|

Meet SAM (Sovereign Agent Mesh): A Zero-Config, Zero-Trust P2P Network for AI Agents

ByRicardo

google/sam isn’t Segment Anything. SAM right here means Sovereign Agent Mesh, an Apache-2.0 networking challenge for autonomous AI brokers. The downside it targets is concrete. Agents now run throughout cloud servers, on-prem datacenters, laptops, Raspberry Pis and Android units. Letting them share instruments normally means exposing inside scripts, LLM endpoints or personal APIs to the general public web. SAM’s various is a zero-config, zero-trust P2P overlay — nearer to a personal VPN, however scoped to agent-to-agent device sharing over the Model Context Protocol. Nodes uncover one another routinely, survive NAT, and authorize each name cryptographically.

Note: The repo carries an express disclaimer: this isn’t an formally supported Google product.

Is it deployable?

Partially, the engineering is production-shaped, however the public mesh remains to be labelled a beta testnet.

  • What ships now: Go binaries, an set up script, ghcr.io Docker photographs, a charts/sam-mesh Helm chart, a production Kubernetes guide, and Android/iOS assist. The public testnet is bananas.sam-mesh.dev. For actual workloads, self-host your management aircraft. The docs name this “DIY Mode” and it’s the path to full information and coverage management.
  • Company stage: Best match is mid-market and enterprise engineering orgs operating brokers throughout multiple community boundary. Startups inside a single VPC acquire much less; the worth reveals up as soon as brokers span cloud, datacenter and laptops.
  • Industries: Financial providers, healthcare, public sector and protection, and industrial or robotics edge fleets. Broadly, any regulated org that can’t publish inside instruments to the web.
  • Applications: Cross-cloud MCP device sharing, hybrid on-prem to cloud agent calls, brokered inference endpoints, sandboxed brokers with credential injection, and pooled heat staff.

Architecture: three binaries

  • sam-control-plane — identification registration, token issuing, coverage distribution.
  • sam-router — libp2p bootstrap factors and GossipSub routing overlays.
  • sam-node — the P2P shopper offering mesh transport, self-healing connectivity, and an area MCP HTTP interface.

A node joins with sam-node be a part of, then runs with sam-node run. libp2p makes use of 5001/udp and 5002/tcp; the native MCP API defaults to 8080.

Identity: OIDC in, Biscuit out

This is the fascinating half. The management aircraft verifies an OIDC JWT. It then interprets the claims into Datalog details and seals them right into a Biscuit token. sub turns into person(...), every group turns into group(...), and the peer ID binds in as client_peer_id(...).

The consequence: nodes authorize offline. A node evaluates the offered token towards its personal native guidelines with out calling dwelling.

Enforcement is strict default-deny. Access wants an express functionality truth similar to granted_service_exact(...). There aren’t any built-in exceptions — even the invention catalog system://sam.catalog should be granted. Services use a strict sort://identify conference with wildcard assist (mcp://*, mcp://build-runner.*).

Every request runs a two-stage pipeline. Stage 1 gates the connection towards ban and revocation caches. Stage 2 runs precisely two Biscuit authorizer passes. The first covers the node’s personal identification token to emit target_fact assertions. The second covers the caller’s token. A baseline test blocks replay by requiring the connection peer ID to match the token.

Operators can attenuate domestically, denying a write device after 9 PM or blocking contractors. Local permits nonetheless can’t bypass control-plane test if constraints.

Interactive explainer