google/agentmesh

What it solves

Agent Mesh creates a secure, private network that allows AI agents to discover and use tools and models hosted across different environments—such as laptops, containers, clusters, and phones—even when they are behind NAT.

How it works

It uses a node-based architecture where an agentmesh-node runs alongside an agent or service. This node handles enrollment via OpenID Connect or bootstrap tokens, manages identity through verifiable credentials, and connects to a control plane and routers. The network ensures that nothing is reachable by default; access is governed by a mesh policy based on service names rather than IP addresses. For the agent, the mesh is exposed as a local MCP server and an OpenAI-compatible API.

Who it’s for

Developers building AI agents that need to share capabilities, tools, or models across a distributed network of devices and services securely.

Highlights

• Secure by Default: No services are exposed and no calls are permitted unless explicitly granted by the mesh policy.
• Identity-Based Access: Uses identity providers for enrollment and issues short-lived, offline-verifiable credentials.
• Flexible Connectivity: Supports direct connections or relays to work across diverse network environments.
• Standardized Interfaces: Provides an OpenAI-compatible endpoint for model routing and an MCP server for tool discovery.