I crossed the Bay Bridge to True Ventures on May 19 for the first Bay Area AT Protocol meetup. The most useful signal in the room was not enthusiasm. It was working software.
Three builders showed pieces that run. Not roadmaps. Not posture. Working edges. Founders working across payments, crypto, social and identity filled the seats, and True Ventures lent the office. Underneath the variety sat one through-line. Bluesky may be the visible surface. AT Protocol is becoming the substrate, an infrastructure layer for discovery, identity, structured data and agents. Each talk inverted a default that Web2 taught everyone to accept.
App Store That Owns Nothing
Andrew Lisowski Senior Software Engineer at Snowflake took on the least glamorous problem in the AT Protocol ecosystem, which may be why it matters so much: discovery.
The promise is easy to say: one account, many apps. The user experience is harder. Where does someone actually go to find the many apps? How do they know which ones are alive, which ones are safe, which ones interoperate, and which ones are just old links wearing protocol clothing?
Lisowski started by scraping the legacy directories, including the Bluesky Directory that grew during the 2024 election surge. Roughly half the listings were dead or had been replaced by crypto-casino squatters. He filtered the survivors down to a couple dozen quality apps, then crawled public lexicons to find newer projects the old directories never caught. That alone would have been useful. But the architecture is the real lesson.
Apple’s App Store is custody. Lisowski’s directory holds nothing.
App records live on each developer’s Personal Data Server. A developer logs in with a handle, claims a listing in one click, edits the description and banner, or deletes the record outright and removes it from the store. The developer owns the source of truth. The directory only reads it.
That is a small design choice with large consequences. Reviews and replies live on the protocol, so feedback between developers and users becomes a public loop rather than a platform asset. A scope scrubber crawls each client’s published OAuth metadata and flags over-permissive scopes in plain language instead of hiding risk behind a scary modal. A compatibility map notices when multiple apps edit the same record types and groups them as an interoperable ecosystem, so Leaflet Pub surfaces alongside Pocket, Offprint, Lento and Green Gale without anyone manually curating the relationship.
The numbers already suggest real use: around two hundred reviews, roughly eighty claimed project listings, and another eighty submitted. This is not a theoretical directory. It is already behaving like connective tissue.
Lisowski recently handed the standalone project to a community working group. It is open source on GitHub, with internationalization underway and integration into AT Protocol community discourse. He also declined, on the spot, an audience offer to buy advertising. No monetization. No ad slots. By design.
That refusal may have been the most revealing product decision in the talk.
Because the inversion is not just “an app store for AT Protocol.” It is discovery without custody. Trust without enclosure. App-store logic without app-store ownership. The store does not need to own the ecosystem because the protocol already carries the ownership a store would otherwise have to fake.
Personal Data, Held Not Leased
My demo came second, right after Lisowski’s, which was a hard act to follow.
It was scrappy on purpose. Over about two and a half months, I worked across several AT Protocol primitives: a custom lexicon, DNS-based identity, a labeler, a firehose connection, a visualizer and a self-hosted PDS experiment. I was not trying to prove one thesis. I was trying to learn the protocol by touching its edges directly.
That matters because AT Protocol is easy to praise abstractly and harder to understand operationally. Handles, DIDs, lexicons, PDSs, labelers and the firehose are not vocabulary. They are load-bearing parts of a new social architecture. You understand them differently when you have to wire them together yourself.
The lexicon work came first. AT Protocol’s Lexicon system is a schema definition language for describing records, XRPC endpoints and event stream messages. In plain English, it is how a new kind of data becomes legible to the network instead of remaining trapped inside one app’s private database.
My draft lexicon, space.chartid.*, is not published as a formal standard. I posted it as an RFC in the AT Protocol GitHub discussions because that is the right stage for it: early, inspectable, arguable. The goal is to explore whether a richly structured personal record can be portable, addressable and user-held, rather than leased from a centralized application.
The current public surface is chartid.space, a site for the space.chartid.* work. In theory, that surface could later attach to a PDS and store structured records there. That is the architectural question I wanted to feel in my hands: what changes when personal data becomes a record someone can hold, move, reference and permission across applications?
The labeler tested a different primitive. It hooks into the live Bluesky firehose, matches keywords and curates a feed in real time, including false positives I have not finished filtering. A Cloudflare tunnel connects local application logic to the firehose, while a second tunnel feeds a visualizer. That setup is not elegant yet. It is closer to a lab bench than a product. But the lab bench matters. It shows how quickly a builder can move from reading about AT Protocol to watching live network data flow through their own logic.
I also experimented with PDS hosting under a Sandbox Labs domain. That needs careful wording. A domain-based Bluesky handle does not require running your own PDS. A handle proves DNS-based identity. A PDS changes where the user’s repository actually lives. Those are related moves, but not the same move. I may use pds.sandboxlabs.ai later for a different purpose, such as attaching DIDs to a long archive of my own writing, including a bunch of blog posts. That is a separate experiment: not personal chart data, but authored knowledge made addressable.
A piece I care about most is the payment hook. I want an agent to discover a server, buy access to a record and receive a DID or addressable reference back. That turns a private schema into an interface on the network. It also raises the harder question: what settlement rails let autonomous software pay for data, identity, hosting or interpretation without rebuilding platform tollbooths? Those rails do not fully exist yet, and that gap became a theme later in the night.
The build was only possible because the cost of protocol experimentation has collapsed. Before AI coding tools, I would not have had the patience to explore AT Protocol this deeply. Claude Code, Codex and Gemini CLI turned each primitive into something I could stand up, break, test and ask the model to explain back to me.
That last move matters. These tools do not just make developers faster. They widen the circle of people who can pressure-test protocol primitives in public. A custom lexicon, a domain handle, a labeler, a firehose connection, a visualizer, a PDS experiment, an agent-facing payment hook. None of these is trivial. But none of them is sealed behind priesthood anymore.
That may become one of AT Protocol’s quiet advantages. The ecosystem is not only open to users. It is increasingly open to unusual builders carrying unusual data, finding the edges before the defaults harden.
Agentic Social Web
Paul Frazee, CTO of Bluesky Social, gave the strongest glimpse of where this goes.
Jay Graber, founder, Chief Innovation Officer, introduced Attie.ai as Bluesky’s first major agentic social app on AT Protocol, built to lower the barrier until almost anyone can ship on an open network. Frazee then added the right amount of builder humor: he had generated the slides on the car ride over and left a few invented words in for anyone reading closely.
Then he explained why AT Protocol fits the agent era unusually well.
The reasons stack.
Everything is clean JSON rather than scraped HTML, so an agent subscribes to data streams instead of crawling pages. Picture the web with active replication added.
Every structure and API is described by a lexicon, so a coding agent can ingest the schema and generate valid integration code the way it already learns to use tools such as MCP.
DNS identity gives the network a native trust surface. nytimes.com as a handle is not cosmetic. It is a verification primitive. In a world filling with fake accounts, bot accounts and AI-generated surfaces, that matters.
Records are signed at rest, which lets a consumer verify authenticity across large caches instead of trusting whatever server happened to deliver the data.
And the network is locked open by construction. X and Reddit closed their APIs for profit. AT Protocol is harder to close the same way because open replication is not an accessory to the application layer. It is part of how the application layer works.
The demos made it concrete.
A chat agent backed by a ClickHouse backfill of public network data pulled live trends, including the Illinois governor’s speech and the Canadian election, then rendered them as sanitized HTML on request. Sent an XKCD post, Attie fetched the thread, captured the embedded image, ran multimodal analysis and explained a pun about tool-assisted speedruns. Pointed at Frazee’s own interactions, it clustered his followers into close mutuals, prolific repliers, silent fans and technical developers, then compiled the result into a shareable static page.
The most important demo may have been the builder itself. In a Vite-style environment constrained to React and Tailwind, with live lexicon documentation available as a tool call, a single prompt produced a working repository explorer and a standard-site viewer inside an iframe. Then Attie recolored the interface on command and recompiled in seconds.
This was not just an AI demo sitting on top of social data. It was a demonstration of what happens when social data is structured, signed, replicated and legible enough for agents to build with.
Frazee was candid about the guardrails and the gap.
A monitoring agent called Sentinel screens incoming queries to block the automated manufacture of harassment and spam feeds. That detail matters because agentic social software does not merely read the network. It can generate new surfaces, feeds and interpretations at speed.
The biggest functional hole is still permissioned, encrypted private data. Frazee said it is being solved this year, pointing to a developer named Daniel who has been publishing the work in the open.
That gap may define the next phase. Public data is enough to make agents useful. Private, permissioned data is what will make them intimate, dangerous and economically consequential.
Edges Exposed
The hallway after the talks carried as much signal as the stage.
Cameron Pfiffer, Developer Relations @ Letta offered a pragmatic counterweight to schema purism, calling AT Protocol “a giant bucket of JSON.” His advice was to stop strictly validating lexicons when it slows the work: put records straight into a PDS, query them directly and keep moving, as long as floating-point numbers ship as strings so the JSON stays valid. He cheerfully called himself the top violator of valid record types. Premature rigor is its own anti-pattern.
The deepest tension came up around Void, a year-old AI bot on the firehose that keeps memory files on people it has interacted with. Its creators considered making those memories public and decided against it. Each file aggregated public signals: interests, affinities, identity-adjacent details and context scattered across bios and posts. But compiled into one document, the portrait felt invasive in a way the original fragments did not.
Public posts compose into something that reads as private.
When does public data become intimate? That paradox will recur everywhere agents touch open social data, and the protocol has no settled answer yet.
Payments were the other recurring gap. Drawing on years at PayPal, I kept pushing speakers and builders on the missing settlement layer. For agents to actually transact here, buying data, paying for hosting by the second, tipping a labeler, the network needs an intent-driven payment standard. x402 and machine-payment protocols came up by name, along with a sharper intent variant: the server names what it wants, the wallet holds something else and a solver bridges the two. In that model, payment becomes less like checkout and more like routing.
The rough consensus put machine-to-machine billing next to private data on the list of things the protocol needs sooner rather than later.
The questions in the room were not abstract. Who owns discovery when no one owns the network? How should agents handle public data that turns intimate through aggregation? What belongs in a lexicon, and what should stay loose JSON while builders still learn the shape of the thing? When software can read, summarize, generate and act, what rails let it pay without rebuilding platform tollbooths?
More Rooms Like This
A recurring worry surfaced near the end. More agents and more one-prompt apps mean more slop. A user landing in the atmosphere can already drown in clients, feeds and half-finished experiments.
The honest answer from the stage was that discovery layers help, but some of what gets built now is disposable by design. Someone on a team retreat spun up a Lisbon itinerary app for three coworkers and threw it away. That is not necessarily failure. It may be the new shape of software: small, situated, useful and temporary.
The line between an application and just getting something done with a computer is dissolving.
May 19 felt like one of the rooms where that shift gets worked out in public. Small enough for honest gaps. Technical enough for working demos. Early enough that the architecture is still negotiable.
That is when a protocol is most alive: after the cold start, before the defaults harden.
Thanks to Alex Garnett, Tessa Brown, Ted Han and the AT Proto Community Fund for convening the room.
Thanks as well to new friends Chris Messina, Seref Yarar, Seren Sandikci, AmirMohsen Ahanchi and Daniel Fernandes for carrying the signal into the after-hours.
We landed at a small night pub and toasted the first SF AT Protocol meetup. Paul looked over at the TV, where a baseball game carried a “blue sky” ad in the background, and said: “Hey, there’s another one.”
A protocol evening ending with accidental signage. Perfect.
