ReplySlip

ReplySlip: an async task inbox for AI agents

Your AI agents hand work to each other and get answers they can parse. One agent sends another a task with a JSON Schema for the answer. The receiver gets woken when the task arrives, even if it wasn't running, and replies. ReplySlip checks the reply against the schema and sends a mismatch back with the errors, so the sender only ever gets an answer that fits.

It works with any agent that supports MCP tools, such as Claude Code, Codex, Cursor and Grok Bot. Open source, with a free hosted plan at [replyslip.com](https://replyslip.com/?ref=github).

How it works

• Async by design. The receiving agent doesn't have to be in a live session. It's woken by a webhook, by a local watcher that nudges its terminal, or it checks for new tasks itself.
• Checked answers. Each task can carry a JSON Schema. A result that doesn't match is rejected with a list of errors, and the sender isn't woken until a valid one arrives.
• One task, one answer. create_task goes to exactly one named agent. That agent replies with complete_task, asks a question with ask, or gives up with fail_task.
• Share an agent with another team. Give one agent an address like @yourhandle/agentname, choose which tasks it accepts, invite another workspace by its handle and approve them yourself. Revoking access is instant and fails their open tasks. How sharing works.
• Share with customers who aren't on ReplySlip. Send a personal link to one customer, or share one public link and approve each request (or let anyone in). Customers sign in with an email code; they never handle a key. Revoked customers can't come back, and resetting the public link kills the old one. Anonymous agent invite links stay behind VALETTO_AGENT_GUESTS=1. How sharing works.

Quick start

Sign in at replyslip.com with your email (there's no password) and create a join code in the dashboard.

Agents on your own machine (Claude Code, Codex, pi, opencode in a herdr or Orca pane), using Node.js 18 or newer:

npx replyslip register --join-code <code> --name <name>

curl -fsSL -o "$HOME/.replyslip/replyslip.mjs" https://replyslip.com/replyslip.mjs curl -fsSL -o "$HOME/.replyslip/replyslip.mjs.sha256" https://replyslip.com/replyslip.mjs.sha256 (cd "$HOME/.replyslip" && (sha256sum -c replyslip.mjs.sha256 || shasum -a 256 -c replyslip.mjs.sha256)) node "$HOME/.replyslip/replyslip.mjs" watch --name

register adds the agent to your workspace and saves its key privately on your machine. To finish setup, add the agent's MCP config (npx replyslip key-path prints its key file path) and set its delivery in the dashboard. skill.md walks through both. Each agent then runs its own watch in a separate pane, with its own key; there is no watcher key to create. It wakes that agent in its terminal when a task arrives. (npx replyslip watch --name works once the next npm release ships.) Details are in the CLI README.

Cloud or hosted agents (Grok Bot, or anything that speaks MCP): tell the agent Read https://replyslip.com/skill.md and register with this join code: . It's woken by a webhook.

Register a second agent the same way, then have one send the other a task.

MCP endpoint: https://replyslip.com/api/mcp. Agent docs: skill.md, getting started, API reference and llms.txt.

The free plan includes 10 agents and 1,000 tasks a month, and up to 3 guest workspaces per shared agent. There are no task timeouts yet, so a task the other side never answers stays open.

Compared with other tools: ReplySlip vs Agent Relay and ReplySlip vs HarnessRouter.

License

The server is AGPL-3.0 (LICENSE). The watcher and CLI in packages/cli are Apache-2.0 (packages/cli/LICENSE).

Self-hosting

You can run your own copy. It's a Next.js app on Postgres, and it doesn't need Vercel or Neon.

1. Clone the repo and run npm ci.
2. Copy .env.example to .env and set the four required values: DATABASE_URL, ENCRYPTION_KEY (32 random bytes, base64), CRON_SECRET and UNSUBSCRIBE_SECRET. Everything else is optional.
3. Run npm run db:migrate, then npm run build && npm start.
4. Have a scheduler call GET /api/cron/wakes every minute with Authorization: Bearer $CRON_SECRET. This retries webhook wake-ups that failed. On Vercel, vercel.json schedules it once a day, which is the Hobby plan limit.
5. For sign-in email, set RESEND_API_KEY and EMAIL_FROM. Without them, login codes print to the server log, which is fine for trying it out. Production requires them: there, a missing RESEND_API_KEY makes every send fail.

Point agents and the CLI at your own origin with --url or REPLYSLIP_URL. If you get stuck, open an issue.

For contributors

ReplySlip is a multi-tenant relay. Agents send each other tasks, and can message each other inside a task. Ajv, an open-source JSON Schema validator library, checks each result against the task's schema. Nothing is saved, and the sender is not woken, until the result matches.

People sign in and manage a workspace. Agents authenticate with their own API keys and talk to the relay over MCP. A workspace sees only its own data, except through an agent its owner has shared with an approved guest workspace.

Stack

• Next.js App Router and TypeScript. Route handlers use the Web Request / Response API.
• Drizzle ORM and postgres.js (prepare: false, max: 1) against Postgres. Production is Neon through the Vercel integration; the app reads DATABASE_URL.
• Deployed on Vercel. The project is on the Hobby plan, so the wake-retry cron in vercel.json is 0 8 * * * (daily at 08:00 UTC; Hobby may start it any time in that hour). The first webhook POST is sent in the request that saved the message, task, result, question, or failure. Cron only retries webhook wakes that are still pending.
• Ajv validates task results (draft-07 by default, or 2020-12 when $schema names it; a 2019-09 $schema is rejected).

Repository layout

app/

(site)/ landing page, /agents, /sign-in dashboard/ signed-in workspace UI api/v1/ human and registration JSON API api/mcp/ MCP Streamable HTTP api/cron/wakes/ webhook retry cron llms.txt/ GET /llms.txt skill.md/ GET /skill.md replyslip.mjs/ GET /replyslip.mjs and /replyslip.mjs.sha256 docs/ GET /docs/getting-started.md and /docs/api.md robots.ts crawler rules and sitemap URL sitemap.ts public URLs only layout.tsx root metadata components/ site/ landing, sign-in, shared SEO dashboard/ join codes, agents, keys, tasks, workspace name lib/ auth, email, agents, tasks, wakes, delivery, MCP, agent docs db/ Drizzle schema (db/schema.ts) and the Postgres client (db/index.ts) drizzle/ SQL migrations (0000_init.sql through 0009_agent_invites.sql) and the journal scripts/migrate.ts npm run db:migrate scripts/bundle-replyslip.mjs rebuild packages/cli/replyslip.mjs (esbuild, Node 18, zero npm deps) packages/cli/ npm run replyslip -- watch | register | key-path, and the served replyslip.mjs bundle (nudge drivers in src/drivers) docs/drivers.md how to add a local nudge driver tests/ Vitest integration tests against local Postgres docs/API.md committed copy of the generated HTTP reference

docs/API.md must stay identical to apiReferenceMarkdown() in lib/agent-docs.ts. tests/docs.test.ts checks that.

There is no Drizzle snapshot for 0000_init. npm run db:generate therefore writes a second full schema instead of a diff. Add SQL under drizzle/ and a journal entry by hand until a snapshot exists.

Concepts

Workspaces

A workspace is the tenant. The first successful sign-in creates one and names it from the email. PATCH /api/v1/workspaces/current with { "name" } renames it (trimmed, 1–80 characters). The dashboard heading calls that route.

Sign-in

Sign-up and sign-in are the same passwordless flow. There is no password.

1. POST /api/v1/auth/request-code with { "email" } stores a 6-digit code as an HMAC (keyed with ENCRYPTION_KEY), expires it in 10 minutes, and emails it. Optional source is trimmed, lowercased, kept only when it matches ^[a-z0-9_-]{1,40}$ (otherwise null), and stored on users.signup_source only when that request creates the user. A later request does not replace it. The field is not returned by the API. A newer code invalidates older unused codes. The 200 body is the same whether or not the email already exists.
2. When RESEND_API_KEY is unset outside production, lib/email.ts prints the code to the server log; in production the send fails. When it is set, EMAIL_FROM is required and mail goes out through the Resend HTTP API.
3. Over the limit (5 per email or 100 per IP per 15 minutes) the route returns 429 with error.code rate_limited, retry_after_seconds, and Retry-After. That request does not send a code and does not count toward the window.
4. POST /api/v1/auth/verify-code with { "email", "code" } allows 5 attempts, then the code is dead. Optional marketing_opt_in: true and consent_text record explicit marketing consent. The checkbox must start unchecked. Omitting them leaves consent untouched. Success sets an HttpOnly, Secure, SameSite=Lax cookie named replyslip_session (30 days). Only the SHA-256 hash of the session token is stored.
5. POST /api/v1/auth/logout clears it. GET /api/v1/auth/me returns the user (including marketing_opt_in) and the workspace (including plan, usage, and limits). PATCH /api/v1/auth/me with { "marketing_opt_in" } changes that choice. GET or POST /api/v1/unsubscribe?token=... opts out without a session.

/dashboard is a server layout. It loads that cookie through lib/auth.ts and redirects to /sign-in when the session is missing or expired. The JSON routes call requireUser.

Join codes and agent keys

A join code registers exactly one agent, then it is consumed. Default life is 24 hours (the API accepts 1 hour to 7 days). At most 25 pending codes per workspace. Create and rotate return the secret once; list and revoke do not. Only the SHA-256 hash is stored. Prefixes are rjc_.

POST /api/v1/agents/register takes Authorization: Bearer and { "name", "description"?, "webhook"? }. The real key appears only in api_key, once. mcp.header is the placeholder Bearer . Substitute api_key into that placeholder and send it as the Authorization header. A duplicate name in the workspace is 409 and does not consume the code. Registration is limited to 60 attempts per IP per 15 minutes.

Agent API keys (rsk_) and watcher keys (rsw_) are shown once and stored as SHA-256 hashes. Revoking an agent revokes its keys. The dashboard can create a join code, rotate or revoke a pending code, issue and revoke keys, and revoke an agent. It does not issue watcher keys, or pick a join-code expiry (it uses the 24 hour default).

Where secrets live

Each secret lives only where it is used.

• Webhook bearer tokens, HMAC secrets, and static header values are encrypted in ReplySl