Your parcel, carried by mules who have no idea where it's going.
MuleNet sends a box through a chain of friends' hubs. Each hub peels one layer, re-boxes it and passes it on, knowing only who handed it over and who's next. Nobody along the way, not the hubs, not the post, can connect the sender to the recipient.
Not endorsed by or affiliated with Logos. MuleNet is an independent experiment by people who like mules. It is built on the Logos tech stack; that is the whole relationship.
- The software exists and passes its tests: the onion labels, the hub directory, the receipts. It ran end to end on the Logos test network and in Basecamp.
- No real box has gone through a real hub. The first trial will be a 3D-printed mule passed between a few friends.
- Nobody independent has reviewed any of this. Some hard problems are still open. Don't send anything you'd miss, and don't send anything you shouldn't.
We're publishing early so the rough edges get found before people start trying it for real.
Onion routing, but with hooves.
Mixnets hide who's talking to whom by passing messages through relays that each strip one layer of encryption. MuleNet does the same thing with cardboard.
The QR label is a fixed-size onion. Each hub scans it and learns only where to send the box next, then prints a fresh label for the next leg. Every label is the same size, so no hub can tell how far the box has come.
The item sits inside one sealed sleeve per hop. Each hub takes off exactly one and checks its seal code. The hubs on either side of an honest hub never even see the same wrapping.
Hubs throw the old box away, use a plain standard one and pad it to a standard weight. They hold the box a few random days and ship on fixed batch days, so arrival and departure don't line up.
Each hub posts "received" and "shipped" receipts over Logos Messaging. They're sealed so only the sender, and the hubs either side, can read them. The sender sees progress; nobody else sees a route.
Who knows what, one hop at a time.
Press Next hop. Click anyone in the lane to see what they know. (Spoiler: the mules know very little, which is the point.)
The sender
The label on the box right now
Every leg gets a new label: same size, no shared bytes, nothing a person can read.
The hubs are the mules. They do the carrying, so they get the protections. (A donkey dad is called a jack. A jackass is anyone who hands a mule something it can't see into and hopes for the best. We're working on that one.)
No mule's home address, ever
A hub's address is never published. It's sealed hub-to-hub, so only the hubs it chooses to receive from can read it. Senders never get one; they hand parcels over at a public intake, like a community meetup or a parcel locker.
Mules don't open the luggage
Nobody looks inside, the same way the post office doesn't. A hub weighs and measures the box, checks one seal code, and takes off one outer sleeve. That's all.
Mules say no whenever they like
Every hub publishes what it's willing to carry: anything, or declared categories only. A hub can refuse any parcel, and the refusal goes back to the sender.
Every handover leaves an alibi
When the next hub confirms "received, seal intact", that receipt is the previous hub's proof that it passed the parcel on untouched. It's sealed, never public.
Only vetted mules on the route
Routes only use hubs vouched for by a steward the sender trusts, such as someone from their own community, or the sender themselves. Mules are stubborn about privacy. We consider that a feature.
Things the mules are still chewing on.
These are written up in the repo, and they're the reason nothing real should travel yet.
What's in the box?
The big one. A hub can't check a sealed parcel without opening it, and opening it breaks the whole idea. We haven't found a way to keep the sender private and keep the hub safe from what it can't see. For now: no inspection, declared categories, refuse freely, and only send between people who trust each other. Ideas welcome.
A herd of three is easy to follow
A mixnet hides you in a crowd. With a handful of parcels, colluding hubs can link sender and recipient by timing alone. More parcels, shared batch days and decoy boxes should help; none of that is built.
Carrier accounts want your phone number
Lockers and couriers often need a phone number or email, which can identify a hub to the carrier. That needs per-country research.
No way back
A refused parcel has no return path yet, and borders need customs forms with a name on them. Domestic routes, or within the EU, for now.
We're looking for a small, patient herd.
The plan is to get the boring parts ready now, so it works when the first people try it.
Got a parcel locker nearby, a few plain boxes and a kitchen scale? Read the hub guide and tell us your city. We're starting with a handful of people in the EU.
Groups that already meet in person (a hackerspace, a local meetup) make natural hand-over points, and their organisers natural people to vouch for hubs. MuleNet is independent: no community is involved unless its members choose to be.
Read the spec and the threat model, and break things. An Android hub app (scan, peel, print) is next.
Built on the Logos tech stack (not endorsed by or affiliated with Logos):