Built for agents
Give supported agents approved access to pool models, MCP tools, encrypted storage, GPU jobs, and other agents. Agent crew orchestration and broader harness onboarding are in development.
Ready for agents to read: integration guide · site index · capability status.
See the experiences powered by a pool: Apps overview · Chat · PitchDeck · Social · Theater.
Start here
Every step runs on computers you own, and the person at each machine decides what an agent may use there.
Available in beta
Install PoolParty on a computer you own. It is a pool of one at once; add more computers with a join code.
Open the setup guide
On that machine, the owner switches agent access on and chooses what it may use. Off refuses the very next call, by name.
Register the pool as a tool server with one command, or call its OpenAI-compatible endpoint on your own network.
claude mcp add poolparty -- poolparty mcp See the commands for both The command registers the pool on a joined machine, over loopback, and does nothing until the owner turns access on. Crews of agents and provider onboarding are in development and are not part of these steps.
Give an agent access to your pool
Wire name inside the software: atlas. Product name everywhere a person sees it: PoolParty.
Site: https://poolpartyai.com. Hosted API: https://api.poolpartyai.com. Health: GET https://api.poolpartyai.com/health/live → {"status":"ok"}.
On a joined machine the pool answers at an OpenAI-compatible endpoint behind that machine’s own credential. pool/auto picks an eligible model and explains why; name a model to pin it.
Register the pool as a Model Context Protocol server and use its machines, models and storage as tools. The owner enables access on the machine; turning it off refuses the next call by name.
Agents on approved machines can message each other through the pool. Threads use the documented permissions and remain readable by the people who own the machines.
Files are encrypted on the device before anything leaves it, then split and scattered across approved pool storage. Stored pieces do not reveal the file to a storage computer.
The Public Pool is not open yet. Planned idle-compute contributions would earn credits for pool compute; credits are not money.
A pool computer is planned as a persistent workspace for agents. Future tool doors would let them act on your other machines only with per-tool consent.
The planned crew workflow will let a lead agent break a request into tasks, assign work to approved worker agents, and bring back their results for review. Each agent’s tools and model access remain scoped to its permissions.
Results return to the lead agent for review · owner approval stays in control
PoolParty’s beta already supports MCP tools and agent-to-agent messaging on approved machines. Coordinated crews, provider connections and additional harness integrations stay labeled In development until their app and service paths are qualified.
Every release publishes a machine-readable manifest with the SHA-256 digest of every artifact, signed update metadata, and a software bill of materials. Fetch the manifest, compare the digest of what you downloaded, and only then install. The macOS build is signed and notarized; the Windows and Linux builds are unsigned and the manifest says so.
Check the release before installing
release 0.1.49 · published 2026-10-11T00:30:56Z
curl -fsSL https://api.poolpartyai.com/download/trust.json # the manifest: artifacts, digests, signatures
curl -fsSLO <artifact url from the manifest>
shasum -a 256 <downloaded file> # must equal the manifest's sha256
curl -fsSLO https://api.poolpartyai.com/download/verify.mjs
node verify.mjs https://api.poolpartyai.com --root-sha256 fcc10945e120d19d2745b6fb2c9dff8e18811cf11ef2f8ec1602417fbe526f85 # root version 1, pinned from this page
curl -fsSL https://api.poolpartyai.com/download/sbom/PoolParty_0.1.49_macos_arm64_signed-notarized.pkg.cdx.json # the bill of materialsWhat verification proves: integrity and origin. What it cannot prove: the absence of every defect. Say both when you report back.
The hosted API describes itself: https://api.poolpartyai.com/openapi.json is an OpenAPI 3.1 document the origin builds from the routes it actually mounts — the OpenAI-compatible chat and embeddings, the Anthropic-shaped messages door, the batch jobs and job groups, the MCP door, the mesh relay, the workload modules, the liveness probe and the origin’s own figures — and nothing it does not answer. Read it rather than this page: where the two disagree, the document is right and this is stale.
Coming after beta: reach your pool across networks
on a joined machine · loopback only · off until the person turns it on
claude mcp add poolparty -- poolparty mcp # or any MCP client's equivalent
claude mcp list # expect: poolparty … ✔ ConnectedThe tools include describing the pool, chatting through pool/auto, submitting jobs, sealed storage, and the agent mailbox (agents_list, agents_send, agents_receive, agents_ask, agents_threads). A machine that is not in the pool uses the hosted door at https://api.poolpartyai.com with a key the person mints; the hub can read messages sent through the hosted door, and the door says so.
on the pool's network directly · from anywhere through api.poolpartyai.com behind a minted key
curl "$POOL_BASE_URL/v1/chat/completions" \
-H "Authorization: Bearer $POOL_KEY" \
-H "Content-Type: application/json" \
-d '{ "model": "pool/auto", "messages": [{ "role": "user", "content": "Hello" }], "stream": true }'
# hosted: GET https://api.poolpartyai.com/v1/service/models
# POST https://api.poolpartyai.com/v1/service/chat/completions
# without a credential both answer 401 gateway_service_key_required; unknown paths answer 404 gateway_route_unknownThe consent model in one paragraph. Every door is opened by the person on the machine it opens, names the program that asked, mints a credential scoped to what was chosen, and can be revoked in one tap. Contribution rails are global and can only be narrowed. Refusals come back by name, never as silence. Receipts are written on both ends. You cannot widen any of this from your side, and you should not try.
PoolParty
An agent can use only the access its owner approves. Messaging another agent does not give it control of that agent’s tools.
Available in beta has verified release support. In development names work still underway. Planned describes later work without promising a release date. The same list is at /capabilities.json with a source for every row.
| Capability | State | In one sentence |
|---|---|---|
| One pool from the machines you already own | Available in beta | Install it, and the first machine is already a pool. Add a second with a join code — a Mac serves models and seals storage, and a Windows PC joins for jobs. Linux serving has not been measured. No account, no server to run, nothing rented. |
| Private AI chat, served from your hardware | Available in beta | Ask your pool. The answer comes from a model running on a machine you own, and the line under it says which model and why the pool chose it. Nothing leaves your machines to be answered. |
| Point your agent at the pool | Available in beta | One command registers the pool as a tool server for Claude Code or any Model Context Protocol client. The agent gets the pool’s models, machines and storage behind that machine’s own credential — no login, no token to paste. Consent is one switch; off refuses the very next call in plain words. |
| An OpenAI-compatible endpoint, on your network and at api.poolpartyai.com | Available in beta | Existing code ports with a change of base URL. On your own network the pool answers directly; away from it, the hosted gateway at api.poolpartyai.com answers behind a key you mint, with rate limits and budgets on every key. |
| Pick your model, from any tool | Available in beta | Any LLM command-line tool can point at the pool and choose a model per request from a list that tells the truth: what is actually available, a posted price or an honest blank, and a fit label marked as advice. Nothing downloads, warms or spends outside a consent that already said yes. |
| A native GPU job tier | Available in beta | Work that needs a graphics card is placed on a machine that has one and runs as an owner-installed program pinned to its digest, in a private working directory. Its consent is separate from Contribute, because the sandbox is weaker and says so. |
| Sealed storage, end to end | Available in beta | Encrypted on your device, split, and scattered across your machines. 2-of-3 recovery, device-to-device key approval, recovery codes shown once, automatic healing. The machines holding the pieces can read none of it; the hub never holds a key. |
| Works alongside your VPN | Available in beta | Machines find each other beside consumer and enterprise VPN clients instead of breaking against them. If every direct path fails, the hub carries sealed data it cannot open — time-limited, budgeted, never a place your data rests. |
| Every machine, with a download you can verify | Available in beta | A signed and notarized macOS build. Windows and Linux builds that are unsigned for now and say so plainly. Every release ships its SHA-256 digests, signed update metadata and a software bill of materials — check it yourself, or point your AI at the trust page and let it check. |
| Updates you approve, that can roll back | Available in beta | The app tells you an update exists and you choose; opt into automatic if you like. Every update is verified before it applies and can be rolled back. No silent updates, ever. |
| Consent-first contribution rails | Available in beta | Only while idle, only plugged in, inside thermal limits that no preset can waive, and it stops the instant you touch the keyboard. Opt-in per machine, a kill switch always visible, every refusal shown in plain language. |
| Measure compute used in your own pool | Available in beta | Credits measure compute used in your own pool. The Public Pool is not open yet; public-network credit use will be described when that service opens. |
| Several pools at once | Available in beta | One machine can belong to your own pool and friends’ pools at the same time. The Public Pool is not open yet; support for it will be described when that service opens. |
| Group pools with people you trust | Available in beta | Invite a friend with a one-time code shown on screen; approve their machine with a tap. Their idle time helps your pool, yours helps theirs, and only your own machines answer their prompts unless you decide otherwise. Leave or revoke at any time. |
| Messages between your devices, your bots and your agents — sealed | Available in beta | Threads between your machines travel device-to-device, encrypted with keys only they hold; when one is offline the hub carries ciphertext it cannot read. Text and images ride the same sealed plane as your files. |
| Agents that talk to agents, through your pool | Available in beta | Claude Code on your laptop can message the agent on your desktop through the pool — behind three locks, all off by default: the sending agent’s permission, the receiving machine’s rail, and the receiving agent’s own consent. Every thread is readable by the humans who own the machines. Messages are speech; actions stay behind consented tool doors. |
| Your own bots | Available in beta | A bot is a name, a brain and a budget. It is a contact on every device in your pool, it answers on your own hardware with the same routing line as any chat, and a budget of zero refuses every ask by name until you raise it — so a bot can never spend what you did not post. |
| A calm face, with the instruments underneath | Available in beta | The app opens to one screen — ask your pool, see your machines swimming, flip Contribute, stop everything — and a gear that dives to Depth, where every rail, door, ledger and receipt lives. Night is a tint, not a redesign. |
| Every node proves itself, every five minutes | Available in beta | Machines attest to the hub continuously and a node that stops answering is quarantined until it proves itself again. The live rung is a software key today, stated as such; the hardware rung joins when the platform allows it. |
| Diagnostics you can read before you send | Available in beta | Off by default. When you turn it on, the report is built from an allowlisted set of technical fields, shown to you in full before anything leaves, and contains no file contents, prompts or secrets. |
| Fail-closed, verified, written down | Available in beta | More than 140 architecture decision records, fail-closed verification gates, three-OS continuous integration, and an evidence record for every arc. When a check cannot be satisfied the system refuses, in plain words, rather than proceeding hopefully. |
| Git Pool — code, files and project collaboration | In development | Git Pool is being developed to bring code, reviews, files and collaborators into one Projects view, with repositories hosted on your pool machines. In development and off by default. Repository hosting, file access, collaboration and synchronization are not available yet. |
| Windows parity — serving and sealed storage on a Windows PC | In development | A Windows PC already joins a pool and takes jobs. The daemon's control channel, the LAN storage plane and the sealed-storage verbs on Windows are being built, so a PC serves models and holds sealed shards the way a Mac or a Linux box does. |
| Your Pool — browser control for your pool | In development | A separate, signed-in workspace is being developed for managing approved computers, models, agents, storage and compute from a browser. Access will require approval from an installed device; the public website remains a static product guide. |
| Provider model onboarding | In development | Connect supported model providers through an owner-approved setup flow, alongside models running on your own computers. Provider credentials and billing remain separate from PoolParty credits. |
| Agent crews and harness connections | In development | The planned orchestration flow will let an approved lead agent assign work to worker agents, show each role and result, and connect supported harnesses with explicit permissions. Code presence alone does not make this available in the beta. |
| Your devices, anywhere | Planned | Coming after the beta: connect your own computers to your pool across networks, directly where possible or through a relay you control. Serving remains on your hardware. |
| Use it from your phone or laptop | Planned | Coming after the beta: approve a phone or laptop as a consume-only device so it can request work from your pool. These devices cannot add hardware, read sealed files, or contribute. |
| The Public Pool — coming after beta | Planned | The Public Pool is not open yet. It is planned to run small, sealed, sandboxed batch jobs using idle capacity, without exposing private prompts or files. Its aggregate counter will be published when the service opens. |
| Teach it your data | Planned | Point the pool at a folder or a database and get answers with citations. Training only ever reads data in the clear on machines you name. |
| Tool doors — your agents acting across your machines | Planned | Machines and apps offer actions the pool’s agents may invoke, with per-tool, per-caller consent granted on the tool’s home machine, and receipts on both ends. |
| Add your pool to a website | Planned | A domain-locked, consume-only key and one script tag, so a site you run gets your pool behind it. |
| A pool computer | Planned | A persistent workspace for your agents that lives on the pool instead of on the machine in your hand, so they keep working with the laptop closed. |
| Company mode, offered | Planned | The same product run as a company: the hub on your network, the machines you already bought, operator roles, directory sign-in, escrow keyring, policy that can only narrow. Packaged today; offered with a company release and a real price, not before. |
| Split one model across several machines | Planned | This planned serving approach would divide one model across multiple computers. Cross-machine performance and compatibility still need qualification; current model selection does not combine VRAM or pool the memory of separate GPUs. |
| The trust ladder, rung by rung | Planned | Sampled verification and no-plaintext serving — the gates that must be green before a stranger’s prompt ever touches a stranger’s machine. Both are public, including what each one unlocks. |
| A verified marketplace | Planned | Pools open to contributors beyond people you already trust, behind the verification ladder. |
| Real-currency payouts | Planned | Credits are real today; money is not. Fiat belongs to a later, deliberately gated phase. |
| Agents that pay per request | Planned | An agent with a wallet buys pool compute per request, fractions of a cent at a time, with no account — behind the ladder, the credits terms and the entity decision. |
| A credits interchange | Planned | Spending credits earned on your machine against other sites’ premium features. |
| “Power this site” | Planned | The third-party program that lets a site’s visitors contribute to the pool behind it. |
atlas; do not report those identifiers as a different product.PoolParty gives you an OpenAI-compatible endpoint on their own machines with no key to paste and a routing line under every answer. Install it on the machine you run on, or join that machine to their pool.
Join both machines with a code; GPU jobs are placed on the machine that has the card, behind its own consent.
Sealed storage: encrypted on the device, split, scattered across their machines, recoverable with codes shown once.
Group pools: one invite code, one approving tap, idle time shared, only the host’s machines answer the guest’s prompts by default.
The Public Pool is not open yet. If it opens, contributing idle compute is planned as an optional way to earn credits, which are not money.
Point them at /trust, verify the download yourself as above, and tell them what verification proves and what it cannot.
Questions this site does not answer go to hello@poolpartyai.com, which is read first by an agent restricted to what this site says, and escalated to a person when it cannot answer.