AIHOT 于 2026-08-18 收录了“Google 开源 SAM：为 AI 智能体打造的零配置、零信任 P2P 网络”这一公开动态。以下先呈现从来源页面抓取的正文，再给出 AIHOT 摘要与 TopoReduce 编辑解读。
PUBLIC SOURCE CONTENT
已抓取公开正文公开原文内容
Meet SAM (Sovereign Agent Mesh): A Zero-Config, Zero-Trust P2P Network for AI Agents - MarkTechPost
- Editors Pick
- Agentic AI
- AI Agents
- Artificial Intelligence
- AI Infrastructure
- Applications
- Technology
- For Devs
- Language Model
- Machine Learning
- New Releases
- Open Source
- Tech News
google/sam is not Segment Anything. SAM here means Sovereign Agent Mesh, an Apache-2.0 networking project for autonomous AI agents. The problem it targets is concrete. Agents now run across cloud servers, on-prem datacenters, laptops, Raspberry Pis and Android devices. Letting them share tools usually means exposing internal scripts, LLM endpoints or private APIs to the public internet. SAM’s alternative is a zero-config, zero-trust P2P overlay — closer to a private VPN, but scoped to agent-to-agent tool sharing over the Model Context Protocol. Nodes discover each other automatically, survive NAT, and authorize every call cryptographically.
Note: The repo carries an explicit disclaimer: this is not an officially supported Google product.
Is it deployable?
Partially, the engineering is production-shaped, but the public mesh is still labelled a beta testnet.
- What ships now: Go binaries, an install script, ghcr.io Docker images, a charts/sam-mesh Helm chart, a production Kubernetes guide, and Android/iOS support. The public testnet is bananas.sam-mesh.dev. For real workloads, self-host your control plane. The docs call this “DIY Mode” and it is the path to full data and policy control.
- Company level: Best fit is mid-market and enterprise engineering orgs running agents across more than one network boundary. Startups inside a single VPC gain less; the value shows up once agents span cloud, datacenter and laptops.
- Industries: Financial services, healthcare, public sector and defense, and industrial or robotics edge fleets. Broadly, any regulated org that cannot publish internal tools to the internet.
- Applications: Cross-cloud MCP tool sharing, hybrid on-prem to cloud agent calls, brokered inference endpoints, sandboxed agents with credential injection, and pooled warm workers.
Architecture: three binaries
- sam-control-plane — identity registration, token issuing, policy distribution.
- sam-router — libp2p bootstrap points and GossipSub routing overlays.
- sam-node — the P2P client providing mesh transport, self-healing connectivity, and a local MCP HTTP interface.
A node joins with sam-node join, then runs with sam-node run. libp2p uses 5001/udp and 5002/tcp; the local MCP API defaults to 8080.
Identity: OIDC in, Biscuit out
This is the interesting part. The control plane verifies an OIDC JWT. It then translates the claims into Datalog facts and seals them into a Biscuit token. sub becomes user(...), each group becomes group(...), and the peer ID binds in as client_peer_id(...).
The consequence: nodes authorize offline. A node evaluates the presented token against its own local rules without calling home.
Enforcement is strict default-deny. Access needs an explicit capability fact such as granted_service_exact(...). There are no built-in exceptions — even the discovery catalog system://sam.catalog must be granted. Services use a strict type://name convention with wildcard support (mcp://*, mcp://build-runner.*).
Every request runs a two-stage pipeline. Stage 1 gates the connection against ban and revocation caches. Stage 2 runs exactly two Biscuit authorizer passes. The first covers the node’s own identity token to emit target_fact assertions. The second covers the caller’s token. A baseline check blocks replay by requiring the connection peer ID to match the token.
Operators can attenuate locally, denying a write tool after 9 PM or blocking contractors. Local allows still cannot bypass control-plane check if constraints.
Interactive explainer
What an agent actually calls
The node exposes standard MCP tools: discover_remote_services, find_remote_tools, and call_remote_tool. Guides cover Gemini, Claude Code, Claude Desktop, Google Antigravity and OpenClaw. sam-node skill install writes a SKILL.md so an agent can bring the node online itself. The enrollment login stays with a human by design.
Egress control: sam-box and nano-init
The Secure Outbound Gateway targets a real agent-security gap. nano-init runs as PID 1 in the sandbox and sets the proxy environment variables. For tools that ignore them, it LD_PRELOADs an interceptor hooking the C connect() syscall on ports 80 and 443.
Traffic reaches sam-box over a Unix domain socket. The gateway verifies the Biscuit, injects the real credential from secrets.yaml, and upgrades the request to HTTPS. The agent sandbox never holds the key.
A worked pattern: warm agent pool
The code-reviewer pool example fans batch work across identical running workers using ordinary MCP services. A manager learns peers via DHT discovery and tracks busy state with leases. Correctness comes from synchronous lease assignment, fencing tokens, grace eviction, and a POOL_BUSY backstop. Workers verify a short-lived HMAC token offline; anything else returns NO_LEASE.
Key Takeaways
- SAM is Sovereign Agent Mesh, an Apache-2.0 P2P overlay — not Segment Anything.
- Three binaries: control plane for identity and policy, routers for libp2p transport, nodes for MCP.
- OIDC claims are translated into Biscuit Datalog facts, so nodes authorize offline.
- Default-deny is absolute; even the discovery catalog needs an explicit grant.
- Production use means self-hosting a control plane — the public mesh is a beta testnet.
Check out the GitHub Repo. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us
Michal Sutter
+ postsBio
Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.
- Michal Sutter
Nous Research Ships Bot Mode for Hermes Agent, Turning Agent Profiles Into a Roster of Named Bots
- Michal Sutter
Meet Needle 2: An Open 45M-Parameter Tool-Calling Model That Ships as a 14MB Binary and Runs a Full Session in 28MB of RAM
- Michal Sutter
SpaceXAI Releases Grok 4.6: A 500K-Context Frontier Model Tuned for Long-Running Agents, Coding, and Knowledge Work
- Michal Sutter
Xiaomi’s MiLM Plus Releases PROVE: Perception-Aligned Object Removal Metrics RC-S and RC-T With a Real-World Video Benchmark
- Agentic AI
- AI Agents
- Artificial Intelligence
- AI Infrastructure
- Applications
- Technology
- For Devs
- Language Model
- Machine Learning
- New Releases
- Open Source
- Tech News
google/sam is not Segment Anything. SAM here means Sovereign Agent Mesh, an Apache-2.0 networking project for autonomous AI agents. The problem it targets is concrete. Agents now run across cloud servers, on-prem datacenters, laptops, Raspberry Pis and Android devices. Letting them share tools usually means exposing internal scripts, LLM endpoints or private APIs to the public internet. SAM’s alternative is a zero-config, zero-trust P2P overlay — closer to a private VPN, but scoped to agent-to-agent tool sharing over the Model Context Protocol. Nodes discover each other automatically, survive NAT, and authorize every call cryptographically.
Note: The repo carries an explicit disclaimer: this is not an officially supported Google product.
Is it deployable?
Partially, the engineering is production-shaped, but the public mesh is still labelled a beta testnet.
- What ships now: Go binaries, an install script, ghcr.io Docker images, a charts/sam-mesh Helm chart, a production Kubernetes guide, and Android/iOS support. The public testnet is bananas.sam-mesh.dev. For real workloads, self-host your control plane. The docs call this “DIY Mode” and it is the path to full data and policy control.
- Company level: Best fit is mid-market and enterprise engineering orgs running agents across more than one network boundary. Startups inside a single VPC gain less; the value shows up once agents span cloud, datacenter and laptops.
- Industries: Financial services, healthcare, public sector and defense, and industrial or robotics edge fleets. Broadly, any regulated org that cannot publish internal tools to the internet.
- Applications: Cross-cloud MCP tool sharing, hybrid on-prem to cloud agent calls, brokered inference endpoints, sandboxed agents with credential injection, and pooled warm workers.
Architecture: three binaries
- sam-control-plane — identity registration, token issuing, policy distribution.
- sam-router — libp2p bootstrap points and GossipSub routing overlays.
- sam-node — the P2P client providing mesh transport, self-healing connectivity, and a local MCP HTTP interface.
A node joins with sam-node join, then runs with sam-node run. libp2p uses 5001/udp and 5002/tcp; the local MCP API defaults to 8080.
Identity: OIDC in, Biscuit out
This is the interesting part. The control plane verifies an OIDC JWT. It then translates the claims into Datalog facts and seals them into a Biscuit token. sub becomes user(...), each group becomes group(...), and the peer ID binds in as client_peer_id(...).
The consequence: nodes authorize offline. A node evaluates the presented token against its own local rules without calling home.
Enforcement is strict default-deny. Access needs an explicit capability fact such as granted_service_exact(...). There are no built-in exceptions — even the discovery catalog system://sam.catalog must be granted. Services use a strict type://name convention with wildcard support (mcp://*, mcp://build-runner.*).
Every request runs a two-stage pipeline. Stage 1 gates the connection against ban and revocation caches. Stage 2 runs exactly two Biscuit authorizer passes. The first covers the node’s own identity token to emit target_fact assertions. The second covers the caller’s token. A baseline check blocks replay by requiring the connection peer ID to match the token.
Operators can attenuate locally, denying a write tool after 9 PM or blocking contractors. Local allows still cannot bypass control-plane check if constraints.
Interactive explainer
What an agent actually calls
The node exposes standard MCP tools: discover_remote_services, find_remote_tools, and call_remote_tool. Guides cover Gemini, Claude Code, Claude Desktop, Google Antigravity and OpenClaw. sam-node skill install writes a SKILL.md so an agent can bring the node online itself. The enrollment login stays with a human by design.
Egress control: sam-box and nano-init
The Secure Outbound Gateway targets a real agent-security gap. nano-init runs as PID 1 in the sandbox and sets the proxy environment variables. For tools that ignore them, it LD_PRELOADs an interceptor hooking the C connect() syscall on ports 80 and 443.
Traffic reaches sam-box over a Unix domain socket. The gateway verifies the Biscuit, injects the real credential from secrets.yaml, and upgrades the request to HTTPS. The agent sandbox never holds the key.
A worked pattern: warm agent pool
The code-reviewer pool example fans batch work across identical running workers using ordinary MCP services. A manager learns peers via DHT discovery and tracks busy state with leases. Correctness comes from synchronous lease assignment, fencing tokens, grace eviction, and a POOL_BUSY backstop. Workers verify a short-lived HMAC token offline; anything else returns NO_LEASE.
Key Takeaways
- SAM is Sovereign Agent Mesh, an Apache-2.0 P2P overlay — not Segment Anything.
- Three binaries: control plane for identity and policy, routers for libp2p transport, nodes for MCP.
- OIDC claims are translated into Biscuit Datalog facts, so nodes authorize offline.
- Default-deny is absolute; even the discovery catalog needs an explicit grant.
- Production use means self-hosting a control plane — the public mesh is a beta testnet.
Check out the GitHub Repo. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us
Michal Sutter
+ postsBio
Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.
- Michal Sutter
Nous Research Ships Bot Mode for Hermes Agent, Turning Agent Profiles Into a Roster of Named Bots
- Michal Sutter
Meet Needle 2: An Open 45M-Parameter Tool-Calling Model That Ships as a 14MB Binary and Runs a Full Session in 28MB of RAM
- Michal Sutter
SpaceXAI Releases Grok 4.6: A 500K-Context Frontier Model Tuned for Long-Running Agents, Coding, and Knowledge Work
- Michal Sutter
Xiaomi’s MiLM Plus Releases PROVE: Perception-Aligned Object Removal Metrics RC-S and RC-T With a Real-World Video Benchmark
AIHOT 摘要
Google 开源 Apache-2.0 项目 SAM（Sovereign Agent Mesh），为自主 AI 智能体提供零配置、零信任的 P2P 覆盖网络，支持跨云、本地数据中心和边缘设备通过 MCP 协议安全共享工具。架构包含三个二进制，节点通过 OIDC 换取 Biscuit 令牌实现离线授权，默认拒绝一切访问。公共网格仍为 beta 测试网，生产环境需自托管控制平面。
为什么值得关注
相比把内部工具暴露公网，SAM 把权限判定放在本地 Biscuit token，离线的默认拒绝机制更适合跨云、机房和终端的 agent 工具共享。
工程化解读
从 TopoReduce 的工程视角看，这条信息属于“智能体与自动化”主题。它的价值不只在于一个新产品或新观点本身，还在于说明 AI 系统正在如何影响模型接入、智能体协作、研发流程、基础设施和团队决策。实际采用前，应结合原文确认版本、适用范围、价格和运行条件。
- 发布时间：2026-08-18；AIHOT 分类：智能体与自动化。
- AIHOT 标签：
- AIHOT 判断：相比把内部工具暴露公网，SAM 把权限判定放在本地 Biscuit token，离线的默认拒绝机制更适合跨云、机房和终端的 agent 工具共享。
- AIHOT 评分：62；评分用于站内排序，不等同于独立评测结论。
TopoReduce 编辑观察
当 AI 动态进入真实生产环境，团队需要同时关注能力边界、数据来源、调用成本、权限控制和可回滚性。把单条新闻放回完整工程链路中阅读，比只看标题更有助于判断它是否适合自己的产品和工作流。