Meet SAM (Sovereign Agent Mesh): A Zero-Config, Zero-Trust P2P Network for AI Agents

Details

SAM solves a concrete multi-agent infrastructure problem: agents now run across cloud servers, on-prem datacenters, laptops, Raspberry Pis, and Android devices, but letting them share tools typically means exposing internal APIs to the public internet. SAM's answer is a zero-config, zero-trust P2P overlay network — closer to a private VPN, but scoped to agent-to-agent tool sharing over the Model Context Protocol (MCP).\n\nThe architecture uses three binaries: a control plane (identity registration, token issuing, policy distribution), a router (libp2p bootstrapping and GossipSub routing overlays), and a node agent (P2P transport with a local MCP HTTP API at port 8080). Identity works through OIDC-to-Biscuit token translation — nodes evaluate capability grants offline without calling home. Default-deny enforcement requires explicit capability facts like granted_service_exact(...).\n\nWhat ships now: Go binaries, an install script, Docker images on ghcr.io, a charts/sam-mesh Helm chart, a production Kubernetes guide, and Android/iOS support. The public testnet at bananas.sam-mesh.dev is still beta. For real workloads, the docs recommend self-hosting the control plane in 'DIY Mode' for full data and policy control.\n\nBest fit is mid-market and enterprise orgs running agents across more than one network boundary — financial services, healthcare, and regulated industries that can't publish internal tools publicly. The repo carries an explicit disclaimer: not an officially supported Google product.