A local node gives agents one doorway to remote MCP tools
Each SAM node exposes a local MCP server. An attached agent can inspect the mesh, discover services, list tools on a peer, and invoke a remote tool through a protected peer-to-peer stream. The node handles network identity and authorization, so the agent harness does not need a credential for every tool provider. A control plane registers identities and policies, while routers help nodes discover and reach one another over libp2p.
The quick start joins Google's public bananas.sam-mesh.dev testnet through OIDC or a bootstrap token. After enrollment, a node stores its Biscuit capability and identity for later starts. Local HTTP is protected by an API token, and Docker examples expose UDP 5001, TCP 5002, and the local API on 8080. This is more networking than a normal single-process MCP server, even on the hosted testnet path.
What happened when we ran it
Our sandbox installed 324 Go packages in 61 seconds and built commit cdaf83e in 78 seconds. The checkout contained 399 files, about 51,103 lines of source, and 27.4 MB. Our scan found 10 CI workflow files and a tests directory, with no Dockerfile. Those results show a manageable source build for a network system with control-plane, router, node, console, and integration code.
The test step failed after 385 seconds. The reported Go result was 0 passed and 1 failed of 1. TestSamBoxNanoInitIntegration tried to re-execute under unshare, which returned Operation not permitted inside our unprivileged container. The test log also showed DHT activity, Biscuit signing-key rotation, and a deliberately malformed OIDC token, but the named test failure was the rejected namespace operation.
That failure does not prove the namespace code is broken, and the log does not establish that granting privileges would make the whole test pass. It does prove this isolation check cannot run under the restrictions of our fresh Debian sandbox. Teams using the sandbox feature should reproduce it with the exact Linux capabilities and kernel configuration intended for deployment rather than removing the test to get a green result.
Claude Code gets a skill, while enrollment stays human
sam-node skill install writes a SAM skill for Claude Code, Claude Desktop, or Google's supported skill locations. The document teaches an agent how to start the node, register its MCP endpoint, find mesh services, and call remote tools. An agent can run the daemon and read its local API token, but the one-time OIDC enrollment login is intentionally returned to a person.
The separation is sensible because enrollment creates durable network identity. Remote MCP configuration must protect that token, and the node should normally bind its management surface to 127.0.0.1. Resetting all node data destroys the key and creates a new peer identity, so backups and recovery procedures need to distinguish configuration from identity.
Self-hosting means OIDC, routers, DNS, and policy
The production guide describes Dex as an identity bridge, a stateless control plane backed by PostgreSQL, stateful routers with persistent identity keys, and nodes authenticated through Kubernetes projected service-account tokens. A DNS synchronization job publishes changing router addresses for DHT bootstrapping. The control plane starts closed until an administrator posts a policy, which is the correct default for remote tool execution.
This stack fits a platform team already operating Kubernetes and identity federation. It is excessive for two agents on one LAN. The sample router deployment uses 3 replicas and persistent volumes, while the control plane example also uses 3 replicas. Operators must manage OAuth clients, issuer and audience values, database availability, DNS records, router ports, signing-key rotation, enrollment approval, and revocation.
Alpha security fixes deserve release-by-release review
Issue 296 reported that the node data-plane authorizer at the exact commit we tested did not inject the time fact needed to reject expired Biscuit capabilities. Pull request 316 fixed missing expiration checks and merged on August 26, 2026, after that commit.
Another current issue, 317, says rotation and revocation events are handled by nodes but are not propagated by the shipped control-plane binary because it retains a no-operation mesh adapter. That is an open report, not a confirmed release note. For a system whose pitch centers on authorization, these are adoption-blocking checks: prove expiry, revocation, key rotation, and policy denial across real nodes before routing sensitive tools.
Remote discovery works by names, and intent search is unfinished
Agents can discover registered MCP services, fetch a peer's catalog, and call a tool through the local node. Open issue 313 points out that the find_remote_tools schema accepts a natural-language intent field but currently ignores it. Exact peer, service, and tool filters work; an agent that does not know the tool name must retrieve a broader list and inspect descriptions itself.
Issue 318 also notes that the node currently exposes 16 MCP tools, including 5 operator diagnostics proposed for removal from the agent-visible list. The proposal had not merged when researched. A growing catalog increases prompt size and the chance of choosing the wrong operation, so deployments should inventory the actual tool list exposed to each agent rather than assuming SAM's local endpoint contains only remote invocation functions.
Same-day activity does not make alpha infrastructure settled
GitHub recorded 702 stars and 15 combined open issues and pull requests when fetched. The last push was August 26, 2026, and v0.1.0-alpha.7 was published August 16. Recent activity covered enrollment, namespace isolation, authorization expiry, Kubernetes packaging, service advertisement, identity evidence, and tool-surface reduction. The pace is high because core behavior is still being corrected.
SAM is interesting when agent networking itself is the product problem. Our 78-second successful build makes source evaluation accessible, while the 385-second failed integration test shows that meaningful validation reaches into Linux isolation behavior. Use the testnet to learn the model, then demand a security and operations proof before trusting a private mesh.