Meet SAM (Sovereign Agent Mesh): A Zero-Config, Zero-Trust P2P Network for AI Agents

Buried in a GitHub repo with an oddly reused acronym sits something genuinely useful: Sovereign Agent Mesh, or SAM, an Apache-2.0 project for wiring AI agents together across machines that don't trust each other by default. The problem is one anyone running agents at scale will recognize. Your agents end up scattered across cloud servers, on-prem boxes, laptops, even a stray Raspberry Pi or Android phone, and the easiest way to let them call each other's tools is to just expose internal scripts and LLM endpoints to the public internet. SAM's answer is a zero-config overlay network, something closer to a private VPN but purpose-built for agent-to-agent tool sharing over the Model Context Protocol, where nodes find each other automatically, punch through NAT, and cryptographically verify every single call.

The identity model is the part worth slowing down for. The control plane takes an OIDC JWT and translates its claims into Datalog facts, then seals them into something called a Biscuit token — a subject becomes a user fact, group memberships become group facts, and the peer's own ID gets bound into the token too. The payoff is that nodes can authorize requests entirely offline, checking a presented token against local rules without phoning home to a central server. Enforcement is default-deny with no exceptions carved out anywhere, meaning even the system's own discovery catalog requires an explicit granted-service fact before a node can see it. Every call runs through two Biscuit authorizer passes, plus a baseline check that blocks replay attacks by matching the connection's peer ID against the token itself.

There's also a credential-handling piece that quietly solves a real headache. Agents running in sandboxes often need outbound access to APIs, but you don't want the sandbox itself holding live API keys. SAM's answer, nano-init and sam-box, runs as the sandbox's PID 1, sets proxy variables, and for stubborn tools that ignore proxy settings, hooks the underlying connect() syscall directly. Traffic gets routed to a gateway that checks the Biscuit token, injects the real credential, and upgrades to HTTPS — the agent process never actually sees the key it's using.

What ships today is more complete than a typical research drop: Go binaries, a Helm chart, Docker images, a Kubernetes production guide, mobile support, and a public testnet at bananas.sam-mesh.dev. But the project itself is upfront that the public mesh is a beta testnet, and anyone wanting real production guarantees is pointed toward what the docs call DIY Mode — standing up your own control plane rather than relying on the shared one. That's a sensible caveat, but it also means the headline claim of a ready-made zero-trust mesh comes with an asterisk: you're the one operating the thing that actually matters.

The use case that makes the most sense here isn't a startup running everything in one cloud account — SAM's value only shows up once agents are scattered across a cloud, a datacenter, and someone's laptop. Financial services, healthcare, public sector, and industrial edge fleets are the obvious targets, precisely because those are the orgs that can't just publish an internal tool to the open internet and call it a day. A worked example in the repo, a pool of code-reviewer agents coordinating work through leases and fencing tokens, gives a decent sense of what the mesh looks like once it's actually doing something rather than just authenticating.