Lullwire Link by ALTRU.dev
Early prototype · not yet independently audited

Let your AI use your tools, from anywhere.

Lullwire Link is an end-to-end encrypted connection between an AI client and the MCP tools running on your own machines. No open ports, no VPN, no cloud account holding your data. The relay in the middle only ever passes sealed messages.

See how it works Ask for early access

How it works

Three small pieces, one program. The tool side and the AI side both connect out to a relay, so neither machine needs to accept incoming connections.

Step 1

Run the tool

On the machine with your MCP server, start Link in front of it. It connects out to the relay and waits.

Step 2

Pair once

Link prints a one-time code. Paste it on the AI side within 10 minutes. It works once, then it's gone.

Step 3

Use it

Point your AI client at connect as an MCP server. Your tools show up as if they were local.

In the terminal

One small program with no dependencies. The same binary is the relay, the tool and the agent.

# on the machine with your tools
$ hush-link tool init -name home-tools -relay wss://link.altru.dev/link -token RELAY_TOKEN
$ hush-link tool pair -label laptop
  pairing code (works once, 10 minutes): hushlink:eyJ2IjoxLCJy…
$ hush-link tool serve -- ./my-mcp-server

# on the machine with your AI client
$ hush-link agent join hushlink:eyJ2IjoxLCJy…
  then use this as the MCP server command:
$ hush-link agent connect home-tools

Security, in plain words

Built so the relay doesn't have to be trusted. Run your own relay if you'd rather not trust ours either.

Both sides prove who they are

Every session starts with a key exchange (X25519, Noise-IK style). The AI side can't reach a tool it isn't paired with, and a fake tool can't answer it.

Nothing to replay

Fresh keys every session (forward secrecy), AES-256-GCM per message, strict ordering. A copied, reordered or altered message ends the session.

Nothing starts early

Your MCP server is only launched after the AI side's first message decrypts. Strangers knocking get nothing to talk to.

What the relay can see

  • When connections happen and how long they last
  • IP addresses of both ends
  • A random room id per tool
  • How many messages, and how big

What it can't see

  • Keys, or which AI client is connecting
  • Tool names, methods and arguments
  • Files, query results or anything returned
  • Your pairing secrets

Where it stands

Link works end to end today: pairing, encrypted sessions and MCP over stdio, with automated tests for replay, tampering, revoked and unpaired agents. It hasn't had an outside security review yet, so please don't trust it with anything critical.

  1. Reconnect and failover: sessions survive a dropped connection.
  2. Remote MCP over HTTP: so web-based AI clients can use it too.
  3. Per-agent permissions and audit log: decide which tools each AI client may call.
  4. Packaging: release downloads, QR pairing, a background service.
  5. Lullwire Business: a hosted relay and team controls on the same engine.