Bramble

Demo

About

Bramble is a private WireGuard network for small teams and the agents they run. Each device checks an ENSv2 registry for membership and service permissions, so a relay can help with connectivity but cannot decide who joins. A team can give a worker access to one internal API, approve a wider grant when it needs one, and revoke its network access later. The API stays off the public internet. Peers can use ENS-listed relays for rendezvous or traffic forwarding, paying per session or byte allotment through x402 on Hedera rather than buying a seat for each device.

How it's made

Bramble’s Go node runs userspace WireGuard and a local forward to private services. A TypeScript sidecar reads ENSv2 records and handles relay payments. On Sepolia, Permissioned Registries and per-device resolvers hold device keys, mesh addresses and access state. ENS Enhanced Access Control separates who can enroll devices, change keys, revoke access and manage grants. Each node checks those records itself and updates its peer table. The gateway checks a scoped grant before forwarding a request. A Ledger hardware wallet signs each device's enrollment transactions directly, and its Key Ring encrypts the secret used to compute later access grants. Relays are also discovered through ENS, and a node pays for a relay session in testnet USDC through Hedera's x402 flow, priced per byte instead of a flat rate. One hacky bit: wallet-cli's own signing tool doesn't support Sepolia, so we wrote a small Ledger signer directly against its Ethereum app instead.