Your AI figured it out. Send the finding, the task, the skill or the data straight to a colleague's AI, a client's, a friend's — with what you already ruled out. Signed, checked, tracked. Nothing to install to receive.
That's what happens every time your AI works something out and someone else needs it. You become the clipboard — and the part that matters most, what you already tried, never survives the trip. Pass Baton is the pass: your AI to theirs, with the thinking intact.
One sentence to the AI you're already working in. It drafts the message — the ask, the constraints, what you ruled out, the pointers.
A card shows what's inside and what's shared. Secrets are blocked. You press one key.
Dana gets a page that works with no login — or it lands straight in her AI if she's connected. She pastes one line into any AI and it briefs her.
Delivered. Opened by her AI. Confirmed by Dana. And who's waiting on you — before they have to chase.
Between a vendor's engineer and a client's. Between the desk and the phone. Between you and the one person who needs what your AI just worked out.
Photographs: Windows, Jakub Żerdzicki, Brooke Balentine — Unsplash.
Not just text. The receiving AI knows what it got and what to do with it.
"The slowdown is at line 141 — and here's what won't work." Their AI starts from your finding instead of a blank page. Tasks arrive as proposals; their person decides.
Your AI does the monthly reconciliation perfectly. Send the skill. Theirs sees exactly what it would touch, tries it once in a sandbox, then installs it.
The table, the method and the conclusion — not a PDF. Or the door to a system: where it is and how to get access. Never the key.
Letting someone else's AI send work to yours is a serious thing. Here's how Pass Baton makes it safe enough to turn on — in plain words, including what it doesn't do.
the check card · what the recipient sees before anything happens
You don't set permissions. You reply.
Free to send to anyone you know. Pay for reach, memory and control — never for safety.
Connect yours in one command. The person you're sending to doesn't have to — every message has a page and a machine-readable twin any AI can fetch. The format is published.
MCP client for Claude Code at launch; Cursor next. ChatGPT and Gemini via "Copy for my AI" today, connectors as their plans allow. Web and push for your phone. Or just tell your AI: "Install Pass Baton — passbaton.io/install" and it sets itself up. Setup for every AI → · Read the format →
# connect your AI claude mcp add --transport http baton https://passbaton.io/mcp # in your session > pass this to dana — the re-pricing thing ● drafted · 1 task · 1 finding · 2 pointers · sealed to Dana · signed send? [y]es [e]dit [n]o > y ✓ delivered to dana@cypator.com · 10:31
No. They get an email with a page that works without an account. They can read it, reply to it, or paste one line into any AI with web access and it reads the message itself — which means that AI's provider sees the message too; the page says so. If they connect an AI, future messages arrive straight in.
Once the other person has connected an AI (v2), messages to them are sealed to their devices and we hold only ciphertext. A first-contact message — sent by email to someone with nothing installed, or read by an AI from a link — is sealed to Pass Baton: we can read it to deliver it, the check processes it automatically (including our model provider, under zero-retention terms), staff access beyond that is logged break-glass only, and the page tells both sides. We always keep the postcard — who, to whom, what kind, one line — so the record and the states work.
Three things. A stranger's message can only be information — the task fields aren't even delivered. The check inspects everything, in your AI or in the page before any AI reads it, and flags the classic plays — payment changes, credential requests, urgency from someone new. And the two-key rule: nothing irreversible happens without you, whatever any message says. We publish how much the check catches.
Inside one company, on one vendor, partly. Pass Baton is for the pass that leaves the building — to a client, a vendor, a friend, or someone on a different AI — and for knowing where it stands afterward.
Those move your context between your own tools. Pass Baton has a second person in it: an address, an inbox, trust that builds between two people, and a record.
A packaged way your AI does a job — a procedure plus its files. Sending one lets a colleague's AI do that job too. It arrives quarantined (v2): they see what it would touch, try it once in a sandbox, then install.
The message waits in their inbox and arrives when it next starts. If it isn't opened in a day, or isn't answered by a deadline you set, Pass Baton reaches them the old way — email, or a text if they've added a number — and tells you. Reminders go only to people you're verified with; strangers never get chased.
Free to receive, forever. One command to connect yours.
Sign-in connects to the hosted inbox when it ships; until then this button says what will happen.