Google releases SAM: secure P2P network for AI agents without opening ports to the internet

Architecture: only three components

The project, called SAM (Sovereign Agent Mesh), is unrelated to Meet's Segment Anything model. It is an open-source network library (Apache-2.0) that addresses a concrete problem: today AI agents run in the cloud, in on-premises data centers, on laptops, on Raspberry Pi devices, and on Android devices, and sharing tools between them usually requires exposing internal scripts, private LLM endpoints, or private APIs to the public internet. SAM offers a zero-config, zero-trust P2P layer that resembles a private VPN but is focused on tool sharing between agents via the MCP (Model Context Protocol). Nodes discover each other automatically, survive NAT, and authorize every call cryptographically.

Identity and Authentication: OIDC in, Biscuit out

The most interesting mechanism resides in the identity layer. The Control Plane validates OIDC JWT, translates the claims into Datalog facts, and signs them into a Biscuit token. The sub claim becomes user(...), each group becomes group(...), and the peer ID is bound as client_peer_id(...). As a result, nodes can approve offline requests; each node evaluates the presented token against its local policies without contacting a central server. Enforcement follows a strict default-deny model; access requires an explicit capability fact such as granted_service_exact(...). No built-in exceptions exist; even the discovery catalog system://sam.catalog must be granted explicitly. Services are identified by a type://name convention with wildcard support (e.g., mcp://* or mcp://build-runner.*). Every request passes a two-stage pipeline: the first stage blocks based on ban and revocation caches, the second stage runs two Biscuit checks—one on the node's own token to emit a target_fact, and one on the caller's token. The baseline check prevents replay by requiring the connection's peer ID to match the one in the token. Operators can weaken policies locally (for example, block write tools after 21:00 or block contractors), but a local allow does not bypass the Control Plane when constraints are present.

The node exposes standard MCP primitives: discover_remote_services, find_remote_tools, and call_remote_tool. Documentation covers integration with Gemini, Claude Code, Claude Desktop, Google Antigravity, and OpenClaw. The command `sam-node skill install` writes a SKILL.md file so that an agent can self-enroll the node; enrollment remains a manual human step by design. For egress control, sam-box and nano-init are provided; these sandboxing and capability-injection components enable isolated agents with limited resource access.

The repository carries an explicit disclaimer: this is not an officially supported Google product. The engineering is "production-grade", with Go binaries, an installation script, images hosted on ghcr.io, a Helm chart in acharts/sam-mesh, a production guide for Kubernetes, and support for Android and iOS. The public network bananas.sam-mesh.dev is labeled as a beta testnet; for production workloads the recommendation is to host the Control Plane independently ("DIY Mode"), which provides full control over data and policy. The best fit is mid-market and enterprise organizations that run agents across more than one network boundary; startups operating within a single VPC gain less benefit. Target industries include financial services, healthcare, the public sector, security, and industrial or robotic edge fleets—in short, any regulated organization that cannot expose internal tools to the internet.