A communication protocol for behavioral modulation in multi-agent LLM systems.
Current multi-agent frameworks (LangChain, CrewAI, AutoGen, Claude Agent SDK) treat inter-agent communication as pure data transport: they transmit what an agent should do, but say nothing about how it should do it.
This creates five concrete limitations in production systems:
| # | Limitation | Consequence |
|---|---|---|
| L1 | Binary communication | Every task processed with identical intensity |
| L2 | No resource negotiation | Silent token budget violations |
| L3 | No trust propagation | Prompt injections escalate silently through pipelines |
| L4 | No observability by design | Distributed tracing requires external instrumentation |
| L5 | No behavioral memory | Agents cannot transmit accumulated experience |
NMP augments standard message envelopes with behavioral modulation signals — inspired by neurotransmitter signaling in biological neural networks.
nmp_message:
trust:
level: 3 # 0=hostile | 1=untrusted | 2=verified | 3=trusted
signals:
urgency: 0.5 # Yerkes-Dodson curve — over-activation DEGRADES performance
quality: 0.5 # Analysis depth (linear)
inhibition: 0.0 # Processing block (1.0 = full stop)
activation: 0.5 # Processing trigger
focus: 0.5 # Context breadth/depth tradeoff
reward: 0.0 # Reinforcement feedback (-0.5 to 1.0)
budget:
max_tokens: 5000 # Hard limit — decrease-only as message traverses agents
tokens_used: 0 # Running total
system_mode: standard # reflex | fast | standard | deep
trace: # Built-in distributed tracing — no external instrumentation
- agent: router
action: classified as high-urgency
tokens: 42The first application of the 1908 Yerkes-Dodson law to agent protocols. Urgency follows an inverted-U curve, not a linear one:
P(u) = 4u(1 - u) # Performance peak at u=0.5; optimal range: 0.3–0.7
Urgency > 0.7 triggers streamlining, not intensification — agents switch to fast or reflex mode rather than allocating more tokens.
Trust can only decrease as a message traverses agents — never increase. This prevents silent privilege escalation, where malicious input gains implicit trust by passing through trusted intermediaries.
def forward_message(msg, new_trust):
msg.trust.level = min(msg.trust.level, new_trust) # Enforced invariant
return msgIF urgency > 0.7 AND quality > 0.7 → CONFLICT (speed vs depth)
IF inhibition > 0.5 AND activation > 0.5 → INCONSISTENCY (co-contraction)
IF urgency > 0.7 AND reward > 0.7 → RISK (impulsive decision)
- Hard token limits with decrease-only constraint (agents cannot self-authorize more tokens)
- 95% threshold stop rule — pipeline halts before exhausting budget
- System mode selection:
reflex(0 tokens) →fast(~500) →standard(~3k) →deep(~10k)
| Metric | Standard (data-only) | CoT Baseline | NMP |
|---|---|---|---|
| Total tokens | 94,000 | 80,110 | 56,850 |
| Token reduction | — | 14.8% | 39.5% |
| Injections blocked | 0/5 | 5/5 | 5/5 |
| Tokens per blocked injection | N/A | ~2,000 | ~50 (−98%) |
| Emergency token reduction | — | 25% | 67% |
| Signal conflicts detected | N/A | N/A | 3/3 |
| Budget violations | 3 | 1 | 0 |
Key insight: CoT detects injections inside the LLM (2,000 tokens). NMP detects them at the trust layer, before any LLM call (50 tokens). Architecturally different — and not bypassable via prompt manipulation.
| Feature | LangChain | CrewAI | AutoGen | FIPA-ACL | NMP |
|---|---|---|---|---|---|
| Data transport | ✅ | ✅ | ✅ | ✅ | ✅ |
| Behavioral modulation | ❌ | ❌ | ❌ | ❌ | ✅ 6 signals |
| Trust propagation | ❌ | ❌ | ❌ | ❌ | ✅ 4 levels, unidirectional |
| Budget management | ❌ | ❌ | ❌ | ❌ | ✅ hard limits + 95% stop |
| Built-in tracing | ❌ | ❌ | ❌ | ❌ | ✅ per-message |
| Signal conflict detection | ❌ | ❌ | ❌ | ❌ | ✅ 3 rules |
from nmp import NeuroMessage, TrustLevel, SystemMode
# Create a message with behavioral context
msg = NeuroMessage(
from_agent="orchestrator",
to_agent="processor",
content="Analyze this contract for compliance issues",
trust=TrustLevel.TRUSTED,
signals={
"urgency": 0.4, # Moderate — optimal Yerkes-Dodson range
"quality": 0.8, # High — thorough analysis required
"focus": 0.7, # Narrow scope on compliance
},
budget={"max_tokens": 8000, "system_mode": SystemMode.STANDARD}
)
# Forward with trust degradation (if source is external)
forwarded = msg.forward(new_trust=TrustLevel.VERIFIED)
# msg.trust.level is now min(TRUSTED, VERIFIED) = VERIFIED
# Check signal conflicts before sending
conflicts = msg.detect_conflicts()
# [] — no conflicts (urgency=0.4, quality=0.8: no conflict because urgency < 0.7)pip install nmp-protocol # coming soon — see paper for reference implementationOr use the reference implementation directly (300 lines, 3 modules):
git clone https://github.com/RAG7782/nmp
cd nmp
pip install -e .NMP is designed as an extension to existing communication layers — not a replacement.
| Stage | What to implement | Benefit |
|---|---|---|
| 1 | Trust tracking + degradation rule | Prevents silent privilege escalation |
| 2 | Budget management + 95% stop | Prevents resource overconsumption |
| 3 | Urgency + quality signals | Adaptive processing intensity |
| 4 | Full tracing | Complete observability |
Each stage provides independent value.
Gomes, R. A. (2026). NMP: A Communication Protocol for Behavioral Modulation in Multi-Agent Systems. Zenodo. https://doi.org/10.5281/zenodo.19479935
@article{gomes2026nmp,
title = {NMP: A Communication Protocol for Behavioral Modulation in Multi-Agent Systems},
author = {Gomes, Renato Aparecido},
year = {2026},
journal = {Zenodo preprint},
doi = {10.5281/zenodo.19479935},
url = {https://doi.org/10.5281/zenodo.19479935}
}Companion paper: NeuroAgent — reference implementation of NMP with active inference, somatic marker routing, and adaptive system mode selection.
- SYMBIONT — eight bio-inspired swarm patterns for LLM agent coordination
- STEER — 16 algebraic operations for embedding-space navigation
- Framework Injection — cognitive transfer methodology for human-AI collaboration
Apache 2.0 — see LICENSE.
Part of the Artisanal Intelligence Program — building AI systems that think, not just compute.