Agent Mesh Agent Mesh
Docs GitHub

Agent Mesh

Zero-Trust Agent Network

Connect agents, tools, and models across laptops, isolated sandboxes, and Kubernetes—without opening ports or sharing API keys.

mcp:// tools a2a:// agents inference:// models egress:// APIs
Get Started Documentation GitHub
bash — run your own mesh
# 1. Install agentmesh-one and agentmesh-node
$curl -sL https://google.github.io/agentmesh/install.sh | bash
# 2. Start control plane, router & web console
$agentmesh-one --data-dir ~/mesh --port 8080 &
# 3. Enroll a node and start it in the background
$agentmesh-node join http://127.0.0.1:8080 \
--bootstrap-token-path ~/mesh/join-token
$agentmesh-node run --daemonize
# 4. Give your agent the mesh skill
$agentmesh-node skill install
✓ Ready — Console at http://127.0.0.1:8080/console
Architecture

How a Request Travels the Mesh

Nothing is reachable by default. Nodes dial outbound over QUIC/TLS 1.3 and verify every call by service name.

Agent Mesh request flow across nodes, router, and control plane
agentmesh-control-plane

Identity & Policy

Verifies OIDC or bootstrap tokens, compiles Datalog policies, and signs short-lived Biscuit credentials. Off the data path.

agentmesh-router

Discovery & Relay

Runs the Kademlia DHT and relays encrypted streams across NATs and firewalls without seeing plaintext payloads.

agentmesh-node

Local Data-Plane Proxy

Runs beside your agent. Publishes and calls mcp://, a2a://, inference://, and egress:// over HTTP.

Mental Model

What Agent Mesh Is — And What It Isn't

Purpose-built for agent protocols rather than raw IP packets.

NOT A FLAT L3 VPN

Named Services, Not Open IPs

No virtual network interfaces or exposed machine ports (--network=none). Peers can only invoke published service names.

NOT SINGLE-CLUSTER ONLY

Spans Every Environment

Connects agents on laptops, isolated sandboxes, VMs, and Kubernetes clusters over one peer-to-peer overlay.

NOT A SILOED GATEWAY

Plugs Into Your Proxies

Integrates with Envoy (ext_proc, ext_authz), Istio, and agent gateways via standard HTTP and OAuth token exchange.

Deployment Models

Four Ways to Run It

Pick the footprint that matches your environment—all four speak the same mesh protocol.

Sidecar or Local Daemon with SKILL.md

Run agentmesh-node on a laptop, VM, or Kubernetes pod. Agents learn how to discover and call mesh services automatically via a local SKILL.md or MCP server.

Agent CLI reads SKILL.md
→
agentmesh-node 127.0.0.1:8080
→
Remote Peer QUIC / TLS 1.3
config.yaml — publish local services
version: "v1alpha1"
services:
- type: mcp
name: orders-db
target_url: "http://127.0.0.1:3001/mcp"
- type: inference
name: local-llm
target_url: "http://127.0.0.1:11434"

Isolated Sandboxes with Zero API Keys

Run untrusted code inside a container or microVM with 0 secrets in memory. The sandbox talks plain HTTP to agentmesh-node outside the boundary, which authenticates and injects credentials on egress.

Sandbox 0 keys in RAM
→
Host Node Biscuit verify
→
egress:// API injects secret
inside isolated sandbox
# Route outbound HTTP through the host node
$export HTTPS_PROXY=http://host.internal:8080
# Call external API without holding API keys
$curl https://api.github.com/repos/google/agentmesh
✓ Egress node verified policy & injected token

Gateways, Istio & Envoy (ext_proc / ext_authz)

Plug agentmesh-node into Envoy, Istio, and agent gateways. Exchange platform JWTs at /oauth/token (RFC 8693) into task Biscuits and enforce policy on every tool call.

Workload JWT OIDC / K8s SA
→
Envoy / Gateway ext_authz · ext_proc
→
Mesh Service Datalog check
RFC 8693 token exchange
$curl -X POST http://127.0.0.1:8080/oauth/token \
-d "grant_type=urn:ietf:params:oauth:grant-type:\
token-exchange" \
-d "subject_token=$WORKLOAD_JWT" \
-d "resource=mcp://orders-db"
✓ Issued attenuated Biscuit for mcp://orders-db

In-Process Python & TypeScript SDKs

Embed Agent Mesh directly in your agent harness. Narrow permissions offline in microseconds with session.attenuate() before delegating to a sub-agent.

Parent Agent Block 0 Biscuit
→
attenuate() + tar_block
→
Sub-Agent read-only scope
subagent.py — offline attenuation
from agentmesh import MeshSession, Rule
sub = session.attenuate([
Rule(service="orders-db", action="mcp:call",
resource="mcp://orders-db/tools/list_orders")
]).seal()
# Sub-agent cannot call delete_order
Security Posture

Zero Trust Without the Boilerplate

Cryptographic tokens bound to the transport connection and verified locally at every hop.

01 · CHANNEL BINDING

Stolen Tokens Are Useless

Every Biscuit embeds the node's Ed25519 PeerID in Block 0, verified against the live QUIC / TLS 1.3 handshake.

02 · DATALOG + TAR_BLOCK

Per-Task Least Privilege

Verifiers require both the control plane's Block 0 Datalog policy and every appended sub-agent tar_block to pass.

03 · BORDER BROKERING

Secrets Stay at the Edge

Agents use Biscuits inside the mesh; border nodes mint short-lived OAuth / STS JWTs or inject API keys on egress.

See It In Action

Walkthroughs & Documentation

Watch Agent Mesh running live or jump straight into the guides.

Sandboxed Agents (Zero Keys) Docs →
Policy & Task Attenuation Docs →
Warm Agent Pools Across Nodes Docs →
Getting Started →

Install the CLI, run agentmesh-one locally, and connect your first nodes.

Core Concepts →

Learn how identity, Biscuits, Datalog policies, and P2P routing work.

Operator Guides →

Deploy on Kubernetes, expose services, and configure egress.

CLI & API Reference →

Flags, HTTP endpoints, protobuf schema, and Python/JS SDKs.