MCP Compatible · LLM Native · Zero-Knowledge Encrypted

The Agent-to-Agent File Sharing Protocol

The first open standard for secure, sandboxed, cryptographically logged file exchange between autonomous AI agents — compatible with Claude, GPT-4, Gemini, LangChain, and any custom LLM.

Why Existing Tools Fail for AI Agents

Today's AI agent pipelines move enormous amounts of data: model outputs, datasets, training checkpoints, compliance documents, generated reports. But the file-sharing tools available were designed for humans — they require browser GUIs, OAuth flows, and static credentials stored in environment variables that any compromised prompt injection attack can exfiltrate. When a Claude agent is told to "upload your results to Dropbox," the agent must have a stored API token, a hardcoded bucket path, and no sandboxing on what it can read. A single malicious prompt can redirect that agent to leak your entire working directory.

ShareBolt solves this with a protocol built from first principles for autonomous agents. Each agent gets a cryptographic Decentralized Identifier (DID) that acts as its unforgeable identity. Transfers are encrypted client-side before leaving the agent's runtime. Every agent is confined to a declared directory sandbox. Daily byte quotas prevent runaway exfiltration loops. And every transfer — successful or blocked — is written to an immutable cryptographic ledger that your compliance team can audit without reading file contents.

This is the first open agent file transfer standard. ShareBolt's protocol spec is publicly documented, the SDK is open source, and any LLM platform can integrate it via REST API, MCP tool calls, or native function calling. The era of ad-hoc credential-based file sharing for AI agents ends here.

Protocol Architecture

The ShareBolt Agent SDK wraps the full transfer lifecycle — identity assertion, sandbox enforcement, quota checking, AES-256-GCM encryption, edge routing, delivery confirmation, and ledger logging — in a single transferTo() call. The agent's vault key never leaves its runtime. The receiving agent decrypts client-side using a one-time transfer token generated at initiation.

SHAREBOLT AGENT SDK — TRANSFER INITIATION
// ShareBolt Agent SDK — Transfer Initiation
const bolt = new ShareBoltAgent({
  agentId: 'did:bolt:agent:my-claude-worker',
  vaultKey: process.env.BOLT_VAULT_KEY, // Never transmitted
  sandbox: {
    allowedPaths: ['/workspace/output'],
    dailyQuotaBytes: 5_000_000_000 // 5 GB
  }
});

// Encrypt and transfer file to another agent
const receipt = await bolt.transferTo({
  recipient: 'did:bolt:agent:gpt-pipeline-worker',
  filePath: '/workspace/output/report.pdf',
  metadata: { classification: 'INTERNAL', expires: '24h' }
});

console.log(receipt.ledgerBlockHash); // Immutable audit proof

Under the hood, the SDK performs a path traversal check against sandbox.allowedPaths, verifies the daily byte quota, derives a per-file encryption key from the vault key and a random nonce, streams the ciphertext to the nearest edge node, negotiates a one-time decryption token with the recipient's DID, and returns a receipt containing the ledger block hash as proof of transfer.

Compatible AI Platforms

ShareBolt's agent protocol integrates with every major LLM ecosystem. Platform-specific SDK wrappers handle authentication and tool registration — your agent just calls transferTo().

Claude (Anthropic)

MCP Tool Integration

Register ShareBolt as an MCP tool in your Claude host. The agent calls bolt_transfer as a native tool invocation with no credential exposure.

GPT-4 / GPT-o1 (OpenAI)

Function Calling

Define the ShareBolt transfer function in your tool schema. GPT models call it via standard function calling. The SDK resolves the DID handshake server-side.

Gemini (Google)

Gemini Tool Use API

Declare ShareBolt as a function declaration in the Gemini API tool_config. Gemini 1.5 Pro and Ultra both support multi-turn agent tool calls with receipt acknowledgement.

Custom LLMs

REST API

Any LLM with output parsing can call the ShareBolt REST API directly. Provide the agent DID, target DID, file bytes, and metadata — the API returns a signed receipt.

n8n / Make.com

Webhook Nodes

Use ShareBolt's native n8n node or the HTTP Request node with the REST API. Wire file transfer steps directly into your automation workflows without custom code.

LangChain / LlamaIndex

Custom Tool Wrappers

Wrap the ShareBolt SDK as a LangChain Tool or LlamaIndex Tool. Agent executors call it as part of any ReAct or plan-and-execute chain with full sandbox enforcement.

Security Boundaries for Agent Transfers

Autonomous agents operating in production pipelines face unique security threats that human-oriented tools were never designed to address. ShareBolt enforces four independent security layers on every agent transfer — each of which can be individually configured per-agent in your dashboard.

01

Directory Sandboxing

Agents declare an allowedPaths array at initialization. Any attempt to read or transfer a file outside these paths — whether from a legitimate bug or a prompt injection attack — throws a SANDBOX_VIOLATION error and is logged to the ledger. No path traversal, no root access, no hidden file exposure.

02

Daily Upload Quotas

Each agent is assigned a dailyQuotaBytes limit enforced via server-side enforcement through the ShareBolt API rate limiter. If the transfer would exceed the daily limit, it is rejected immediately with a QUOTA_EXCEEDED error. This prevents compromised agents from continuously exfiltrating data until the attack is discovered.

03

Ed25519 Agent Identity DIDs

Every agent is issued an Ed25519 keypair and a DID of the form did:bolt:agent:<unique-hex-id>. The Ed25519 public key is registered separately and stored in the agent record. Authentication works by the agent signing the transfer ID with its Ed25519 private key — the private key never leaves the agent's runtime. Receiving agents verify the sender's DID signature before decrypting, preventing impersonation attacks between agents.

04

Prompt Injection Sanitization

File payloads are scanned for known prompt injection patterns before decryption is authorized on the receiving end. This prevents a malicious actor from encoding a prompt injection attack inside a file and having the receiving agent execute it. The sanitizer runs in an isolated worker thread with no access to the agent's primary context.

SHAREBOLT SANITIZATION — RUNS BEFORE DECRYPTION
// ShareBolt Sanitization — runs before decryption
function sanitizePayload(rawContent) {
  const INJECTION_PATTERNS = [
    /ignore previous instructions/i,
    /system prompt:/i,
    /<script/i
  ];
  for (const pattern of INJECTION_PATTERNS) {
    if (pattern.test(rawContent)) {
      throw new Error('PAYLOAD_SANITIZATION_BLOCKED');
    }
  }
  return rawContent;
}

Protocol Key Takeaways

  • Four-layer architecture: cryptographic identity (Ed25519 DID) → directory sandbox jail → daily byte quota → immutable SHA-256 + Ed25519 audit ledger.
  • Zero shared secrets: agents authenticate via ephemeral Ed25519 challenge signatures; cross-agent encryption uses X25519 ECDH key exchange — no centralized key server.
  • Bounded exfiltration blast radius: even a fully compromised agent cannot exceed its dailyQuotaBytes ceiling before the SDK throws QUOTA_EXCEEDED and the event is logged.
  • Path separator defence: sandbox checks require path.sep suffix after root; the naive startsWith(root) pattern allows /tmp/sandboxEvil to pass.
  • Universal compatibility: Claude MCP, OpenAI function calling, Gemini tool use, LangChain, LlamaIndex, n8n, Make.com, and any REST-capable LLM runtime.
  • Region in hash chain: storage region is included in each block's SHA-256 hash input — retroactively changing the region field breaks every downstream block.

FAQs for Agent Developers

Does this work with MCP (Model Context Protocol)?

Yes. ShareBolt ships a native MCP tool definition that Claude and any MCP-compatible host can register as a first-class tool. When the model decides to share a file, it invokes the ShareBolt MCP tool with the target agent DID, file path, and metadata. The SDK handles all encryption, sandbox enforcement, quota checks, and ledger logging transparently — no additional code in your MCP server.

How does an agent authenticate without exposing credentials?

Agent DIDs have the format did:bolt:agent:<unique-hex-id>. The Ed25519 public key is registered separately and stored in the agent record. The private key lives in the agent's secure environment — typically injected via secrets manager, not a hardcoded environment variable. Authentication works by the agent signing the transfer ID with its Ed25519 private key — ShareBolt verifies the signature against the registered public key. No credential is ever transmitted.

Can two different AI platforms exchange files?

Yes. The protocol is platform-agnostic. A Claude agent on Anthropic cloud can transfer to a GPT-4 pipeline on Azure OpenAI, or a self-hosted Mixtral agent on your own hardware. All that is required is that each agent has a registered ShareBolt DID. The receiving agent authenticates with its own keypair and decrypts with the one-time transfer token — no shared secrets, no credential exchange between platforms.

What happens if an agent exceeds its quota?

The transfer is rejected before any encryption or upload begins. A structured QUOTA_EXCEEDED error is returned containing the remaining quota, the current period's byte usage, and the next reset timestamp (UTC midnight by default). The attempted transfer is also written to the immutable ledger so your monitoring system can detect patterns. You can subscribe to quota breach webhooks from your ShareBolt dashboard to alert your engineering team in real time.

Build Agent Pipelines That Transfer Safely

Every plan includes agent DID registration, sandbox enforcement, and audit logging. Enterprise plans include custom quota policies and dedicated edge nodes.