What is Efficient Labs?

Efficient Labs builds sovereign AI infrastructure. StratosAgent runs on your own hardware and The Atmosphere meshes those nodes peer-to-peer across the world — content-addressed, capability-secured, and post-quantum — so you can build, run, remember, and scale AI without surrendering ownership.

What is StratosAgent?

StratosAgent is a local-first AI agent runtime that runs on hardware you control. It is owner-governed, keeps its state and memory across sessions, and connects to other nodes through The Atmosphere rather than a central cloud.

What is The Atmosphere?

The Atmosphere is a sovereign mesh that links AI nodes peer-to-peer. It is content-addressed, capability-secured, and post-quantum, so no central server is required to run, route, or remember — described as the sovereign internet for AI agents.

How is this different from cloud AI?

Your intelligence runs on infrastructure you own instead of a provider's cloud. There is no landlord and no per-use meter; your data and state stay on your hardware. Efficient Labs runs its own company on this system and publishes the operating layer's telemetry — operational proof before public proof.

The Atmosphere StratosAgent Architecture Pricing Enterprise Docs Status

Open OS Sign in Install now

The Atmosphere StratosAgent Architecture Pricing Enterprise Docs Status

Open OS Sign in Install now

The Atmosphere

A mesh with no open ports,
no central server, no off-switch.

The Atmosphere is the transport layer beneath every StratosAgent: a peer-to-peer mesh where nodes find each other over a public DHT, hole-punch directly through NAT, and exchange content-addressed, post-quantum-sealed data. There is no broker in the middle to subpoena, throttle, or switch off. This page goes under the hood — past the homepage's one-line pitch and into how it actually works, and exactly what is running today.

Topology: P2P mesh · no hub
Inbound ports: Zero
Discovery: Public DHT
Trust: Post-quantum

01What the Atmosphere is

A fabric, not a cloud

“The cloud” is someone else's computer with your keys on it. The Atmosphere inverts that: the network is the union of the machines you and your peers already own. There is no datacenter to trust because there is no datacenter — just nodes that speak directly, prove what they carry, and refuse anything they can't verify.

PEER-TO-PEER · NO CENTRAL SERVER · NO OFF-SWITCH

Owned, not rented

Every node runs on hardware its operator controls — a laptop, a workstation, a home server. Capacity comes from the edge, not a rented region. Nothing about you lives on infrastructure you don't hold the keys to.

Direct, not brokered

Peers connect to each other, not through a relay that sees every message. The mesh has no privileged middle to compromise, bill, or compel.

Verified, not assumed

Data is addressed by the hash of its contents and sealed with post-quantum signatures. A node trusts a payload because the math checks out — never because of where it came from.

02The mesh architecture

DHT discovery + hole-punch transport

Two mechanisms do the heavy lifting. A distributed hash table lets a node find its peers without a central directory. NAT hole-punching then opens a direct path between them without ever asking the operator to forward a port or expose a service. The result is reachability without exposure.

Public DHT discovery

Wired

Nodes announce and look each other up on a public Hyperswarm-style DHT keyed by topic. There is no membership server and no account registry — knowing the topic key is what lets two peers find one another in the swarm.

NAT hole-punching — zero inbound ports

Wired

Once two nodes know each other, they coordinate a simultaneous outbound connection that punches straight through their NATs. Neither side opens a listening port to the public internet. There is no attack surface to scan because there is nothing exposed.

Why “no open ports” is the whole point

Nothing to scan

An attacker port-scanning your IP finds nothing listening. The node only ever makes outbound connections it initiated.

Nothing to seize

There is no central endpoint to subpoena or pull offline. Take down any node and the mesh routes around it.

Nothing to surveil

Traffic is peer-to-peer and end-to-end sealed. No relay in the middle accumulates a log of who talked to whom.

03Joining the mesh

What happens when a node comes online

Bringing a node up is a sequence of local, outbound-only steps. No inbound configuration, no firewall surgery, no public address to register.

Generate identity locally

On first run the node mints its keypair on the machine itself. Private keys are sealed in the vault and never leave the device.

Announce on the DHT

The node publishes itself under its topic keys to the public DHT — an outbound operation. No listening socket is opened to receive lookups.

Discover & hole-punch peers

It finds peers on the same topics and coordinates simultaneous outbound dials that punch through NAT, forming direct encrypted links.

Sync content-addressed state

Peers exchange data by hash, verifying every block. Skills carry provenance and are seal-checked before they are accepted.

Sovereign by construction

At no point does the operator forward a port, register a public hostname, or hand a key to a third party. Reachability is an emergent property of the swarm, not a service someone grants you — which is exactly why nobody can revoke it.

Keys generated and held on-device
Outbound-only — no inbound listeners
Discovery via topic keys, not accounts
Survives any single node disappearing

04Contribution & proof-of-capacity

How nodes carry their weight

A mesh is only as strong as what its members contribute. Nodes bring storage, bandwidth, and compute — and contribution is something the network can measure, not just claim. The accounting layer comes first; rewards built on top of it come later, and we say so plainly.

Storage

Wired

Nodes hold and serve content-addressed blocks. Because data is named by its hash, any node holding a block can serve it and the requester can prove it's the right one.

Bandwidth

Wired

Skill and state propagation rides gossip across direct peer links, so popular content spreads without any single node — or central CDN — bearing the whole load.

Compute

Wired

A node can resolve work locally for itself and, where its operator allows, contribute spare cycles to the mesh — turning idle hardware into capacity that already exists.

Proof-of-capacity — measurement before rewards

Mock

The honest version: the path is measurement → attribution → rewards, built in that order. Content-addressing and gossip give us a verifiable record of what a node actually served. Economic settlement on top of that is designed to be offline-signed and never broadcast today — it is scaffolded, not real. We will not show you a token chart and call it a network. The status matrix tracks this as Mock until it ships.

05Sovereignty & trust

Trust the math, not the middleman

Sovereignty isn't a slogan here — it's enforced by the cryptography every node runs at the substrate. These are the pieces that make the mesh untrusting by default.

Content-addressed pipeline

Live

Data is referenced by the hash of what it contains, so integrity is intrinsic. You can fetch a block from any peer and still know it's exactly the bytes you asked for.

SHA-256 freshness model in the engine
A block is named by its contents
Tampering changes the hash — and is rejected

Post-quantum seals

Live

Skills and receipts are signed with post-quantum signatures, so provenance holds up even against an adversary with a future quantum computer.

ML-DSA-65 signatures on skills & receipts
Forward-safe against quantum attack
Seal verified on ingest before trust

Gossip skill-sync

Wired

New capabilities spread through the mesh by gossip, carrying their provenance with them — and each peer re-verifies the seal before accepting anything.

Peer-to-peer skill propagation
Provenance travels with the payload
Seal-checked on every hop

How we label every capability

Full status matrix →

Live: Running in production, exercised by tests.
Wired: Built and connected into the daemon; hardening in progress.
Standalone: Built and tested in isolation; live wiring is supervised.
Mock: Scaffold / placeholder — explicitly NOT real yet.

Run a node

Add your machine to the Atmosphere.

Two commands stand up a sovereign node — no ports, no VPS, no central server. See the agent that rides on top, or read exactly what's live today.

Install a node Meet StratosAgent

Back to overview