If you saw “google/sam” trending and assumed it was another segmentation model, you’d be wrong. SAM here stands for Sovereign Agent Mesh, an Apache-2.0 project tackling a problem that’s been quietly festering as AI agents multiply: how do you let agents on different machines share tools without exposing your internal APIs to the open internet?
The answer is a zero-config, zero-trust P2P overlay built on libp2p and the Model Context Protocol. Nodes discover each other automatically, punch through NAT, and authorize every call cryptographically. Think of it as a private VPN scoped specifically to agent-to-agent tool sharing. The repo carries the standard disclaimer that this isn’t an officially supported Google product, but the engineering has production ambitions: Go binaries, Docker images, a Helm chart, Kubernetes guides, and even Android and iOS support. There’s a public testnet at bananas.sam-mesh.dev, though the docs steer serious users toward self-hosting the control plane in what they call DIY Mode.
The architecture splits across three binaries. sam-control-plane handles identity registration and policy distribution. sam-router provides libp2p bootstrap points and GossipSub routing. sam-node is the actual P2P client that exposes a local MCP HTTP interface on port 8080. The identity flow is where things get interesting: the control plane verifies an OIDC JWT, translates the claims into Datalog facts, and seals them into a Biscuit token. That means nodes can authorize offline by evaluating the token against local rules without phoning home. Enforcement is strict default-deny, with no built-in exceptions — even the discovery catalog has to be explicitly granted.
The most practical piece might be sam-box, a Secure Outbound Gateway that addresses a real gap in agent security. It runs a sandbox where agents never actually hold API keys. The nano-init component sets proxy variables and, for tools that ignore them, LD_PRELOADs an interceptor that hooks the C connect() syscall. Credentials get injected at the gateway from a secrets.yaml file, and requests are upgraded to HTTPS. It’s the kind of egress control that regulated industries — financial services, healthcare, defense — have been asking for as they watch agents proliferate across cloud, datacenter, and edge devices. Whether SAM gains traction beyond Google’s walls is an open question, but the design choices suggest someone has been thinking hard about what happens when autonomous agents stop being demos and start touching production infrastructure.
