GitHub - google/agentmesh: Agent Mesh

| [.devcontainer](https://github.com/google/agentmesh/tree/main/.devcontainer ".devcontainer") | [.devcontainer](https://github.com/google/agentmesh/tree/main/.devcontainer ".devcontainer") | [build(deps): bump devcontainers/go in /.devcontainer](https://github.com/google/agentmesh/commit/a047f9e424425d4ddf2e1384615614d4f3e6c7c6 "build(deps): bump devcontainers/go in /.devcontainer Bumps devcontainers/go from `adc3262` to `dcd81a1`. --- updated-dependencies: - dependency-name: devcontainers/go dependency-version: 1.27-bookworm dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 10, 2026 |

| [.gemini](https://github.com/google/agentmesh/tree/main/.gemini ".gemini") | [.gemini](https://github.com/google/agentmesh/tree/main/.gemini ".gemini") | [agents: a flaky test is a bug report](https://github.com/google/agentmesh/commit/d48b1dc643e261cbd99994df577bfb1e45ce584d "agents: a flaky test is a bug report AGENTS.md describes how a flake is handled: it is a race the production code has too, so it is not retried, given a wider timeout or a sleep. It is reproduced with the test binary built with the race detector and run in parallel under stress, starved of CPU when the CI runner is smaller than the workstation; the failure is read from the binaries' own output, and when that output does not explain it, the missing log line, counter or gauge is added to the production code first. The fix then makes the test wait on the exported condition, and the stress loop runs until it is clean for hundreds of runs. The integration suite reserves ports from one base per process and is run with one process. The review guide asks for that reproduction and the resulting code change when a PR adds a retry, a timeout or a sleep to a test that failed in CI.") | Oct 11, 2026 |

| [.github](https://github.com/google/agentmesh/tree/main/.github ".github") | [.github](https://github.com/google/agentmesh/tree/main/.github ".github") | [build(deps): bump github/codeql-action/upload-sarif](https://github.com/google/agentmesh/commit/2fcb2b5ce4da7918ff9cadd9bcbd8c10e8b4ce96 "build(deps): bump github/codeql-action/upload-sarif Bumps github/codeql-action/upload-sarif from 4.38.3 to 4.39.0. - Release notes - Changelog - Commits --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [.vscode](https://github.com/google/agentmesh/tree/main/.vscode ".vscode") | [.vscode](https://github.com/google/agentmesh/tree/main/.vscode ".vscode") | [fix(e2e,mobile,bench,docs): fix Bats Helm release name, mobile E2E sc…](https://github.com/google/agentmesh/commit/9d4bd0b432415d57f2c763192e7a5b76ee268dbc "fix(e2e,mobile,bench,docs): fix Bats Helm release name, mobile E2E script paths, bench test race, and docs URLs") | Oct 9, 2026 |

| [agents/skills/agentmesh](https://github.com/google/agentmesh/tree/main/agents/skills/agentmesh "This path skips through empty directories") | [agents/skills/agentmesh](https://github.com/google/agentmesh/tree/main/agents/skills/agentmesh "This path skips through empty directories") | [node: drop the gossip and dht_size claims from agent-facing text](https://github.com/google/agentmesh/commit/312ca68640de73132485ca504d87cb1ce52fc214 "node: drop the gossip and dht_size claims from agent-facing text The find_remote_tools schema told agents that tool_name lookups are served from gossip announcements. The handler fetches every provider's catalog and filters by name. The shipped agent skill told agents that get_mesh_info returns dht_size, which the response no longer has; it returns attached_routers. The node API reference repeated the gossip claim.") | Oct 19, 2026 |

| [api](https://github.com/google/agentmesh/tree/main/api "api") | [api](https://github.com/google/agentmesh/tree/main/api "api") | [api, docs: actor_node is half of the request binding](https://github.com/google/agentmesh/commit/615aa3827d91ef2df5dc711fc8bde25b90f4e622 "api, docs: actor_node is half of the request binding The FactActorNode comment and the actor_node bullet in §4.3 listed the fact's uses as audit logs and ext_proc attributes, which could read as safe to drop. Together with client_peer_id, actor_node is how identity.RequireAuthorityRequestBinding binds a token without node() to the presenting peer, and /sts/token runs that check. Both now say so. No Datalog rule reads it, so it still grants nothing.") | Oct 20, 2026 |

| [charts](https://github.com/google/agentmesh/tree/main/charts "charts") | [charts](https://github.com/google/agentmesh/tree/main/charts "charts") | [charts: seed the mesh policy only when the control plane has none](https://github.com/google/agentmesh/commit/4d5cf4ee7f2ba813ea080ada49eabf5aa4baa52e "charts: seed the mesh policy only when the control plane has none The bootstrap Job runs on every helm upgrade and POSTed the whole policy each time, so an upgrade erased every edit made in the console or with POST /policies. The Kubernetes guide said the database is the source of truth once it has a policy. The Job now reads /admin/policy and seeds only when it holds no roles, as agentmesh-one does with --policy-file. A policy it cannot read fails the Job instead of being overwritten. The seed also drops the mesh:role:agentmesh-box role and binding, whose binary f6abfb82 removed.") | Oct 20, 2026 |

| [cmd](https://github.com/google/agentmesh/tree/main/cmd "cmd") | [cmd](https://github.com/google/agentmesh/tree/main/cmd "cmd") | [build(deps): bump the python-deps group across 3 directories with 6 u…](https://github.com/google/agentmesh/commit/00ad25d9642461813edb017672aa192f913da2ab "build(deps): bump the python-deps group across 3 directories with 6 updates Updates the requirements on openai, langchain, langchain-openai, a2a-sdk, starlette and google-genai to permit the latest version. Updates `openai` to 3.35.1 - Release notes - Changelog - Commits Updates `langchain` to 1.4.6 - Release notes - Commits Updates `langchain-openai` to 1.7.2 - Release notes - Commits Updates `a2a-sdk` to 1.2.3 - Release notes - Changelog - Commits Updates `starlette` to 1.9.0 - Release notes - Changelog - Commits Updates `google-genai` to 2.31.0 - Release notes - Changelog - Commits Updates `a2a-sdk` to 1.2.3 - Release notes - Changelog - Commits Updates `starlette` to 1.9.0 - Release notes - Changelog - Commits --- updated-dependencies: - dependency-name: openai dependency-version: 3.35.1 dependency-type: direct:production dependency-group: python-deps - dependency-name: langchain dependency-version: 1.4.6 dependency-type: direct:production dependency-group: python-deps - dependency-name: langchain-openai dependency-version: 1.7.2 dependency-type: direct:production dependency-group: python-deps - dependency-name: a2a-sdk dependency-version: 1.2.3 dependency-type: direct:production dependency-group: python-deps - dependency-name: starlette dependency-version: 1.9.0 dependency-type: direct:production dependency-group: python-deps - dependency-name: google-genai dependency-version: 2.31.0 dependency-type: direct:production dependency-group: python-deps - dependency-name: a2a-sdk dependency-version: 1.2.3 dependency-type: direct:production dependency-group: python-deps - dependency-name: starlette dependency-version: 1.9.0 dependency-type: direct:production dependency-group: python-deps ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [deploy/skypilot](https://github.com/google/agentmesh/tree/main/deploy/skypilot "This path skips through empty directories") | [deploy/skypilot](https://github.com/google/agentmesh/tree/main/deploy/skypilot "This path skips through empty directories") | [docs,mobile,deploy: clean up remaining SAM references and restore ren…](https://github.com/google/agentmesh/commit/abd436c4cff78d910b123974927e592055f79ab7 "docs,mobile,deploy: clean up remaining SAM references and restore rename note") | Oct 10, 2026 |

| [development](https://github.com/google/agentmesh/tree/main/development "development") | [development](https://github.com/google/agentmesh/tree/main/development "development") | [build(deps): bump the npm_and_yarn group across 3 directories with 1 …](https://github.com/google/agentmesh/commit/6d454d39443e0747716ca43c4f0576610acfa57c "build(deps): bump the npm_and_yarn group across 3 directories with 1 update Bumps the npm_and_yarn group with 1 update in the /development/examples/code-reviewer-pool/manager directory: qs. Bumps the npm_and_yarn group with 1 update in the /development/examples/code-reviewer-pool/reviewer directory: qs. Bumps the npm_and_yarn group with 1 update in the /development/examples/gemini-buddy-mcp directory: qs. Updates `qs` from 6.16.0 to 6.16.1 - Changelog - Commits Updates `qs` from 6.16.0 to 6.16.1 - Changelog - Commits Updates `qs` from 6.16.0 to 6.16.1 - Changelog - Commits --- updated-dependencies: - dependency-name: qs dependency-version: 6.16.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [hack](https://github.com/google/agentmesh/tree/main/hack "hack") | [hack](https://github.com/google/agentmesh/tree/main/hack "hack") | [policy: allowed_publish grants what a member may publish, deny by def…](https://github.com/google/agentmesh/commit/99076bc4f51037507f489fa92415837eebd07cfc "policy: allowed_publish grants what a member may publish, deny by default A role said what a member may call (allowed_services) and where it may send (allowed_targets), but nothing said what a member may serve. Any enrolled node could publish mcp://github or inference://gpt-4 and callers that asked the directory would be routed to it: a member of the mesh could stand in for any service, which the record check in the previous commit does not prevent, it only ties a key to the name the record itself claims. PolicyRole gains allowed_publish, the same patterns as allowed_services (\"*\", \"mcp://*\", \"mcp://github\", \"mcp://team-*\"), empty by default: a member publishes nothing until a role it holds grants the service. The control plane validates and stores the list, and mints it into the authority block as granted_publish_* facts (api.BuildPublishDatalogFacts) beside the granted_* facts of allowed_services, with the same budget. A member of a served egress destination gets egress://<name> granted at mint from the destination's served_by (api.WithEgressPublish), so the egress policy is the single place an operator names who serves it. Two verifiers enforce the grant, from the same Datalog allow policies (api.PublishPolicies, exported to the SDK artifact as publish_policies): * The router that holds a member keeps its credential from the auth handshake and refuses a DirectoryProvide whose service the credential does not grant (requirePublish; the peer record is always allowed); the refusal is a \"Record denied\" warning and the \"denied\" result of agentmesh_router_directory_lookups_total. * The caller checks the provider it is about to use: node (VerifyProvider at the egress proxy, A2A, egress tunnel, OpenAI facade and MCP connect, 403 \"provider is not granted <svc>\"), JS and Python (requirePublish / require_publish on the provider's verified biscuit before the MCP session or egress stream carries a request). The catalog service system://mesh.catalog needs no grant. The default policies grant \"*\" to the node role where every node is the operator's (standalone, the testnets, the integration fixtures); the chart takes bootstrap.nodePublish, empty by default, and the container e2e mesh grants exactly the services its nodes run.") | Oct 14, 2026 |

| [internal](https://github.com/google/agentmesh/tree/main/internal "internal") | [internal](https://github.com/google/agentmesh/tree/main/internal "internal") | [node, storage: preserve policy denial across trusted keys and seriali…](https://github.com/google/agentmesh/commit/613d55f76ec935dd1a2f905c9bd8c28380226548 "node, storage: preserve policy denial across trusted keys and serialize initial key creation") | Oct 20, 2026 |

| [mobile](https://github.com/google/agentmesh/tree/main/mobile "mobile") | [mobile](https://github.com/google/agentmesh/tree/main/mobile "mobile") | [build(deps): bump gradle-wrapper in /mobile/agentmesh-node-app/android](https://github.com/google/agentmesh/commit/3669094734d68c7601d3ccd1e36363d9cef57272 "build(deps): bump gradle-wrapper in /mobile/agentmesh-node-app/android Bumps gradle-wrapper from 9.8.1 to 9.8.2. - Release notes - Commits --- updated-dependencies: - dependency-name: gradle-wrapper dependency-version: 9.8.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [scripts](https://github.com/google/agentmesh/tree/main/scripts "scripts") | [scripts](https://github.com/google/agentmesh/tree/main/scripts "scripts") | [site,docs: serve website from google.github.io/agentmesh](https://github.com/google/agentmesh/commit/11ff26e7af41e3931a0b16218fe55122778580e2 "site,docs: serve website from google.github.io/agentmesh") | Oct 10, 2026 |

| [sdk](https://github.com/google/agentmesh/tree/main/sdk "sdk") | [sdk](https://github.com/google/agentmesh/tree/main/sdk "sdk") | [build(deps): bump @libp2p/gossipsub from 17.1.2 to 17.2.1 in /sdk/js](https://github.com/google/agentmesh/commit/6fc979a3d05d6efd0a7df3ae4639a13e655f7f2d "build(deps): bump @libp2p/gossipsub from 17.1.2 to 17.2.1 in /sdk/js Bumps @libp2p/gossipsub from 17.1.2 to 17.2.1. - Release notes - Commits --- updated-dependencies: - dependency-name: \"@libp2p/gossipsub\" dependency-version: 17.2.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [site](https://github.com/google/agentmesh/tree/main/site "site") | [site](https://github.com/google/agentmesh/tree/main/site "site") | [examples: kgateway with mesh authorization, with a script that checks…](https://github.com/google/agentmesh/commit/284feb29e0d8b192bf178b9097184ecc28ec5b70 "examples: kgateway with mesh authorization, with a script that checks each case") | Oct 25, 2026 |

| [tests](https://github.com/google/agentmesh/tree/main/tests "tests") | [tests](https://github.com/google/agentmesh/tree/main/tests "tests") | [build(deps): bump the python-deps group across 3 directories with 6 u…](https://github.com/google/agentmesh/commit/00ad25d9642461813edb017672aa192f913da2ab "build(deps): bump the python-deps group across 3 directories with 6 updates Updates the requirements on openai, langchain, langchain-openai, a2a-sdk, starlette and google-genai to permit the latest version. Updates `openai` to 3.35.1 - Release notes - Changelog - Commits Updates `langchain` to 1.4.6 - Release notes - Commits Updates `langchain-openai` to 1.7.2 - Release notes - Commits Updates `a2a-sdk` to 1.2.3 - Release notes - Changelog - Commits Updates `starlette` to 1.9.0 - Release notes - Changelog - Commits Updates `google-genai` to 2.31.0 - Release notes - Changelog - Commits Updates `a2a-sdk` to 1.2.3 - Release notes - Changelog - Commits Updates `starlette` to 1.9.0 - Release notes - Changelog - Commits --- updated-dependencies: - dependency-name: openai dependency-version: 3.35.1 dependency-type: direct:production dependency-group: python-deps - dependency-name: langchain dependency-version: 1.4.6 dependency-type: direct:production dependency-group: python-deps - dependency-name: langchain-openai dependency-version: 1.7.2 dependency-type: direct:production dependency-group: python-deps - dependency-name: a2a-sdk dependency-version: 1.2.3 dependency-type: direct:production dependency-group: python-deps - dependency-name: starlette dependency-version: 1.9.0 dependency-type: direct:production dependency-group: python-deps - dependency-name: google-genai dependency-version: 2.31.0 dependency-type: direct:production dependency-group: python-deps - dependency-name: a2a-sdk dependency-version: 1.2.3 dependency-type: direct:production dependency-group: python-deps - dependency-name: starlette dependency-version: 1.9.0 dependency-type: direct:production dependency-group: python-deps ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [.dockerignore](https://github.com/google/agentmesh/blob/main/.dockerignore ".dockerignore") | [.dockerignore](https://github.com/google/agentmesh/blob/main/.dockerignore ".dockerignore") | [fix(e2e,mobile,bench,docs): fix Bats Helm release name, mobile E2E sc…](https://github.com/google/agentmesh/commit/9d4bd0b432415d57f2c763192e7a5b76ee268dbc "fix(e2e,mobile,bench,docs): fix Bats Helm release name, mobile E2E script paths, bench test race, and docs URLs") | Oct 9, 2026 |

| [.gitignore](https://github.com/google/agentmesh/blob/main/.gitignore ".gitignore") | [.gitignore](https://github.com/google/agentmesh/blob/main/.gitignore ".gitignore") | [refactor(cmd,internal): rename CLI binaries, env vars, and default pa…](https://github.com/google/agentmesh/commit/8078bf7fd08cfe7055aee867293fadd78903a9f3 "refactor(cmd,internal): rename CLI binaries, env vars, and default paths to agentmesh") | Oct 9, 2026 |

| [.golangci.yml](https://github.com/google/agentmesh/blob/main/.golangci.yml ".golangci.yml") | [.golangci.yml](https://github.com/google/agentmesh/blob/main/.golangci.yml ".golangci.yml") | [bump go biscuits](https://github.com/google/agentmesh/commit/9fc9aaa93a5631bb3a1f9f027abd84a7c37a0c02 "bump go biscuits") | Oct 14, 2026 |

| [.goreleaser.yaml](https://github.com/google/agentmesh/blob/main/.goreleaser.yaml ".goreleaser.yaml") | [.goreleaser.yaml](https://github.com/google/agentmesh/blob/main/.goreleaser.yaml ".goreleaser.yaml") | [release: publish checksums.txt and sync the site install.sh](https://github.com/google/agentmesh/commit/c6ee17f159085d08a980c406a93cb7919a5dc1ee "release: publish checksums.txt and sync the site install.sh Fixes #672") | Oct 12, 2026 |

| [AGENTS.md](https://github.com/google/agentmesh/blob/main/AGENTS.md "AGENTS.md") | [AGENTS.md](https://github.com/google/agentmesh/blob/main/AGENTS.md "AGENTS.md") | [AGENTS.md: nothing interacts with the mesh unauthenticated](https://github.com/google/agentmesh/commit/13afdcbbf601ef8c8db7ce4b9c283b4daf1b3851 "AGENTS.md: nothing interacts with the mesh unauthenticated") | Oct 13, 2026 |

| [CODEOWNERS](https://github.com/google/agentmesh/blob/main/CODEOWNERS "CODEOWNERS") | [CODEOWNERS](https://github.com/google/agentmesh/blob/main/CODEOWNERS "CODEOWNERS") | [Add CODEOWNERS file with default owner](https://github.com/google/agentmesh/commit/71b822d240ea11d4a7a798674dcd514b4251ed5a "Add CODEOWNERS file with default owner") | Oct 6, 2026 |

| [CODE_OF_CONDUCT.md](https://github.com/google/agentmesh/blob/main/CODE_OF_CONDUCT.md "CODE_OF_CONDUCT.md") | [CODE_OF_CONDUCT.md](https://github.com/google/agentmesh/blob/main/CODE_OF_CONDUCT.md "CODE_OF_CONDUCT.md") | [init](https://github.com/google/agentmesh/commit/8757b33f09a0cd5c9eb4a7c6110e3d31790d243e "init") | Apr 24, 2026 |

| [CONTRIBUTING.md](https://github.com/google/agentmesh/blob/main/CONTRIBUTING.md "CONTRIBUTING.md") | [CONTRIBUTING.md](https://github.com/google/agentmesh/blob/main/CONTRIBUTING.md "CONTRIBUTING.md") | [init](https://github.com/google/agentmesh/commit/8757b33f09a0cd5c9eb4a7c6110e3d31790d243e "init") | Apr 24, 2026 |

| [Dockerfile.agentmesh-console](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-console "Dockerfile.agentmesh-console") | [Dockerfile.agentmesh-console](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-console "Dockerfile.agentmesh-console") | [build(deps): bump the docker-digests group across 3 directories with …](https://github.com/google/agentmesh/commit/8152b264b831909e56848beb0a008bb680b59c51 "build(deps): bump the docker-digests group across 3 directories with 5 updates Bumps the docker-digests group with 2 updates in the / directory: golang and distroless/static. Bumps the docker-digests group with 2 updates in the /development/examples/kgateway directory: curlimages/curl and keycloak/keycloak. Bumps the docker-digests group with 1 update in the /development/examples/openshell-kubernetes directory: nvidia/base/ubuntu. Updates `golang` from 1.27.1 to 1.27.2 Updates `distroless/static` from `5167571` to `18f4cc2` Updates `curlimages/curl` from 8.11.1 to 8.22.0 Updates `keycloak/keycloak` from 26.4.0 to 26.8.1-1 - Commits Updates `nvidia/base/ubuntu` from 24.04 to 26.04 --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-digests - dependency-name: distroless/static dependency-version: nonroot dependency-type: direct:production dependency-group: docker-digests - dependency-name: curlimages/curl dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-digests - dependency-name: keycloak/keycloak dependency-version: 26.8.1-1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-digests - dependency-name: nvidia/base/ubuntu dependency-version: '26.04' dependency-type: direct:production dependency-group: docker-digests ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [Dockerfile.agentmesh-control-plane](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-control-plane "Dockerfile.agentmesh-control-plane") | [Dockerfile.agentmesh-control-plane](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-control-plane "Dockerfile.agentmesh-control-plane") | [build(deps): bump the docker-digests group across 3 directories with …](https://github.com/google/agentmesh/commit/8152b264b831909e56848beb0a008bb680b59c51 "build(deps): bump the docker-digests group across 3 directories with 5 updates Bumps the docker-digests group with 2 updates in the / directory: golang and distroless/static. Bumps the docker-digests group with 2 updates in the /development/examples/kgateway directory: curlimages/curl and keycloak/keycloak. Bumps the docker-digests group with 1 update in the /development/examples/openshell-kubernetes directory: nvidia/base/ubuntu. Updates `golang` from 1.27.1 to 1.27.2 Updates `distroless/static` from `5167571` to `18f4cc2` Updates `curlimages/curl` from 8.11.1 to 8.22.0 Updates `keycloak/keycloak` from 26.4.0 to 26.8.1-1 - Commits Updates `nvidia/base/ubuntu` from 24.04 to 26.04 --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-digests - dependency-name: distroless/static dependency-version: nonroot dependency-type: direct:production dependency-group: docker-digests - dependency-name: curlimages/curl dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-digests - dependency-name: keycloak/keycloak dependency-version: 26.8.1-1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-digests - dependency-name: nvidia/base/ubuntu dependency-version: '26.04' dependency-type: direct:production dependency-group: docker-digests ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [Dockerfile.agentmesh-node](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-node "Dockerfile.agentmesh-node") | [Dockerfile.agentmesh-node](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-node "Dockerfile.agentmesh-node") | [build(deps): bump the docker-digests group across 3 directories with …](https://github.com/google/agentmesh/commit/8152b264b831909e56848beb0a008bb680b59c51 "build(deps): bump the docker-digests group across 3 directories with 5 updates Bumps the docker-digests group with 2 updates in the / directory: golang and distroless/static. Bumps the docker-digests group with 2 updates in the /development/examples/kgateway directory: curlimages/curl and keycloak/keycloak. Bumps the docker-digests group with 1 update in the /development/examples/openshell-kubernetes directory: nvidia/base/ubuntu. Updates `golang` from 1.27.1 to 1.27.2 Updates `distroless/static` from `5167571` to `18f4cc2` Updates `curlimages/curl` from 8.11.1 to 8.22.0 Updates `keycloak/keycloak` from 26.4.0 to 26.8.1-1 - Commits Updates `nvidia/base/ubuntu` from 24.04 to 26.04 --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-digests - dependency-name: distroless/static dependency-version: nonroot dependency-type: direct:production dependency-group: docker-digests - dependency-name: curlimages/curl dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-digests - dependency-name: keycloak/keycloak dependency-version: 26.8.1-1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-digests - dependency-name: nvidia/base/ubuntu dependency-version: '26.04' dependency-type: direct:production dependency-group: docker-digests ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [Dockerfile.agentmesh-one](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-one "Dockerfile.agentmesh-one") | [Dockerfile.agentmesh-one](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-one "Dockerfile.agentmesh-one") | [build(deps): bump the docker-digests group across 3 directories with …](https://github.com/google/agentmesh/commit/8152b264b831909e56848beb0a008bb680b59c51 "build(deps): bump the docker-digests group across 3 directories with 5 updates Bumps the docker-digests group with 2 updates in the / directory: golang and distroless/static. Bumps the docker-digests group with 2 updates in the /development/examples/kgateway directory: curlimages/curl and keycloak/keycloak. Bumps the docker-digests group with 1 update in the /development/examples/openshell-kubernetes directory: nvidia/base/ubuntu. Updates `golang` from 1.27.1 to 1.27.2 Updates `distroless/static` from `5167571` to `18f4cc2` Updates `curlimages/curl` from 8.11.1 to 8.22.0 Updates `keycloak/keycloak` from 26.4.0 to 26.8.1-1 - Commits Updates `nvidia/base/ubuntu` from 24.04 to 26.04 --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-digests - dependency-name: distroless/static dependency-version: nonroot dependency-type: direct:production dependency-group: docker-digests - dependency-name: curlimages/curl dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-digests - dependency-name: keycloak/keycloak dependency-version: 26.8.1-1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-digests - dependency-name: nvidia/base/ubuntu dependency-version: '26.04' dependency-type: direct:production dependency-group: docker-digests ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [Dockerfile.agentmesh-router](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-router "Dockerfile.agentmesh-router") | [Dockerfile.agentmesh-router](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-router "Dockerfile.agentmesh-router") | [build(deps): bump the docker-digests group across 3 directories with …](https://github.com/google/agentmesh/commit/8152b264b831909e56848beb0a008bb680b59c51 "build(deps): bump the docker-digests group across 3 directories with 5 updates Bumps the docker-digests group with 2 updates in the / directory: golang and distroless/static. Bumps the docker-digests group with 2 updates in the /development/examples/kgateway directory: curlimages/curl and keycloak/keycloak. Bumps the docker-digests group with 1 update in the /development/examples/openshell-kubernetes directory: nvidia/base/ubuntu. Updates `golang` from 1.27.1 to 1.27.2 Updates `distroless/static` from `5167571` to `18f4cc2` Updates `curlimages/curl` from 8.11.1 to 8.22.0 Updates `keycloak/keycloak` from 26.4.0 to 26.8.1-1 - Commits Updates `nvidia/base/ubuntu` from 24.04 to 26.04 --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-digests - dependency-name: distroless/static dependency-version: nonroot dependency-type: direct:production dependency-group: docker-digests - dependency-name: curlimages/curl dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-digests - dependency-name: keycloak/keycloak dependency-version: 26.8.1-1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-digests - dependency-name: nvidia/base/ubuntu dependency-version: '26.04' dependency-type: direct:production dependency-group: docker-digests ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [Dockerfile.agentmesh-sdk-js](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-sdk-js "Dockerfile.agentmesh-sdk-js") | [Dockerfile.agentmesh-sdk-js](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-sdk-js "Dockerfile.agentmesh-sdk-js") | [build(deps): bump the docker-digests group across 1 directory with 3 …](https://github.com/google/agentmesh/commit/eff140c2941ede28108cb01cf9e61b1b38d8c130 "build(deps): bump the docker-digests group across 1 directory with 3 updates Bumps the docker-digests group with 3 updates in the / directory: golang, node and python. Updates `golang` from `3680233` to `162be52` Updates `node` from `43ac6c6` to `c3de60b` Updates `python` from `392307d` to `34386ef` --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-digests - dependency-name: node dependency-version: 22-bookworm-slim dependency-type: direct:production dependency-group: docker-digests - dependency-name: python dependency-version: 3.12-slim-bookworm dependency-type: direct:production dependency-group: docker-digests ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 14, 2026 |

| [Dockerfile.agentmesh-sdk-python](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-sdk-python "Dockerfile.agentmesh-sdk-python") | [Dockerfile.agentmesh-sdk-python](https://github.com/google/agentmesh/blob/main/Dockerfile.agentmesh-sdk-python "Dockerfile.agentmesh-sdk-python") | [build(deps): bump the docker-digests group across 1 directory with 3 …](https://github.com/google/agentmesh/commit/eff140c2941ede28108cb01cf9e61b1b38d8c130 "build(deps): bump the docker-digests group across 1 directory with 3 updates Bumps the docker-digests group with 3 updates in the / directory: golang, node and python. Updates `golang` from `3680233` to `162be52` Updates `node` from `43ac6c6` to `c3de60b` Updates `python` from `392307d` to `34386ef` --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-digests - dependency-name: node dependency-version: 22-bookworm-slim dependency-type: direct:production dependency-group: docker-digests - dependency-name: python dependency-version: 3.12-slim-bookworm dependency-type: direct:production dependency-group: docker-digests ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 14, 2026 |

| [LICENSE](https://github.com/google/agentmesh/blob/main/LICENSE "LICENSE") | [LICENSE](https://github.com/google/agentmesh/blob/main/LICENSE "LICENSE") | [Initial commit](https://github.com/google/agentmesh/commit/6bbd3540ce198158117a4828296f3a86b1691e2b "Initial commit") | Apr 17, 2026 |

| [Makefile](https://github.com/google/agentmesh/blob/main/Makefile "Makefile") | [Makefile](https://github.com/google/agentmesh/blob/main/Makefile "Makefile") | [feat(agentmesh-cop): watch the mesh as a member through the Python SDK](https://github.com/google/agentmesh/commit/92f4d96d876fbb5ca954427eb7a55ba61ffbd0a1 "feat(agentmesh-cop): watch the mesh as a member through the Python SDK agentmesh-cop joins the mesh with the Python SDK, holds every listed router and alerts on: - control-plane sync failing and recovering - control-plane signing keys added and retired - routers listed, delisted, unreachable and reachable again - peers banned and unbanned - the mesh unreachable, told apart from the cop's own isolation - services appearing and disappearing, named as <type>://<name> for mcp, inference, a2a and egress Alerts go to stdout and, when configured, Telegram and Slack. The tests run under make sdk-python and the SDK workflow.") | Oct 13, 2026 |

| [README.md](https://github.com/google/agentmesh/blob/main/README.md "README.md") | [README.md](https://github.com/google/agentmesh/blob/main/README.md "README.md") | [docs: a bootstrap token is not single-use](https://github.com/google/agentmesh/commit/0d303c9892271ea65995f956f7beb767371ce666 "docs: a bootstrap token is not single-use The README and the docs index said a node enrolls with a one-time bootstrap token. A bootstrap token carries max_usages and usages_count (api/agentmesh.proto:694-695), and the control plane refuses it once usages_count reaches max_usages, not after its first use (internal/controlplane/server.go:2242). An admin-minted token defaults to one use (internal/controlplane/server.go:2796-2797), and the join token agentmesh-one mints allows 1<<30 uses (internal/standalone/standalone.go:68).") | Oct 20, 2026 |

| [ROADMAP.md](https://github.com/google/agentmesh/blob/main/ROADMAP.md "ROADMAP.md") | [ROADMAP.md](https://github.com/google/agentmesh/blob/main/ROADMAP.md "ROADMAP.md") | [docs: simplify ROADMAP.md into pre-v0.1.0, v0.1.0-v0.x, and v1.0.0 st…](https://github.com/google/agentmesh/commit/c7e336da5ea82a40745618ad067ce1ac4125d3a9 "docs: simplify ROADMAP.md into pre-v0.1.0, v0.1.0-v0.x, and v1.0.0 stages") | Oct 15, 2026 |

| [go.mod](https://github.com/google/agentmesh/blob/main/go.mod "go.mod") | [go.mod](https://github.com/google/agentmesh/blob/main/go.mod "go.mod") | [build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6](https://github.com/google/agentmesh/commit/d4ce5ae082d5705d9b5b0b769cb3267e620993be "build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 Bumps github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6. - Release notes - Commits --- updated-dependencies: - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [go.sum](https://github.com/google/agentmesh/blob/main/go.sum "go.sum") | [go.sum](https://github.com/google/agentmesh/blob/main/go.sum "go.sum") | [build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6](https://github.com/google/agentmesh/commit/d4ce5ae082d5705d9b5b0b769cb3267e620993be "build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 Bumps github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6. - Release notes - Commits --- updated-dependencies: - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>") | Oct 27, 2026 |

| [install.sh](https://github.com/google/agentmesh/blob/main/install.sh "install.sh") | [install.sh](https://github.com/google/agentmesh/blob/main/install.sh "install.sh") | [fix(install): remove legacy sam references and deduplicate install.sh](https://github.com/google/agentmesh/commit/821b17090aa8bc11d1358d3d135d1d31c0b2d810 "fix(install): remove legacy sam references and deduplicate install.sh") | Oct 15, 2026 | | View all files |

Repository files navigation

- README

More items

Agent Mesh

[](https://github.com/google/agentmesh#agent-mesh)

![Image 15: Agent Mesh](https://github.com/google/agentmesh/blob/main/site/content/docs/agentmesh_logo.png)

**Agent Mesh** is a private network for AI agents. A node runs next to an agent and gives it three things: a way to publish tools and models to the network, a way to find and call what other nodes publish, and an identity every other node can verify. Nodes connect directly when they can and through relays when they cannot, so the network works across laptops, containers, clusters and phones behind NAT.

> **Note:** We have updated the name to **Agent Mesh** to better align with the goals of the project in the ecosystem.

Two properties hold everywhere:

- **Nothing is reachable by default.** A node exposes no services until its configuration says so, and no node may call a service the mesh policy has not granted. Grants are evaluated on service names, never on addresses.

- **Identity comes from your identity provider.** A node enrolls with an OpenID Connect token or a bootstrap token, and the control plane turns that into a short-lived, offline-verifiable credential bound to the node's own key.

Try it

[](https://github.com/google/agentmesh#try-it)

undefinedshell curl -sL https://google.github.io/agentmesh/install.sh | bash # agentmesh-node, mcp-client and friends agentmesh-node join https://bananas.sam-mesh.dev # one-time login agentmesh-node run --daemonize # local MCP server on 127.0.0.1:8080 agentmesh-node skill install # teach your agent to use it undefined

Your agent now has tools that discover and call services across the mesh, and an OpenAI-compatible endpoint that routes model requests to whoever serves the model. `bananas.sam-mesh.dev` is a shared developer testnet with no uptime promise; the quick start walks through it, and your own mesh runs a control plane on your laptop in one command.

To run a control plane of your own without installing anything, open a GitHub codespace with the released binaries and run `make testnet`. It starts on a public `https` URL that your laptop and phone can enroll into, on your GitHub account's free quota:

![Image 16: Develop in GitHub Codespaces](https://codespaces.new/google/agentmesh?quickstart=1&devcontainer_path=.devcontainer%2Ftestnet%2Fdevcontainer.json)

The Codespaces guide has the steps, what persists and what stops.

What is in a mesh

[](https://github.com/google/agentmesh#what-is-in-a-mesh)

| Program | Role | | --- | --- | | `agentmesh-control-plane` | Verifies who is joining, issues each node a signed credential, and holds the policy that says who may call what. | | `agentmesh-router` | A well-known peer that nodes connect to first. Relays traffic between nodes that cannot reach each other and hosts

GitHub - google/agentmesh: Agent Mesh

Navigation Menu

Repository navigation

About

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Latest commit

History

Folders and files

Repository files navigation

Agent Mesh

Try it

What is in a mesh