On 21 July 2026, Block released Buzz — an open-source, self-hostable workspace where humans and AI agents share one Nostr-backed chat-and-code environment, licensed Apache 2.0. It has since passed 31,500 GitHub stars. That is not a slow-build project finding its audience over a year. It is also, one week before the Model Context Protocol moved cross-call state into applications, an independent arrival at the same higher-layer gap from a completely different direction.
What Buzz builds is a genuinely good answer to a real problem. What is not there yet — and is not claimed to be — is the layer above identity and provenance: sequence evaluation. MCP’s specification, seven days later, likewise made no provision for that evaluation; it placed cross-call state in the application’s hands.
What Buzz actually builds
Buzz states its design goal plainly: “One community. One identity model. One event log. Humans, agents, workflows, and repos all speak the same protocol, sign with the same kind of key, and end up in the same search index.” Every participant — human or agent — holds an independent Nostr keypair, and every message, reaction, workflow step, review approval and git event lands as a signed event in one log, the same shape whether the author is a person or a process.
Agents are not bolted on as a special case. The README scopes them “by identity, not by permission flags — the same way you’d scope a teammate,” each with its own keys, channel memberships and audit trail. Three agent harnesses ship at launch — Block’s own Goose, OpenAI’s Codex, and Claude Code — wired in through the Agent Client Protocol. One component, buzz-acp, is documented in the architecture diagram as an “ACP ↔ MCP” bridge: the piece that lets an ACP-harnessed agent’s MCP tool calls land as signed events in that same log.
That is a coherent, well-scoped thing to build, and the reception suggests many teams were waiting for someone to build it: portable, cryptographically verifiable identity for agents that mixes cleanly with human identity in one audit trail, instead of a vendor API key nobody outside the platform can independently verify.
The layer that is not there yet
I looked for the next layer up — something evaluating what an agent’s signed, individually-legitimate actions compose into over a session or a channel — and it is not in the README, in either the shipped column or the actively-being-wired-up one.
The closest adjacent item, “web-of-trust reputation across relays,” sits in the third column: strong opinions, pending code. Explicitly future work. And reputation — trust attached to an identity’s track record — is itself a narrower question than composition, which asks whether this specific sequence of already-signed actions has crossed a risk threshold right now. The nearest built-adjacent feature, “workflow approval gates,” is still being wired up, and is a human sign-off checkpoint at a single step — not an automated evaluation of what a chain of already-approved steps adds up to.
None of that is a criticism, and it is worth being precise about why. Identity and provenance — know who did what, sign it, put it in one searchable, tamper-evident log — is Buzz’s job, stated as such in its own README, and it does that job well. Evaluating what a correlated sequence of signed, individually-authorized actions composes into is a different job — the one Authorized but Composed (DOI 10.5281/zenodo.21400261) is about — and nothing in Buzz’s current build or its two nearest-term roadmap columns claims to be it.
The same higher-layer gap, one week apart
Taken together, Buzz and MCP expose the same higher-layer gap. MCP explicitly named its own handoff: protocol-level sessions were removed and cross-call state became the application’s responsibility. Buzz approaches from a different direction, providing signed identity and provenance without claiming to evaluate the resulting sequence. The two are not literally the same architectural boundary — MCP separates protocol correlation from application state, Buzz separates identity and provenance from higher-level evaluation — but they leave the same thing unbuilt directly above them. The MCP maintainers were direct about what they were handing off: “If your server needs to carry state across calls, mint an explicit handle from a tool and have the model pass it back as an argument.”
MCP’s answer to “how do you know these ten tool calls belong together” is: mint a handle, thread it through. Buzz’s answer to “how do you know these ten actions came from this specific agent” is: sign every one with that agent’s key and put them in one append-only log. Different mechanism, same shape of answer — correlation and attribution, not evaluation. A handle tells you the calls are linked. A signature tells you who is accountable for each one. Neither tells you whether the ten, linked and signed, add up to something anyone would have approved if asked about the sequence instead of the step.
Buzz and the MCP spec did not reference each other. Buzz shipped 21 July; the spec shipped 28 July; as far as I can tell from public sources the two efforts were unconnected. That is what makes the pairing worth writing about rather than a coincidence to note in passing: two teams solving unrelated immediate problems — routing reliability for MCP, agent-human identity parity for Buzz — converged on the same higher-layer gap, one week apart, without coordinating.
The takeaway
Buzz is a genuinely good, fast-moving answer to an identity and provenance problem agent-native teams have needed solved for a while: one signed log, one identity model, humans and agents treated the same way instead of agents bolted on as an exception. That is worth the attention it is getting.
It is not, and by its own roadmap does not yet claim to be, an answer to a different question: what a sequence of an agent’s individually-signed, individually-legitimate actions composes into. Ten recorded actions, each correctly signed under an agent’s key, each landing cleanly in the append-only log, can still be a dataset walked out the door one signed file at a time. The log will show, precisely and verifiably, who did it. Nothing in the current build asked, before or during, whether the sequence should have happened at all.
To be precise about the claim, because drawing it the other way would repeat exactly the mistake this boundary is about: this is not an argument against adopting Buzz, and not a claim that Buzz is unsafe. Its maintainers built a useful, well-scoped identity layer and were straightforward in the README about what is shipped versus what is still pending code. The argument is narrower — signed provenance and sequence-level composition governance are two different layers. Buzz is explicit about the identity-and-provenance layer it built; MCP is explicit about the state it handed to applications. Neither claims to provide sequence evaluation. That a viral launch and a major protocol spec converged on the same higher-layer gap one week apart is a signal about where the open problem in agent infrastructure sits, not a defect in either project.
Related reading
MCP Removed Protocol Sessions. State Is Your Job Now.Authorized but Composed: the residual-moat argument
Agent Identity Is the Wrong Fight