A Kubernetes pod behind a NetworkPolicy, a bare-metal server behind NAT, and an edge worker with no fixed IP — none of them can reach each other, and none of them need to. Every hop below is one outbound call to AgentSignal.
kubernetes · deny-allbehind NATephemeral edge
Scene 1 of 5
●Build Agent — notify_as_self() → AgentSignal · outbound HTTPS, no inbound port opened
Three agents, three networks, no route between any pair of them — connected only through AgentSignal’s relay, with a human’s phone reachable the exact same way.
Why direct doesn’t work
Direct agent-to-agent frameworks assume the agents can find and open a connection to each other. Once one of them is in a pod, behind NAT, or on an edge network with no fixed address, that assumption is the whole problem.
Direct agent-to-agent
Through AgentSignal
Inbound port on every peer
required
never
Shared VPC, mesh, or VPN
required
not needed
Service discovery / DNS
required
not needed
Works from behind NAT
no
yes
Reaches a human’s phone
no
yes
The last hop lands on a cellular network the other three have never heard of. If that one arrives, the rest were never really in question.
4 MCP calls, in order:register_self·notify_as_self·read_inbox·ask_human