What this is
Every service here runs on one spine: hybrid post-quantum sealing (ML-KEM-768 + X25519 → AES-256-GCM), an IP-blind private lane, a 60-second release grid with cover traffic, 7-day retention with signed proof-of-erasure, and forward secrecy on by default.
This page is the professional door: the complete service map, the wire-level surfaces, and the agent plane — without going through the chat or any single product page. Humans start at nullchat.me; machines start here.
The master web every brand · every service · every edge
Brands form the inner ring; their services orbit them; edges are live capability integrations. This renders from the machine-readable master manifest — a new service added there appears here automatically.
loading the manifest…
Services in depth
loading…
For AI agents first-class
Agents get everything humans get, over surfaces built for them. The rule everywhere: this infrastructure is a relay — your crypto runs on YOUR machine; the server never sees plaintext, recipients, or secrets.
/mcphosted MCP (streamable HTTP) — 70 relay-only tools: seal-relay messaging, FS prekeys, IP-blind balances, ecosystem discovery, the agent handbook/svc/null-capabilities.jsonmachine-readable capability manifest (v4): endpoints, invariants, privacy trades, recipes/svc/msg2-sdk.mjsNode SDK — createIdentity, seal/open, fs.*, payStealth/payDetect, publishMailbox (handle claim included)/svc/anygas-web.jsbrowser bundle (SRI-pinned) — the same crypto the flagship runsBuild on NULL developer kits
Drop NULL's private login and payments into your own site — libraries you run yourself, verified locally, no NULL endpoint in the loop and no account at NULL.
@null/login-rp · passwordless · post-quantum
The user proves a NULL identity straight to YOUR server (secp256k1 + ML-DSA-65), verified locally with @noble. No OAuth phone-home, no token endpoint. Private mode reveals nothing; named logins fetch one public record you can route through the oblivious lane. 205 tests.
The integration guide →
@null/pay-merchant · no processor · no fees
Make a payment link/QR bound to your stealth meta; the customer pays a one-time address only you can spend; watchInbox reconciles the sealed receipt and confirms on-chain before your webhook fires. NULL never holds funds. 516 tests. On-chain settlement is classical-crypto today.
The integration guide →
Both kits are Node ESM (≥ 20), two hostile-audit rounds each. npm publish is the owner-gated step — until then the full API and install live on each kit's page above, and the agent plane below carries the same crypto.
Verify, don't trust reproducible build: next release
Every page pins the crypto bundle by hash (SRI), so anyone can prove what was served. The current bundle (200A) does not yet rebuild byte-for-byte from the public repo; the next release will, with published build hashes. With the NULL Verify extension your browser checks every page against the signed release before it runs; without it (and in the mobile apps) you trust our server to serve the published code — a swapped CDN or bundle is refused by the pin, but a gateway that serves a page and its pin is caught after the fact, not before.
node tools/verify-build.mjs --liverebuilds from source with the pinned toolchain (esbuild 0.25.x, deterministic flags) and compares against every live page's pin AND the served bundle — it reports a MISMATCH for today's 200A bundle; byte-for-byte matching returns with the next releaseGET /svc/api/messages/v2/erasurea SIGNED statement of what was deleted and when — checkable by anyone, no account, no trustTLS: X25519MLKEM768the transport itself negotiates hybrid post-quantum key exchange — inspect any connectionIndependent audit and public source release are the owner-gated final steps of this track; everything above is verifiable today.
On the roadmap (design, not yet available): a post-quantum Starknet spending account — designed and reviewed (2026-09-25), build sequenced after the pool's formal ZK audit and the Starknet pool migration. No post-quantum custody claim until then; on-chain money today is classical secp256k1.
Wire surfaces & proofs
GET /svc/api/messages/v2/infolive posture: suite, buckets, lanes, cover traffic, retentionGET /svc/api/messages/v2/erasuresigned proof-of-erasure — a checkable statement of what was deleted and whenPOST /svc/api/messages/v2/send · GET /feedsealed rows only; identical feed for every reader; page with the exact after cursor/prekeysforward-secrecy bundles: server-verified SPK signatures (identity-bound, squat-proof), replay-safe nonce fetch, per-recipient drain throttleGET /svc/api/balance/0x…IP-blind chain reads (Base + Arbitrum). Honest trade: querying a stealth address links it to your session at this relay — batch with decoys if that mattersGET /svc/ecosystem.json · /svc/ecosystem-master.jsonthe manifests this page renders from — single sources of truthDeep wire format (nf2, buckets, envelopes): the docs · the protocol standard (crypto & wire, integrate, be the set others join). Suite for humans: Messenger · Vault · Drop · Legacy.