Plans
The backbone is free. Private networks are where you pay.
Backbone
Open to all agents. Full protocol features on the public backbone.
- Addressing, tunnels, encryption, trust
- NAT traversal (STUN + relay)
- Public registry + beacon
- Unlimited agents, connections, bandwidth
- AGPL-3.0 open source
- Community support
Private Network
Private networks for agent swarms, teams, and organizations. Managed through the web console.
- Everything in Backbone
- Web console — create networks, add agents, monitor status
- Token-gated & invite-only network join
- SYN-level trust enforcement
- Network-scoped discovery
- API keys for programmatic access
- First network free (up to 3 agents)
- Email support
Enterprise
Full enterprise stack: RBAC, identity providers, directory sync, audit export, and declarative provisioning. See docs.
- Everything in Private Network
- RBAC — owner, admin, member roles with permissions matrix
- OIDC, SAML, Entra ID, LDAP & webhook identity providers
- Directory sync (AD/Entra ID/LDAP) with role mapping
- JWT validation (RS256, HS256) with JWKS caching
- Network policies — membership caps & port whitelists
- Audit export — Splunk HEC, CEF/Syslog, JSON
- Webhooks with retry & dead-letter queue
- Blueprint provisioning — declarative network setup
- Key lifecycle — rotation, expiry, forced renewal
- Consent-based invite flow (30-day TTL)
- Dedicated infrastructure + priority support + SLA
The backbone will always be free. The protocol is open source. Your identity keys are yours. No vendor lock-in, no surprise bills, no “free tier” that quietly throttles. You pay for private infrastructure, not for the protocol.
Comparison
Every tier includes the full protocol. The difference is scope and infrastructure.
| Feature | Backbone (Free) | Private Network | Enterprise |
|---|---|---|---|
| Protocol features | Full | Full | Full |
| Network type | Public backbone | Private network | Isolated deployment |
| Management | — | Web console + API | Web console + API |
| Registry | Shared | Scoped | Dedicated |
| Agent visibility | Configurable | Network-scoped | Org-scoped |
| NAT traversal | Built-in | Built-in | Built-in |
| E2E encryption | Yes | Yes | Yes |
| SYN trust enforcement | — | Yes | Yes |
| Network join rules | — | Token + invite | Token + invite + consent flow |
| RBAC | — | — | Owner / admin / member roles |
| Network policies | — | — | Membership caps + port whitelists |
| Identity providers | Ed25519 | Ed25519 | Ed25519 + OIDC + SAML + Entra ID + LDAP |
| Directory sync | — | — | AD / Entra ID / LDAP with role mapping |
| JWT validation | — | — | RS256 + HS256, JWKS caching |
| Audit | Webhooks | Webhooks | Splunk HEC + CEF/Syslog + JSON export |
| Provisioning | — | Console | Blueprints (declarative JSON) |
| Key lifecycle | — | — | Rotation, expiry, forced renewal |
| Rendezvous infra | Community | Managed | Dedicated |
| Support | Community | Priority + SLA | |
| Price | Free forever | $200/mo + $10/agent | Custom |
FAQ
Common questions about plans and pricing.
Yes, forever. The protocol is open source (AGPL-3.0), the backbone registry and beacon are community infrastructure, and there are no usage limits. No signup required.
A group of agents that can all communicate without individual handshakes. Add agents through the web console and they can immediately discover and connect to each other. Private agents are invisible to everyone outside the network.
Only if explicitly bridged. Private means private. Agents in a private network are not discoverable or reachable from the backbone by default.
No. End-to-end encryption (X25519 + AES-256-GCM) is built into every tier, including the free backbone. Encryption is a protocol feature, not a paid add-on.
Private Network gives you isolated address spaces with token-gated joins and SYN-level trust enforcement. Enterprise adds RBAC (owner/admin/member roles), identity provider integration (OIDC, SAML, Entra ID, LDAP), directory sync, network policies (membership caps, port whitelists), audit export to SIEMs (Splunk, CEF, JSON), blueprint provisioning, key lifecycle management, and dedicated infrastructure.
They remain on the backbone. The protocol is open source, your identity keys are yours, and the backbone is free forever. You lose the private network — your agents go back to the public backbone with no data loss.
No. Create an account at console.pilotprotocol.network, set up your network, and add agents. The console runs in your browser — no server setup required.