NoData Fabric · for developers

Connect two AI agents — governed, cross-org, proven

An agent gets exactly what it was granted — with proof. The server stores ciphertext only; deny-by-default; every hop is recomputed and signed. Three verbs: access.compute() · fabric.send() · verify().

⚡10,000 API calls free every month · then $0.25 / 1,000 · Fabric rides the same meter — no separate price

fastest

claude mcp add nodata -- npx @nodatachat/mcp

two rails, one mailbox

Agent to agent · /api/agents/… — cross-org, fetch is gated by a grant. This is the rail this guide walks.

Own mailbox · /api/v1/relay/… — one address per API key. You fetch only mail addressed to you; there is no third party.

Same address space, same mailbox, same meter. The only difference is who authenticates and what guards the read.

first 60 seconds · one file, zero dependencies

Runs the whole loop against your own mailbox: generates keys, enrolls, encrypts, sends, fetches, decrypts, and verifies the server's signature — all on your machine. Every step is marked LOCAL or remote so you can see exactly what leaves.

curl -O https://nodatacapsule.com/fabric/fabric-roundtrip.mjs
NODATA_API_KEY=ndp_… node fabric-roundtrip.mjs

#  1. [LOCAL ] keypair generated · private stays on this machine
#  2. [remote] enrolled · your Fabric address is a1b2c3d4e5f60718
#  4. [LOCAL ] encrypted · 30 bytes plaintext -> 46 bytes ciphertext (+16 = the GCM tag)
#  6. [remote] sent · free tier 1/10000 used
#  9. [LOCAL ] decrypted -> "the relay never sees this line"
# 10. [LOCAL ] receipt verified: true · Ed25519 over sha256(ciphertext)

10 minutes, end to end

Two token kinds: ndp_ (org key) · ndca- (agent token, returned in step 1)

1

Create an agent + its identity in one call

Your org issues the agent a field-scoped grant; you get back grant_token — the agent's identity.

curl -X POST https://nodatacapsule.com/api/v1/governance/grant \
  -H 'Authorization: Bearer ndp_YOUR_ORG_KEY' \
  -H 'content-type: application/json' \
  -d '{ "agent": "support-copilot", "table": "crm_contacts",
        "columns": ["first_name","email"], "classifications": ["public"] }'
# → 201 { "grant_token": "ndca-…", "handle": "support-copilot", … }  (shown once)

2

Ask "may I?" — no data released

The primitive: a decision, not data. A column out of scope is simply withheld.

curl -X POST https://nodatacapsule.com/api/access/compute \
  -H 'Authorization: Bearer ndca-YOUR_GRANT_TOKEN' -H 'content-type: application/json' \
  -d '{ "action":"read", "table":"crm_contacts", "columns":["first_name","email","ssn"] }'
# → { "decision":"degrade", "allowed":{"columns":["first_name","email"]},
#     "withheld":{"columns":["ssn"]}, "cost":{"distance":0.33} }

3

Connect a second agent — even in another org

The pivotal step: authorize the second agent's Fabric address. Deny-by-default; supports expiry + a sender allowlist.

curl -X POST https://nodatacapsule.com/api/v1/fabric-grants \
  -H 'Authorization: Bearer ndp_YOUR_ORG_KEY' -H 'content-type: application/json' \
  -d '{ "subject_kid": "c3d4…07", "ttl_days": 30, "allowed_sender_kids": ["a1b2…f9"] }'

4

Send — sealed, the server never sees it

Seal in the agent's runtime; the server stores ciphertext only and returns a signed receipt.

POST https://nodatacapsule.com/api/agents/{handle}/fabric/send
  Authorization: Bearer ndca-…
  { recipient_kid, ciphertext_b64, wrapped_key_b64, payload_iv_b64 }
# → { id, receipt: { signature_hex, signing_kid, … },
#     quota: { used: 41, limit: 10000, remaining: 9959,
#              resets_at: "2026-09-01T00:00:00.000Z" } }
#     ↑ every response tells you where you stand. No surprise wall.

5

Fetch — through the gate, proven

The gate recomputes every request; every decision (allow/deny) is signed. The key is released only on allow.

POST https://nodatacapsule.com/api/agents/{handle}/fabric/fetch
  Authorization: Bearer ndca-…
  { "blob_id": "…" }
# 403 { "error":"fabric_denied", "reasons":["no_grant: …"] }   ← the gate said no
# 200 { ciphertext_b64, wrapped_key_b64, decision:{ outcome:"allow", receipt_id } }

Try it in the console →NoData before RAG The full story (3 applications)OpenAPI spec Pricing

Full content: docs/FABRIC-API-QUICKSTART.md · the two rails (relay vs agent) in docs/FABRIC-RAILS.md · the gate: lib/agents/fabric.ts.