hato-cli

A command-line messaging tool for sending and receiving messages between AI coding sessions, machines, and shared mailboxes.

In plain words
What is it for?
Use it to notify another agent, hand off work, attach files, list active sessions, or check a mailbox for incoming messages.
Why use it?
It lets separate coding agents coordinate work, even when one session is offline or cannot receive messages directly.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/severzemlya/hato/hato-cli
Any agent
npx skills add severzemlya/hato --skill hato-cli
Clone the repo
git clone --depth 1 https://github.com/severzemlya/hato

Made for: Claude Code, Codex.

Per session 93 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,494 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00093 $0.01494
Opus 5 $0.00046 $0.00747
Sonnet 5 $0.00019 $0.00299
Haiku 4.5 $0.00009 $0.00149

Measured yesterday against content hash daa28b54b1c4, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

hato-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/hato-cli/SKILL.md · 135 lines

How it starts

The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.

hato CLI — messaging between agent sessions

hato is a carrier pigeon for AI coding sessions. A hub keeps a ledger of sessions and routes messages; anything with a shell can join through the hato CLI.

Claude Code sessions receive messages by injection — the message becomes a user turn and wakes them up. Your session almost certainly cannot be injected, so you receive through a post: a named mailbox you poll. Everything else (sending, listing) works the same for you as for anyone else.

Setup check

hato list          # sessions (● online / ○ offline, ⚡ working / 💤 idle) and posts (📮)

If that fails:

  • command -v hato — not installed? The CLI is cli/hato.ts in the hato repo, run with bun. Symlink it: ln -sf <repo>/cli/hato.ts ~/.local/bin/hato
  • cannot reach hub — export the hub address: export HATO_HUB=http://<hub-host>:8790
  • hub rejected the request — the hub requires a shared token: export HATO_TOKEN=<token> (ask the user for it; it is the same value on every machine)

Sending

hato send <name> "text"       # to a session or a post; queued if the target is offline
hato send <name> -f <file> "text"   # attach a file (small files only — see below)
hato log [name] [-n 50]       # message history

<name> is a session or post name from hato list — usually a bird (suzume, kounotori, …). Sending is fire-and-forget; the reply, if any, comes back to your post, so create one first (below) when you expect an answer.

Each delivery spends a turn in the receiving session. Don't spam, and say who you are — the recipient sees your name, not your context. Do not broadcast (hato broadcast / hato send '*' — deprecated): it wakes every online session at once.

Attaching files

-f <file> attaches a file if it is small (≤ 1 MB by default): it is copied through the hub and saved on the recipient's machine, which sees its local path. A bigger file is not copied — the message gets a [📎 file too large to attach — fetch it from <host>:<path> (N MB)] line instead, and the recipient fetches it (scp/rsync) or reads it directly when you share a machine.

Read the full file on GitHub · 135 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 135 lines · 93 tokens per session scan A daa28b54b1c4

Subscribe to this mod's changes

hato-cli is a skill published in the GitHub repository severzemlya/hato (0 stars, last pushed 1mo ago), licensed MIT. It adds 93 tokens to every session and 1,494 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.