Warifu MCP Server

warifu

Hand someone a key and they are in the room with you — no account, no server to run. Your AI agent can sit in too.

warifu (割符) — a tally stick split in two. When the halves match, each side proves the other is who they claim to be.

日本語版: README.ja.md

A guest (Sam) joined with a room key. The agent on this computer (note-taker) speaks in the same conversation as the people, and its lines are labelled as an agent. Nobody created an account.

---

When you would use it

You need to talk to someone outside your organisation, and you do not want them to sign up for anything. Send them one room key — by chat, email, a QR code, or read out over the phone. One key lets in one person. There is no invite list to manage and no tenant to add them to. When they leave, the key is spent.

You want your coding agent in the meeting, not in a separate window. Connect Claude Code (or any MCP client) with one command. It reads and writes in the same conversation the people see, can speak out loud in the call, and can ask for a room key to bring someone in. It can only do what a person allowed — and when it needs more, it asks on your screen:

You want to talk between the office and home without running a server. The two machines connect to each other directly (QUIC through iroh — you dial a public key, not an IP address). When a router will not let them through, you can opt in to a relay (docs/relay.md); nothing is relayed unless you turn it on.

Try it

1. Download from the download page — macOS (Apple Silicon, signed and notarized) and Windows (x64 and ARM64, not code-signed). Windows needs one extra step on first launch: docs/install.md.
2. Open it. You land on your contacts. Go to Room → Invite someone → issue a key.
3. Send the key to the other person. They paste it into Join another room. You are both in the room, text first; press Add video and sound when you want it.
4. (Optional) Bring your agent in: warifu setup adds warifu to your per-user Claude Code config. Start Claude Code in any folder and it can talk in the room. See docs/mcp.md.

Prefer the command line? warifu host prints a key and waits; warifu join <key> joins from another machine. No GUI needed.

Building from source:

git clone https://github.com/meta-taro/warifu.git && cd warifu
scripts/setup-hooks.sh                        # once per clone
pnpm install
pnpm --filter @warifu/desktop tauri dev

For a distributable build: pnpm --filter @warifu/desktop tauri build. cargo run gives you a blank window — a debug build looks for the dev server. What shipped in each version: CHANGELOG.md.

Status: alpha. Here is exactly what has been measured

Do not put anything you actually need to protect on this version. Everything that is not done is written down in SECURITY.md.

Windows is not code-signed, and on first run an administrator has to allow the app through the firewall — otherwise text arrives but video never starts. The app says so by name and hands you the exact command.

What this is, in one paragraph

Most "serverless" chat still needs an account somewhere: a signalling server, a directory, a tenant. warifu removes that by making the key the identity. You hand someone a room key — one string containing your address and one half of a tally — and only that person can get in. There is no account to create, no invite to manage, no server to run. The transport is iroh (QUIC), where you dial a public key, not an IP address; that property is the tally.

What works today

Not there yet: recording, transcription, scheduling negotiation, and persistent chat history (closing the window clears it).

Recovery when you lose every device at once is still undecided (the decision log (kept in a separate, non-public notes repository), D2). PGP, Keybase and Secure Scuttlebutt did not die of missing features — they died here. We treat it as a known cause of death, not a hypothetical risk.

Agents are first-class (MCP)

This is the part that has no obvious equivalent elsewhere. Your local coding agent (Claude Code, for example) can join the same conversation a human is looking at. Lines the agent says appear on the human's screen, labelled as the agent.

warifu setup          # writes the MCP server into your per-user Claude Code config, once

• You are shown what will be permitted before it is installed. The default is conversation plus the agent's own profile — not the inbox, not the calendar.
• Nothing is permitted unless a human writes --allow. warifu never issues a permission to itself.
• Agents get chat_send / chat_read / chat_wait / room_status / profile_set and a few more. room_status answers "is a human still being asked something?" — including which room it is about.

See docs/mcp.md.

Two design commitments we will not trade away

1. A received message is data, never an instruction

Once agents exchange structured intents, prompt injection stops being one of the threats and becomes a design premise.

1. Every received agent message is data, not a command.
2. Authorization is decided outside the model. We never read a model's output to decide what is permitted.
3. Higher trust does not change how a string is handled.
4. "A smart enough model will catch it" is not an accepted answer.

Trust answers who someone is. It never answers whether to run what they said.

2. We do not round uncertainty into confidence

If we cannot tell whether the link is direct, the screen says unknown. If we cannot tell whether a firewall rule exists, the screen says we could not check — it does not tell you to add one, because that stops people who are already fine. Colour is never the only mark: state is shown as colour plus label plus shape.

Not reinventing things

We diff against existing standards before implementing.

"Existing pieces are mostly enough" would not be a failure. It would make this a profile plus a reference implementation, and implementers of those standards become candidates for the second implementation. That is a better position, not a worse one.

Stack

An SFU is out of scope for now: it would mean "a user's device relays someone else's traffic", and we will not start until the legal side is settled (the decision log (kept in a separate, non-public notes repository), D7). The line we draw is whether traffic is relayed, not how many people are in the room. The network relay you can opt in to is different: it passes encrypted packets between the two ends when a router will not let them meet, and you can point it at one you run yourself (WARIFU_RELAY_URL, see docs/relay.md). It is off by default.

How this repository is developed

Humans and an AI agent work on it together, under one rule set (.claude/rules/product-baseline.md, CLAUDE.md):

• The AI commits; a human pushes. Never a path where code leaves the machine unreviewed.
• Tests are not deferred and failing tests are not deleted. "Done" is not written without them.
• Decisions live in the decision log (kept in a separate, non-public notes repository) with the reason, and the condition that should make us stop.
• Every claim in this README is either measured or marked as not measured.

Bug reports from real machines are the most valuable thing this project receives — most of what was fixed in the last few days came from someone running it on hardware we do not have.

Licence

Dual licensed: Apache License 2.0 or MIT, at your option. See LICENSE, LICENSE-APACHE, LICENSE-MIT.