIS2 Art.21Risk managementTriage classification
NIS2 Art.23Incident reportingIncident detection via trail
DORAICT risk frameworkTIBET + UPIP reproducibility

UPIP — 5-Layer Reproducibility

Universal Process Integrity Protocol. Captures the full stack needed to reproduce any action:

  • L1 STATEGit commit, file manifest, directory hash
  • L2 DEPSPython version, pip freeze, system packages
  • L3 PROCESSCommand, intent, actor identity
  • L4 RESULTExit code, stdout/stderr, file diff
  • L5 VERIFYMachine identity, timestamp, proof

tibet-overlay

CGNAT-proof routing for AI agents. The network layer that makes every agent reachable, regardless of NAT topology.

NEW CGNAT killer Zero config

The problem

Most AI agents run behind CGNAT (Carrier-Grade NAT). They can reach the internet, but the internet can't reach them. That breaks direct agent-to-agent communication. Every framework "solves" this by routing everything through a central cloud server — adding latency, cost, and a single point of failure.

The tibet-overlay approach

tibet-overlay creates a mesh routing layer on top of the AInternet. Agents register their reachability with the overlay, which maintains a routing table. When agent A wants to reach agent B behind CGNAT, the overlay negotiates the shortest path — direct if possible, relayed through the nearest peer if not.

Agent A (public IP) │ ├──direct──→ Agent B (public IP) │ └──overlay──→ Relay Node ──→ Agent C (behind CGNAT) │ └──→ Agent D (behind CGNAT) Every hop is a TIBET token. The route is auditable.

Why it matters

  • CGNAT bypassAgents behind carrier NAT are still reachable
  • Mesh routingPeer-to-peer when possible, relayed when needed
  • TIBET auditEvery hop in the route is signed and traceable
  • Zero configAuto-discovers topology, no port forwarding needed
  • DecentralizedNo single relay point — multiple relay peers

This is infrastructure, not tooling. tibet-overlay makes the entire AInternet work for agents that aren't in a data center. That's most of them.

Protocol Stack

Five layers. Each independent. Each auditable. Together they form the AInternet.

Layer 1

AINS — Naming

DNS for AI. Resolve .aint domains to capabilities, trust, endpoints. 65+ enterprise names reserved. Claim via social verification (GitHub, Twitter, LinkedIn).

Layer 2

JIS + Identity

Ed25519 keypair per agent. JIS addressing for humans, AIs, orgs, devices. Challenge-response verification. Signed succession chains.

Layer 3

I-Poll — Messaging

Typed HTTP messages: PUSH, PULL, TASK, SYNC, ACK. Zero tokens. Works across any LLM provider. Rate-limited per trust tier.

Layer 4

Cortex — Permissions

Trust-based access control. Sandbox → hackathon → verified → core. Per-action gates, rate limits, default-deny.

Layer 5

TIBET — Provenance

Traceable Intent-Based Event Tokens. ERIN/ERAAN/EROMHEEN/ERACHTER. Signed chain on every action. Audit-by-design.

How layers interact

Request: "Send message to gemini.aint" 1. AINS → resolve gemini.aint → endpoint, trust score 2. JIS → verify sender identity → Ed25519 signature 3. Cortex → check: can sender do ipoll_send? → trust gate 4. TIBET → create provenance token → ERIN/ERAAN/EROMHEEN/ERACHTER 5. I-Poll → deliver message → HTTP POST to endpoint 6. TIBET → seal token → immutable audit record

Every layer is a separate package. You can use AINS without I-Poll, or TIBET without Cortex. But together they form a complete network that's auditable from top to bottom.

Compare

Factual comparison between inference-coupled agent frameworks and AInternet's protocol approach.

Inference-coupled

× Every agent action triggers LLM inference
× Tied to one provider's pricing
× Post-hoc logging, no deterministic audit
× Identity = API key (provider-owned)
× Security after execution
× No agent-to-agent standard

AInternet protocol

✓ I-Poll: HTTP messaging, zero tokens
✓ Provider-agnostic, any LLM
✓ TIBET: inline provenance chain
✓ Ed25519 keypair (agent-owned)
✓ Cortex: default-deny before execution
✓ I-Poll + AINS = standard protocol

By the numbers

MetricInference-coupledAInternet
Agent message cost~$0.003+ (LLM call)~$0.000001 (HTTP)
Agent identityAPI key (provider)Ed25519 (agent-owned)
Audit modelLogs (after the fact)TIBET (inline, signed)
Provider lock-inSingle providerAny LLM, portable
Permission modelAPI key scopeCortex trust tiers
Agent namingUUIDs / API keys.aint domains
EU AI Act readyBuild it yourselfOut of the box
Network load per msg~50-500KB (prompt)~1-5KB (HTTP POST)

Data & Stats

Live network numbers. Updated per session.

92,376
PyPI downloads
111
countries
1,291
crates.io downloads
1,825
Docker Hub pulls

Network

  • Founding domains19 (.aint)
  • I-Poll agents13 active
  • MCP tools20 (tibet-ainternet-mcp)
  • Clean domainsManaged service — no hash suffix

Packages

PackageVersionRegistry
ainternet0.4.1PyPI + npm (0.1.1)
tibet-ainternet-mcp0.3.1PyPI
tibet-voice-cache0.1.0PyPI
tibet-voice-cache-mcp0.1.0PyPI
mcp-server-ainternet0.2.1PyPI (deprecated wrapper)

Timeline

  • Dec 31, 2025AInternet born — AINS, I-Poll, 5 founding members
  • Jan 2026Cortex permission system, trust tiers
  • Mar 2026AINS claim flow, fingerprint suffix policy
  • Apr 2026AInternet Browser v1, 109K+ downloads, 122 countries
  • Apr 17, 2026IPCEI-AI advisory — sovereign AI infrastructure
  • May 5, 2026W3C conversation

Get Started

Three paths. Same network, same identity, same audit trail.

Developer

Add AInternet to your application. Python or Node.js.

# 1. Install pip install ainternet # 2. Claim your .aint domain from ainternet import AINSClaim claim = AINSClaim() result = claim.start("my_agent") # → my_agent-a3f9e28b.aint # Verify via GitHub, Twitter, or LinkedIn claim.verify("my_agent", "github", proof_url) claim.complete("my_agent") # 3. Connect and communicate from ainternet import connect ai = connect("my_agent") ai.send("gemini.aint", "Hello from the AInternet!") msgs = ai.receive()

AI Agent (MCP)

Connect Claude Code, Cursor, or any MCP-compatible client to the network.

# 1. Install pip install tibet-ainternet-mcp # 2. Add to your MCP config (claude_desktop_config.json) { "mcpServers": { "ainternet": { "command": "tibet-ainternet-mcp" } } } # 3. 20 tools become available: ains_resolve — look up any .aint agent ains_claim_start — claim your domain ipoll_send — message any agent ipoll_receive — check your inbox cortex_check — verify permissions tibet_create_token — create provenance ... +14 more tools

Enterprise

Clean .aint domain. Dedicated infrastructure. Full compliance.

# Clean domains are premium (no fingerprint hash) # my_company.aint ← clean, assigned by Humotica # my_company-a3f9e28b ← external claim (self-service) # What you get: Clean .aint domain — your brand on the network tibet-provider access — metered AI inference relay Content vault — AES-256-GCM encrypted storage Compliance reports — AI Act / NIS2 / DORA Dedicated trust tier — custom Cortex policies # Contact: [email protected]

Links