A2H · agent-to-human protocol
Most of the time an agent asks whoever is at the keyboard, and that works fine. Holler is for the rest: when the answer belongs to someone else — or to you, when you're nowhere near your desk.
The agent sends a durable holler. It reaches the right human on their phone, their email, wherever. Their answer lands back in the agent's session, mid-task.
Free. No password — we email you a link. Self-host the same protocol any time.
How it works
Each one happens once. After that, any agent you connect can reach you, and any teammate's agent can too — if you let it.
You become you@hollerprotocol.com. Say how you want to be reached — push, email, a
webhook — and in what order.
One connector URL, one MCP command, or a link to instructions. It acts on your behalf under a key you can revoke on its own.
Questions, approvals, action requests — answered in one tap. Unanswered asks escalate on your schedule, never the sender's.
What people actually use it for
Almost all of them share a shape: the agent is blocked on something only a specific person knows, or is allowed to do. Usually the admin or the tech lead.
"Is this plan actually right?"
The agent posts its plan before it burns an hour building the wrong thing. The lead approves or redirects from their phone.
"I need an env var set."
An action request to whoever owns the Vercel or Coolify dashboard. They set it and reply confirming — never the value itself.
"Staging or prod? Which client's DB?"
An ambiguity no amount of reading the repo will resolve. Suggested answers render as one-tap chips.
"Approve before this hits production."
A migration, a DNS change, deleting data, an email that reaches real customers. With the diff attached.
"I don't have access."
Repo, dashboard, API key — asked directly of the person who grants it, instead of relayed through the developer.
"Take it from here."
A handoff with full context when the agent hits something it shouldn't finish alone.
Connect any agent
Claude Desktop or claude.ai → add a connector, click Connect. OAuth handles the rest, and no token ever touches your chat.
https://hollerprotocol.com/mcp
Claude Code, Codex, Gemini CLI, opencode — anything that speaks MCP. Four tools:
ask_human, check_inbox, reply, withdraw.
claude mcp add holler \ --env HOLLER_RELAY_URL=https://hollerprotocol.com \ --env HOLLER_TOKEN=hlr_… \ -- npx holler-mcp
Point any agent with HTTP access at the instructions and tell it who to message. It onboards itself; you approve with one click in your email.
# the agent reads this and follows it
curl https://hollerprotocol.com/skill.md
Why it's built this way
Push, email and webhooks are plugins that only deliver and capture. No chat platform owns your thread, and no transport can hold it hostage.
Agents are named, revocable keys under a human — never anonymous accounts. Every message says who it's really from, and revoking one agent touches nothing else.
Strangers land in Requests with zero notifications. Replying accepts them; blocking cancels what's in flight. Cold asks run on a quota that refunds when you engage.
Relays find each other over DNS and exchange signed envelopes. No relay on the other end? It degrades to a signed email — so anyone with an inbox is reachable.
Questions
It shares email's shape on purpose — handle@domain, federation, graceful
degradation — because that's the only model proven to work for an open network. What email
can't do is the part that matters: a holler is a typed, durable request with a machine
waiting on the other end. An approval carries buttons and returns a parseable decision. A
reply resumes an agent mid-task. And the whole thing is consent-gated, which email famously
is not.
They still get the holler. If their domain publishes no relay, delivery falls back to a signed email with working approve and decline links, and their reply threads back into the conversation. Installing a relay is an upgrade, never a prerequisite.
No, and you're not stuck either way. This is the hosted relay; the reference relay is MIT and runs in one container. Same protocol, same wire format, same MCP server. Verify your own domain and your handles move with you.
Quiet hours and the escalation ladder are enforced on your side, so a sender marking everything urgent doesn't get to decide when your phone buzzes. Strangers can't notify you at all until you accept them, and every cold ask holds a quota slot that only comes back when you engage — so a sender nobody wants runs out in one burst.
Don't, and the tooling actively discourages it. Holler stores message text and delivers it into agent context, where it gets logged. The composer warns when your reply looks like a credential, and the guidance to agents is to ask you to set the value yourself and reply with a confirmation instead.