tryAGI.WebRTC

WebRTC transport for .NET 10, authored from standards and licensed under MIT.

Build encrypted audio, video and data transports with explicit network admission, bounded resource use and a runtime that depends only on the .NET shared framework. The library owns ICE, DTLS/SRTP and SCTP channel lifetimes; your application owns signaling, media encoding/decoding and playback.

Experimental 0.x. APIs and supported negotiation profiles are evolving. Independent Pion and Chromium checks pass for the documented scope; real DId/Advantage/Simli sessions and physical Apple Watch playback are still acceptance work. This is not yet a drop-in replacement for those adapters or a security-audited general WebRTC stack. See completion gates.

Install

dotnet add package tryAGI.WebRTC --prerelease

Requires .NET 10 or later. Main builds publish 0.x development packages after all validation jobs succeed; v0.x.y tags create releases. See publication and immutable-source verification.

Start a peer

using System.Net;
using tryAGI.WebRTC;

await using var peer = new PeerConnection(new PeerConnectionOptions
{
    LocalEndPoint = new IPEndPoint(IPAddress.Loopback, 0), // Local testing.
});

string offer = peer.CreateOffer();
// Send offer through your application's authenticated signaling.
// Obtain the remote answer, then:
// peer.SetRemoteAnswer(answer);
// await peer.ConnectAsync(cancellationToken);

For a remote connection, choose a reachable local interface and an application candidate/destination policy. Signal ICE credentials and DTLS fingerprints over an authenticated channel. No public STUN/TURN server or provider endpoint is contacted by default. An answerer uses CreateAnswer(remoteOffer).

Peer lifecycle and API covers gathering/trickle, channels, encoded media, readiness, cancellation and disposal. MediaReady allows authenticated media to start before data-channel setup finishes; callers still observe Completion.

Observe packet delays

Inspect retained establishment evidence for ICE/DTLS/SCTP/DCEP timeout attribution, including after disposal.

Attach diagnostics to a live peer for correlated managed receive/decrypt/queue/send stages, bounded packet capture and .NET metrics. Collection runs in a consumer-owned publication loop, separate from audio processing. Kernel arrival and physical playback remain explicit unknowns. See diagnostics and collection example.

Supported scope

Area	Implemented and tested	Current limits
ICE / STUN	UDP checks, nomination, consent, trickle, same-socket mappings, bounded URI/DNS gathering	Explicit local interface; no mDNS/SRV, remote candidate DNS or ICE restart
TURN	Owned relay allocations over UDP, TCP or TLS; authentication, renewal, permissions, relay-only policy	Bounded documented profiles; not proof of every NAT topology
DTLS / SRTP	Fingerprint-authenticated DTLS 1.2, directional SRTP/SRTCP, replay and key-use bounds	Explicit cipher/handshake subset; trusted signaling required
Audio	Negotiated Opus RTP transport, source/clock metadata, bounded receive queues	Encoded packets; application owns codec, pacing, jitter policy and playback
Video	Explicit H264/VP8 capabilities, bounded frame reassembly, RTCP reports and negotiated PLI	Application owns codec/packetization; no general codec or SDP renegotiation
Data channels	SCTP/DCEP, ordered/unordered reliable or partial delivery, fragmentation, reset/closure	Documented negotiation/resource limits apply
Compatibility	Independent local Pion and Chromium; actual decoded Opus/video and protected loss recovery	Consumer/provider/device E2E remains
NativeAOT	Whole-library rooting, publish and executed smoke lane	Linux x64 CI evidence; other native targets need their own acceptance

See the scope documents for ICE, server URIs, TURN, DTLS, SRTP, SDP, data channels, video and RTCP.

Validate locally

dotnet build WebRTC.slnx -c Release
dotnet run --project src/tests/WebRTC.ProtocolTests -c Release --no-build
dotnet run --project src/tests/WebRTC.IntegrationTests -c Release --no-build
python3 -m unittest discover -s scripts -p 'test_*.py'

Console runners exit nonzero on failure and need no test-framework package. Tests use local peers and synthetic inputs without provider keys.

Independent Pion peer — local ICE/DTLS/SRTP/SCTP/DCEP and relay checks:

docker build -f tests/interop/Pion/Dockerfile -t tryagi-webrtc-interop .
docker run --rm tryagi-webrtc-interop

Chromium — offer/answer and both DTLS roles, data-channel policies/reset, two-way decoded Opus, RTP pacing, protected packet loss/recovery and H264/VP8 rendering:

./tests/interop/Chromium/run.sh

See browser evidence and tooling. Docker is required; these checks run in an isolated network with disposable browser profiles.

NativeAOT, on a Linux x64 host with the .NET native toolchain:

dotnet publish src/tests/WebRTC.AotSmoke -c Release -r linux-x64 -p:PublishAot=true -o artifacts/aot
./artifacts/aot/WebRTC.AotSmoke

A build alone is not execution evidence. Targeted runner filters are useful for local diagnosis; passing a subset does not replace the full validation suite.

Security and provenance

Runtime source is newly authored against the standards in architecture. No SIPSorcery or Pion implementation has been imported into the runtime. Build and independent test tooling have separate licenses and dependency graphs; see source provenance and build tooling. MIT licensing does not establish security.

Read SECURITY.md for trust boundaries and private vulnerability reporting. Strong naming provides assembly identity, not publisher authentication.

Contribute

See CONTRIBUTING.md, code of conduct and changelog. Focused fixes, resource-bound regressions and independent interoperability reports are welcome.

• Report a bug or propose a feature
• Ask a question or discuss a design
• Browse releases

License

MIT — tryAGI and contributors. Separately licensed test/build tooling retains its original notices.