Testnets

Mon, 01 Jan 0001 00:00:00 +0000

The project runs two public meshes for its own testing and for anyone who wants to try the software without deploying anything.

	`bananas.sam-mesh.dev`	`hub.sam-mesh.dev`
Built from	every push to `main`	every `v*` tag
Image tag	the commit SHA	the release version
Purpose	continuous integration of unreleased code	the latest release, for interoperability testing

Both are deployed by .github/workflows/deploy.yaml to a GKE cluster from the templates in .github/k8s/. Each testnet has a control plane Deployment on PostgreSQL, a router StatefulSet that announces /dnsaddr/bootstrap.<env>.sam-mesh.dev (a DNS-sync CronJob keeps the record current), the console, and a few canary nodes that publish demo services: the MCP everything server, an OpenRouter proxy, and a vLLM instance when one is running. Identity comes from a Dex instance at auth.sam-mesh.dev that accepts Google and GitHub logins, and from the cluster’s own issuer for in-cluster workloads.

Security architecture

Mon, 01 Jan 0001 00:00:00 +0000

This document describes the security architecture and posture of Agent Mesh for developers and security reviewers. It covers how Agent Mesh acts as an authority, Policy Decision Point (PDP), and task-scoped credential layer across environments, what problems it solves, what responsibilities remain with the surrounding platform, how its cryptographic and policy mechanisms work across agentmesh-control-plane, agentmesh-node, agentmesh-router, and the native SDKs, and which extensions are deferred on purpose.

Contributing on Agent Mesh

Testnets

Security architecture

1. Current security posture: a courier network for tasks