Meet SAM: A Zero-Config P2P Network for AI Agents
Discover Sovereign Agent Mesh, a secure zero-trust P2P network for AI Agents featuring offline token verification and a Secure Outbound Gateway.
Stock photo for illustration only, not from the actual event
- SAM is a zero-config and zero-trust peer-to-peer network designed for AI Agents
- Translates OIDC JWT claims into Datalog facts sealed inside Biscuit tokens
- Enables nodes to perform strict offline authorization without calling home
- Secures outbound traffic and credentials using a dedicated Secure Outbound Gateway
As autonomous artificial intelligence agents become increasingly prominent, securing their inter-communication and coordination is paramount. A new project named Sovereign Agent Mesh (SAM) has emerged to tackle this challenge, offering a zero-config and zero-trust peer-to-peer (P2P) network built specifically for AI agents. Although the repository carries an explicit disclaimer stating it is not an officially supported Google product and the public mesh is currently labeled as a beta testnet, its underlying engineering reflects production-grade design principles.
Joining the network is straightforward, initiated with the sam-node join command and executed via sam-node run. The underlying libp2p protocol utilizes 5001/udp and 5002/tcp, while the local MCP API defaults to port 8080. A particularly fascinating aspect of the system lies in its control plane, which verifies an OIDC JWT, translates the claims into Datalog facts, and seals them into a Biscuit token. In this mapping, the sub claim transforms into user(...), groups become group(...), and the peer ID binds directly as client_peer_id(...).
Stock photo for illustration only, not from the actual event
The direct consequence of this architecture is that nodes can authorize requests entirely offline. A node evaluates the presented token against its own local rules without needing to phone home. Enforcement follows a strict default-deny policy, meaning access requires explicit capability facts such as granted_service_exact(...). There are no built-in exceptions; even the discovery catalog system://sam.catalog must be explicitly granted. Services adhere to a strict type://name convention with full wildcard support, including patterns like mcp://* and mcp://build-runner.*
The integration of Biscuit tokens and Datalog facts for decentralized offline authorization represents a significant leap forward in distributed systems security. By decentralizing the verification process, AI agents can interact securely and autonomously even in environments with intermittent connectivity, significantly reducing single points of failure.
Every incoming request traverses a rigorous two-stage pipeline. Stage 1 gates the connection against ban and revocation caches, while Stage 2 executes exactly two Biscuit authorizer passes. The first pass evaluates the node's own identity token to emit target_fact assertions, and the second pass evaluates the caller's token. A foundational security check prevents replay attacks by strictly requiring the connection peer ID to match the token. Operators can also apply local attenuations, such as blocking write tools after 9 PM or restricting contractor accounts.
Stock photo for illustration only, not from the actual event
Stock photo for illustration only, not from the actual event
The node exposes standard Model Context Protocol (MCP) tools, including discover_remote_services, find_remote_tools, and call_remote_tool. Comprehensive guides are available for integration with Gemini, Claude Code, Claude Desktop, Google Antigravity, and OpenClaw. Additionally, the sam-node skill install command generates a SKILL.md file, enabling an agent to bring its node online independently, while initial enrollment login remains intentionally restricted to human operators. To bridge critical security gaps, the Secure Outbound Gateway utilizes nano-init running as PID 1 within the sandbox to configure proxy environment variables and intercept system calls for tools that might otherwise bypass them.
"Note: The repo carries an explicit disclaimer: this is not an officially supported Google product."
MarkTechPost
Source: MarkTechPost
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment