Agent Mesh

AgentMesh — Community Edition

SSL for AI Agents

The trust, identity, and governance layer for production AI agent systems

Identity · Trust · Reward · Governance

[](https://github.com/imran-siddique/agent-mesh/stargazers) [](https://github.com/sponsors/imran-siddique) [](https://github.com/imran-siddique/agent-mesh/actions/workflows/ci.yml) [](LICENSE) [](https://python.org) [](sdks/typescript/) [](sdks/go/) [](https://pypi.org/project/agentmesh-platform/) [](https://pypi.org/project/agentmesh-platform/) [](https://pepy.tech/project/agentmesh-platform) [](https://github.com/imran-siddique/agent-governance/blob/master/docs/OWASP-COMPLIANCE.md) [](https://github.com/imran-siddique/agent-os) [](https://github.com/Shubhamsaboo/awesome-llm-apps) [](https://github.com/imran-siddique/agent-mesh/discussions) [](https://github.com/run-llama/llama_index/pull/20644) [](https://github.com/Jenqyang/Awesome-AI-Agents/pull/45) [](https://github.com/github/awesome-copilot/pull/755) [](https://github.com/magsther/awesome-opentelemetry/pull/24)

> ⭐ If this project helps you, please star it! It helps others discover AgentMesh.

> 🔗 Part of the Agent Governance Ecosystem — Works with Agent OS (kernel), Agent Hypervisor (runtime), and Agent SRE (reliability)

> 📦 Install the full stack: pip install ai-agent-governance[full] — PyPI | GitHub

[Quick Start](#quick-start) • [MCP Proxy](#the-agentmesh-proxy-ssl-for-ai-agents) • [Examples](#examples--integrations) • Agent OS • Agent Hypervisor

Trusted By

Featured In

1,300+Tests Passing 6Framework Integrations 170K+Combined Stars ofIntegrated Projects 4Protocol Bridges(A2A · MCP · IATP · AI Card) <1ms p99Full Governance Pipeline

🏢 Production Integrations

| Framework | Stars | Status | What We Ship | |-----------|-------|--------|-------------| | Dify | 65K ⭐ | ✅ Merged | Trust verification plugin in Dify Marketplace | | LlamaIndex | 47K ⭐ | ✅ Merged | TrustedAgentWorker + TrustGatedQueryEngine | | Microsoft Agent-Lightning | 15K ⭐ | ✅ Merged | Governance kernel for RL training safety | | LangGraph | 24K ⭐ | 📦 PyPI | Trust-scored state transitions | | OpenAI Agents SDK | — | 📦 PyPI | Tool-level governance guardrails | | Haystack | 22K ⭐ | 🔄 In Review | GovernancePolicyChecker + TrustGate components |

> AgentMesh is "SSL for AI Agents" — the trust and identity layer that makes multi-agent systems enterprise-ready. Every agent gets a cryptographic identity. Every interaction is verified. Every action is audited.

---

Overview

AgentMesh is the first platform purpose-built for the Governed Agent Mesh — the cloud-native, multi-vendor network of AI agents that will define enterprise operations.

The protocols exist (A2A, MCP, IATP). The agents are shipping. The trust layer does not. AgentMesh fills that gap.

┌─────────────────────────────────────────────────────────────────────────────┐
│                           AGENTMESH ARCHITECTURE                            │
├─────────────────────────────────────────────────────────────────────────────┤
│  LAYER 4  │  Reward & Learning Engine                                       │
│           │  Per-agent trust scores · Behavioral rewards · Adaptive          │
├───────────┼─────────────────────────────────────────────────────────────────┤
│  LAYER 3  │  Governance & Compliance Plane                                  │
│           │  Policy engine · EU AI Act / SOC2 / HIPAA · Audit logs          │
├───────────┼─────────────────────────────────────────────────────────────────┤
│  LAYER 2  │  Trust & Protocol Bridge                                        │
│           │  A2A · MCP · IATP · Protocol translation · Capability scoping   │
├───────────┼─────────────────────────────────────────────────────────────────┤
│  LAYER 1  │  Identity & Zero-Trust Core                                     │
│           │  Agent CA · Ephemeral creds · SPIFFE/SVID · Human sponsors      │
└───────────┴─────────────────────────────────────────────────────────────────┘

Why AgentMesh?

The Problem

• 40:1 to 100:1 — Non-human identities now outnumber human identities in enterprises
• AI agents are the fastest-growing, least-governed identity category
• A2A gives agents a common language. MCP gives agents tools. Neither enforces trust.

The Solution

AgentMesh provides:

| Capability | Description | |------------|-------------| | Agent Identity | First-class identity with human sponsor accountability | | Ephemeral Credentials | 15-minute TTL by default, auto-rotation | | Protocol Bridge | Native A2A, MCP, IATP with unified trust model | | Reward Engine | Continuous behavioral scoring | | Compliance Automation | EU AI Act, SOC 2, HIPAA, GDPR mapping |

How It Works

1. Agent Registration & DID Issuance

sequenceDiagram
    participant Agent
    participant CLI as AgentMesh CLI
    participant CA as Certificate Authority
    participant Registry as Agent Registry

    Agent->>CLI: agentmesh init --name my-agent --sponsor alice@company.com
    CLI->>CA: Request Ed25519 keypair & DID
    CA-->>CLI: did:mesh:my-agent + signed certificate
    CLI->>Agent: Write identity to local config
    Agent->>CLI: agentmesh register
    CLI->>Registry: Register DID + capabilities + sponsor
    Registry-->>CLI: Registration confirmed
    CLI-->>Agent: Agent ready (status: registered)

2. Trust Handshake Between Two Agents

sequenceDiagram
    participant A as Agent A
    participant Bridge as TrustBridge
    participant B as Agent B

    A->>Bridge: verify_peer(did:mesh:agent-b, min_trust=700)
    Bridge->>B: IATP challenge (nonce + timestamp)
    B-->>Bridge: Signed response (Ed25519 signature)
    Bridge->>Bridge: Verify signature & check trust score
    alt Trust score ≥ 700
        Bridge-->>A: Verification succeeded (score: 850)
        A->>Bridge: send_message(did:mesh:agent-b, payload)
        Bridge->>B: Deliver message
        B-->>Bridge: Acknowledge
        Bridge-->>A: Message delivered
    else Trust score >A: Verification failed (score: 620)
    end

3. MCP Proxy Request Flow

sequenceDiagram
    participant Client as MCP Client (e.g. Claude)
    participant Proxy as AgentMesh Proxy
    participant Policy as Policy Engine
    participant Server as MCP Server

    Client->>Proxy: Tool call request
    Proxy->>Policy: Evaluate action against policy rules
    alt Action allowed
        Policy-->>Proxy: Allow
        Proxy->>Server: Forward tool call
        Server-->>Proxy: Tool result
        Proxy->>Proxy: Sanitize output & append verification footer
        Proxy-->>Client: Governed tool result
    else Action denied
        Policy-->>Proxy: Deny (rule: no-pii-export)
        Proxy-->>Client: Action blocked + reason
    end
    Proxy->>Proxy: Write audit log entry

4. Credential Rotation Lifecycle

sequenceDiagram
    participant Agent
    participant CA as Certificate Authority
    participant Registry as Agent Registry

    CA->>Agent: Issue ephemeral credential (TTL: 15 min)
    Note over Agent: Credential active

    loop Every 15 minutes
        Agent->>CA: Request credential rotation
        CA->>CA: Verify agent DID & trust score
        CA-->>Agent: New ephemeral credential (TTL: 15 min)
        CA->>Registry: Update credential fingerprint
        Note over Agent: Old credential invalidated
    end

    alt Trust breach detected
        Registry->>CA: Revoke credential immediately
        CA-->>Agent: Credential revoked
        Note over Agent: Agent must re-register
    end

5. Trust Score Update After Task Completion

sequenceDiagram
    participant Agent
    participant Governance as Governance Layer
    participant Reward as Reward Engine
    participant Registry as Agent Registry

    Agent->>Governance: Complete task (action: data_export)
    Governance->>Governance: Check compliance (SOC2, HIPAA)
    Governance-->>Reward: Task result + compliance status
    Reward->>Reward: Calculate score delta
    Note over Reward: Policy compliance: +10Task success: +5No violations: +3
    Reward->>Registry: Update trust score (820 → 838)
    Registry-->>Agent: Updated trust score: 838
    Reward->>Governance: Write audit log

Quick Start

Option 1: Secure Claude Desktop (Recommended)

# Install AgentMesh
pip install agentmesh-platform

# Set up Claude Desktop to use AgentMesh governance
agentmesh init-integration --claude

# Restart Claude Desktop - all MCP tools are now secured!

Claude will now route tool calls through AgentMesh for policy enforcement and trust scoring.

Option 2: Create a Governed Agent

# Initialize a governed agent in 30 seconds
agentmesh init --name my-agent --sponsor alice@company.com

# Register with the mesh
agentmesh register

# Start with governance enabled
agentmesh run

Option 3: Wrap Any MCP Server

# Proxy any MCP server with governance
agentmesh proxy --target npx --target -y \
  --target @modelcontextprotocol/server-filesystem \
  --target /path/to/directory

# Use strict policy (blocks writes/deletes)
agentmesh proxy --policy strict --target 

Installation

pip install agentmesh-platform

Or install with extra dependencies:

pip install agentmesh-platform[server]  # FastAPI server
pip install agentmesh-platform[dev]     # Development tools

Or from source:

git clone https://github.com/imran-siddique/agent-mesh.git
cd agent-mesh
pip install -e .

Examples & Integrations

Real-world examples to get started quickly:

| Example | Use Case | Key Features | |---------|----------|--------------| | [Registration Hello World](./examples/00-registration-hello-world/) | Agent registration walkthrough | Identity, DID, sponsor handshake | | [MCP Tool Server](./examples/01-mcp-tool-server/) | Secure MCP server with governance | Rate limiting, output sanitization, audit logs | | [Multi-Agent Customer Service](./examples/02-customer-service/) | Customer support automation | Trust handshakes, delegation, A2A | | [Healthcare HIPAA](./examples/03-healthcare-hipaa/) | HIPAA-compliant data analysis | Compliance automation, PHI protection, audit logs | | [DevOps Automation](./examples/04-devops-automation/) | Just-in-time DevOps credentials | Ephemeral creds, capability scoping | | [GitHub PR Review](./examples/05-github-integration/) | Code review agent | Output policies, shadow mode, trust decay |

Framework integrations:

• [Claude Desktop](./docs/integrations/claude-desktop.md) - Secure MCP tools with one command
• [LangChain Integration](./examples/integrations/langchain.md) - Secure LangChain agents with policies
• [CrewAI Integration](./examples/integrations/crewai.md) - Multi-agent crew governance
• [LangGraph](./src/agentmesh/integrations/langgraph/) - Trust checkpoints for graph workflows (built-in)
• [OpenAI Swarm](./src/agentmesh/integrations/swarm/) - Trust-verified handoffs (built-in)
• Dify - Trust middleware for Dify workflows

📚 [Browse all examples →](./examples/)

Trust Visualization Dashboard

Interactive Streamlit dashboard:

cd examples/06-trust-score-dashboard
pip install -r requirements.txt
streamlit run trust_dashboard.py

Tabs: Trust Network | Trust Scores | Credential Lifecycle | Protocol Traffic | Compliance

The AgentMesh Proxy: "SSL for AI Agents"

Problem: AI agents like Claude Desktop have unfettered access to your filesystem, database, and APIs through MCP servers. One hallucination could be catastrophic.

Solution: AgentMesh acts as a transparent governance proxy:

# Before: Unsafe direct access
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/me"]
    }
  }
}

# After: Protected by AgentMesh
{
  "mcpServers": {
    "filesystem": {
      "command": "agentmesh",
      "args": [
        "proxy", "--policy", "strict",
        "--target", "npx", "--target", "-y",
        "--target", "@modelcontextprotocol/server-filesystem",
        "--target", "/Users/me"
      ]
    }
  }
}

What you get:

• 🔒 Policy Enforcement - Block dangerous operations before they execute
• 📊 Trust Scoring - Per-agent trust scoring (800-1000 scale)
• 📝 Audit Logs - Record of every action
• ✅ Verification Footers - Visual confirmation in outputs

Set it up in 10 seconds:

agentmesh init-integration --claude
# Restart Claude Desktop - done!

Learn more: [Claude Desktop Integration Guide](./docs/integrations/claude-desktop.md)

Core Concepts

1. Agent Identity

Every agent gets a unique, cryptographically bound identity:

from agentmesh import AgentIdentity

identity = AgentIdentity.create(
    name="data-analyst-agent",
    sponsor="alice@company.com",  # Human accountability
    capabilities=["read:data", "write:reports"],
)

2. Scope Chains

Agents can delegate to sub-agents, but scope always narrows:

# Parent agent delegates to child
child_identity = parent_identity.delegate(
    name="summarizer-subagent",
    capabilities=["read:data"],  # Subset of parent's capabilities
)

3. Trust Handshakes (IATP)

Cross-agent communication requires trust verification:

from agentmesh import AgentIdentity, TrustBridge

# Create your identity first
identity = AgentIdentity.create(name="my-agent", sponsor="admin@company.com")

# Set up trust bridge
bridge = TrustBridge(agent_did=str(identity.did))

# Verify peer before communication
verification = await bridge.verify_peer(
    peer_did="did:mesh:other-agent",
    required_trust_score=700,
)

if verification.verified:
    print(f"Peer trusted: score={verification.trust_score}")

4. Reward Scoring

Every action is scored to maintain agent trust:

from agentmesh import RewardEngine

engine = RewardEngine()

# Actions are automatically scored
score = engine.get_agent_score("did:mesh:my-agent")
# Returns trust score on 0-1000 scale

5. Policy Engine

Declarative governance policies:

# policy.yaml
version: "1.0"
agent: "data-analyst-agent"

rules:
  - name: "no-pii-export"
    condition: "action.type == 'export' and data.contains_pii"
    action: "deny"
    
  - name: "rate-limit-api"
    condition: "action.type == 'api_call'"
    limit: "100/hour"
    
  - name: "require-approval-for-delete"
    condition: "action.type == 'delete'"
    action: "require_approval"
    approvers: ["security-team"]

Protocol Support

| Protocol | Status | Description | |----------|--------|-------------| | AI Card | ✅ Alpha | Cross-protocol identity standard (src/agentmesh/integrations/ai_card/) | | A2A | ✅ Alpha | Agent-to-agent coordination (full adapter in src/agentmesh/integrations/a2a/) | | MCP | ✅ Alpha | Tool and resource binding (trust-gated server/client in src/agentmesh/integrations/mcp/) | | IATP | ✅ Alpha | Trust handshakes (via agent-os, graceful fallback if unavailable) | | ACP | 🔜 Planned | Lightweight messaging (protocol bridge supports routing, adapter not yet implemented) | | SPIFFE | ✅ Alpha | Workload identity |

Architecture

agentmesh/
├── identity/           # Layer 1: Identity & Zero-Trust
│   ├── agent_id.py     # Agent identity management (DIDs, Ed25519 keys)
│   ├── credenti

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [imran-siddique](https://github.com/imran-siddique)
- **Source:** [imran-siddique/agent-mesh](https://github.com/imran-siddique/agent-mesh)
- **License:** MIT
- **Homepage:** https://imransiddique.com

Install and usage instructions live in the source repository linked above.