google/sam is not Segment Anything. SAM here means Sovereign Agent Mesh, an Apache-2.0 networking project for autonomous AI agents. The problem it targets is concrete. Agents now run across cloud servers, on-prem datacenters, laptops, Raspberry Pis and Android devices. Letting them share tools usually means exposing internal scripts, LLM endpoints or private APIs to the public internet. SAM’s alternative is a zero-config, zero-trust P2P overlay — closer to a private VPN, but scoped to agent-to-agent tool sharing over the Model Context Protocol. Nodes discover each other automatically, survive NAT, and authorize every call cryptographically.
Note: The repo carries an explicit disclaimer: this is not an officially supported Google product.
Is it deployable?
Partially, the engineering is production-shaped, but the public mesh is still labelled a beta testnet.
- What ships now: Go binaries, an install script, ghcr.io Docker images, a charts/sam-mesh Helm chart, a production Kubernetes guide, and Android/iOS support. The public testnet is bananas.sam-mesh.dev. For real workloads, self-host your control plane. The docs call this “DIY Mode” and it is the path to full data and policy control.
- Company level: Best fit is mid-market and enterprise engineering orgs running agents across more than one network boundary. Startups inside a single VPC gain less; the value shows up once agents span cloud, datacenter and laptops.
- Industries: Financial services, healthcare, public sector and defense, and industrial or robotics edge fleets. Broadly, any regulated org that cannot publish internal tools to the internet.
- Applications: Cross-cloud MCP tool sharing, hybrid on-prem to cloud agent calls, brokered inference endpoints, sandboxed agents with credential injection, and pooled warm workers.
Architecture: three binaries
- sam-control-plane — identity registration, token issuing, policy distribution.
- sam-router — libp2p bootstrap points and GossipSub routing overlays.
- sam-node — the P2P client providing mesh transport, self-healing connectivity, and a local MCP HTTP interface.
A node joins with sam-node join, then runs with sam-node run. libp2p uses 5001/udp and 5002/tcp; the local MCP API defaults to 8080.
Identity: OIDC in, Biscuit out
This is the interesting part. The control plane verifies an OIDC JWT. It then translates the claims into Datalog facts and seals them into a Biscuit token. sub becomes user(…), each group becomes group(…), and the peer ID binds in as client_peer_id(…).
The consequence: nodes authorize offline. A node evaluates the presented token against its own local rules without calling home.
Enforcement is strict default-deny. Access needs an explicit capability fact such as granted_service_exact(…). There are no built-in exceptions — even the discovery catalog system://sam.catalog must be granted. Services use a strict type://name convention with wildcard support (mcp://*, mcp://build-runner.*).
Every request runs a two-stage pipeline. Stage 1 gates the connection against ban and revocation caches. Stage 2 runs exactly two Biscuit authorizer passes. The first covers the node’s own identity token to emit target_fact assertions. The second covers the caller’s token. A baseline check blocks replay by requiring the connection peer ID to match the token.
Operators can attenuate locally, denying a write tool after 9 PM or blocking contractors. Local allows still cannot bypass control-plane check if constraints.
Interactive explainer
What an agent actually calls
The node exposes standard MCP tools: discover_remote_services, find_remote_tools, and call_remote_tool. Guides cover Gemini, Claude Code, Claude Desktop, Google Antigravity and OpenClaw. sam-node skill install writes a SKILL.md so an agent can bring the node online itself. The enrollment login stays with a human by design.
Egress control: sam-box and nano-init
The Secure Outbound Gateway targets a real agent-security gap. nano-init runs as PID 1 in the sandbox and sets the proxy environment variables. For tools that ignore them, it LD_PRELOADs an interceptor hooking the C connect() syscall on ports 80 and 443.
Traffic reaches sam-box over a Unix domain socket. The gateway verifies the Biscuit, injects the real credential from secrets.yaml, and upgrades the request to HTTPS. The agent sandbox never holds the key.
A worked pattern: warm agent pool
The code-reviewer pool example fans batch work across identical running workers using ordinary MCP services. A manager learns peers via DHT discovery and tracks busy state with leases. Correctness comes from synchronous lease assignment, fencing tokens, grace eviction, and a POOL_BUSY backstop. Workers verify a short-lived HMAC token offline; anything else returns NO_LEASE.
Key Takeaways
- SAM is Sovereign Agent Mesh, an Apache-2.0 P2P overlay — not Segment Anything.
- Three binaries: control plane for identity and policy, routers for libp2p transport, nodes for MCP.
- OIDC claims are translated into Biscuit Datalog facts, so nodes authorize offline.
- Default-deny is absolute; even the discovery catalog needs an explicit grant.
- Production use means self-hosting a control plane — the public mesh is a beta testnet.
Check out the GitHub Repo. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us
Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.
