Meet SAM (Sovereign Agent Mesh): A Zero-Config, Zero-Trust P2P Network for AI Agents

google/sam is not Segment Anything. SAM here means Sovereign Agent Mesh , an Apache-2.0 networking project for autonomous AI agents. The problem it targets is concrete. Agents now run across cloud servers, on-prem datacenters, laptops, Raspberry Pis and Android devices. Letting them share tools usually means exposing internal scripts, LLM endpoints or private APIs to the public internet. SAM’s alternative is a zero-config, zero-trust P2P overlay — closer to a private VPN, but scoped to agent-to-agent tool sharing over the Model Context Protocol. Nodes discover each other automatically, survive NAT, and authorize every call cryptographically.

Note: The repo carries an explicit disclaimer: this is not an officially supported Google product.

Partially , the engineering is production-shaped, but the public mesh is still labelled a beta testnet.

A node joins with sam-node join , then runs with sam-node run . libp2p uses 5001/udp and 5002/tcp ; the local MCP API defaults to 8080 .

This is the interesting part. The control plane verifies an OIDC JWT. It then translates the claims into Datalog facts and seals them into a Biscuit token. sub becomes user(...) , each group becomes group(...) , and the peer ID binds in as client_peer_id(...) .

The consequence: nodes authorize offline . A node evaluates the presented token against its own local rules without calling home.

Enforcement is strict default-deny. Access needs an explicit capability fact such as granted_service_exact(...) . There are no built-in exceptions — even the discovery catalog system://sam.catalog must be granted. Services use a strict type://name convention with wildcard support ( mcp://* , mcp://build-runner.* ).

Every request runs a two-stage pipeline. Stage 1 gates the connection against ban and revocation caches. Stage 2 runs exactly two Biscuit authorizer passes. The first covers the node’s own identity token to emit target_fact assertions. The second covers the caller’s token. A baseline check blocks replay by requiring the connection peer ID to match the token.

Operators can attenuate locally, denying a write tool after 9 PM or blocking contractors. Local allows still cannot bypass control-plane check if constraints.

The node exposes standard MCP tools: discover_remote_services , find_remote_tools , and call_remote_tool . Guides cover Gemini , Claude Code , Claude Desktop, Google Antigravity and OpenClaw. sam-node skill install writes a SKILL.md so an agent can bring the node online itself. The enrollment login stays with a human by design.