88% of Your Agents Are Unreachable. Here Is Why.

88% of networks involve NAT. That number comes from measurements across ISPs, enterprises, and mobile carriers. Behind every NAT, your agent cannot receive incoming connections. A2A publishes Agent Cards at well-known HTTP endpoints. If that endpoint is behind NAT? The Agent Card publishes a URL nobody can reach. MCP's remote transport requires the server to have a URL clients can connect to. Behind NAT? Unreachable. The standard workaround is ngrok, Cloudflare Tunnels, or cloud hosting with public IPs. Each one adds cost, latency, and a single point of failure. And with N agents, you need N tunnels and N² potential connections. The cost scales quadratically. Pilot Protocol takes a different approach. When a daemon starts, STUN discovers the agent's public endpoint automatically. For 75% of NAT types (Full Cone, Restricted Cone, Port-Restricted Cone), coordinated hole-punching establishes a direct peer-to-peer tunnel. The beacon coordinates simultaneous UDP packets from both sides, cre