Warifu

warifu

Hand someone a key and they are in the room with you — no account, no server to run. Your AI agent can sit in too.

warifu (割符) — a tally stick split in two. When the halves match, each side proves the other is who they claim to be.

日本語版: README.ja.md

*A guest (Sam) joined with a room key. The agent on this computer (note-taker) speaks in the same conversation as the people, and its lines are labelled as an agent. Nobody created an account.*

---

When you would use it

You need to talk to someone outside your organisation, and you do not want them to sign up for anything. Send them one room key — by chat, email, a QR code, or read out over the phone. One key lets in one person. There is no invite list to manage and no tenant to add them to. When they leave, the key is spent.

You want your coding agent in the meeting, not in a separate window. Connect Claude Code (or any MCP client) with one command. It reads and writes in the same conversation the people see, can speak out loud in the call, and can ask for a room key to bring someone in. It can only do what a person allowed — and when it needs more, it asks on your screen:

You want to talk between the office and home without running a server. The two machines connect to each other directly (QUIC through iroh — you dial a public key, not an IP address). When a router will not let them through, you can opt in to a relay (docs/relay.md); nothing is relayed unless you turn it on.

Try it

1. Download from the download page — macOS (Apple Silicon, signed and notarized) and Windows (x64 and ARM64, not code-signed). Windows needs one extra step on first launch: docs/install.md.
2. Open it. You land on your contacts. Go to Room → *Invite someone* → issue a key.
3. Send the key to the other person. They paste it into *Join another room*. You are both in the room, text first; press *Add video and sound* when you want it.
4. *(Optional)* Bring your agent in: warifu setup adds warifu to your per-user Claude Code config. Start Claude Code in any folder and it can talk in the room. See docs/mcp.md.

Prefer the command line? warifu host prints a key and waits; warifu join joins from another machine. No GUI needed.

Building from source:

git clone https://github.com/meta-taro/warifu.git && cd warifu

scripts/setup-hooks.sh # once per clone pnpm install pnpm --filter @warifu/desktop tauri dev

For a distributable build: pnpm --filter @warifu/desktop tauri build. `cargo run` gives you a blank window — a debug build looks for the dev server. What shipped in each version: CHANGELOG.md.

Status: alpha. Here is exactly what has been measured

Do not put anything you actually need to protect on this version. Everything that is *not* done is written down in SECURITY.md.

Windows is not code-signed, and on first run an administrator has to allow the app through the firewall — otherwise text arrives but video never starts. The app says so by name and hands you the exact command.

What this is, in one paragraph

Most "serverless" chat still needs an account somewhere: a signalling server, a directory, a tenant. warifu removes that by making the key the identity. You hand someone a room key — one string containing your address and one half of a tally — and *only that person* can get in. There is no account to create, no invite to manage, no server to run. The transport is iroh (QUIC), where you dial a public key, not an IP address; that property *is* the tally.

What works today

Not there yet: recording, transcription, scheduling negotiation, and persistent chat history (closing the window clears it).

Recovery when you lose every device at once is still undecided (the decision log (kept in a separate, non-public notes repository), D2). PGP, Keybase and Secure Scuttlebutt did not die of missing features — they died here. We treat it as a known cause of death, not a hypothetical risk.

Agents are first-class (MCP)

This is the part that has no obvious equivalent elsewhere. Your local coding agent (Claude Code, for example) can join the same conversation a human is looking at. Lines the agent says appear on the human's screen, labelled as the agent.

warifu setup          # writes the MCP server into your per-user Claude Code config, once

• You are shown what will be permitted before it is installed. The default is conversation plus the agent's own profile — not the inbox, not the calendar.
• Nothing is permitted unless a human writes `--allow`. warifu never issues a permission to itself.
• Agents get chat_send / chat_read / chat_wait / room_status / profile_set and a few more. room_status answers "is a human still being asked something?" — including *which room* it is about.

See docs/mcp.md.

Two design commitments we will not trade away

1. A received message is data, never an instruction

Once agents exchange structured intents, prompt injection stops being *one* of the threats and becomes a design premise.

1. Every received agent message is data, not a command.
2. Authorization is decided outside the model. We never read a model's output to decide what is permitted.
3. Higher trust does not change how a string is handled.
4. "A smart enough model will catch it" is not an accepted answer.

Trust answers *who someone is*. It never answers *whether to run what they said*.

2. We do not round uncertainty into confidence

If we cannot tell whether the link is direct, the screen says unknown. If we cannot tell whether a firewall rule exists, the screen says we could not check — it does not tell you to add one, because that stops people who are already fine. Colour is never the only mark: state is shown as colour *plus* label *plus* shape.

Not reinventing things

We diff against existing standards before implementing.

"Existing pieces are mostly enough" would not be a failure. It would make this a profile plus a reference implementation, and implementers of those standards become candidat