agentmesh-mesh

AgentMesh

A security mesh for AI agent systems. Sits between your agents and the tools they call, enforcing taint tracking, content scanning, identity verification, and compliance audit without changing your agent code.

Built on Tessera (51 of 94 modules integrated), with support for SPIRE identity, agentgateway data plane, and OpenTelemetry observability.

Quickstart

# Install
pip install agentmesh-mesh tessera-mesh

# Start the demo tools server
python examples/demo_tools_server.py &

# Start the proxy
PYTHONPATH=src python -c "
from agentmesh.proxy import MeshProxy
MeshProxy(signing_key=b'your-key-here-at-least-16-bytes',
          enable_rag_guard=True).run()
"

# Run the demo (in another terminal)
pip install requests
python examples/demo_agent.py

Demo output

  [1] Injection Detection and Taint Tracking

  search_hotels: ALLOWED
  read_webpage:  labeled trust=0 (min_trust dropped to 0)
  Scan result:   tainted=True, heuristic=1.00
  send_email:    BLOCKED (context tainted by webpage injection)

  [2] RAG Retrieval Scanning

  Clean chunk:   safe=True, action=allow
  Poison chunk:  safe=False, action=reject

  [3] Tool Shadow Detection

  Shadowed: True
    read_file <-> read_flle  distance=1

  [4] MCP Baseline Drift Detection

  Baseline saved: 2 tools
  Drift detected: True (search: modified)

  [7] Compliance Export (SARIF)

  SARIF version: 2.1.0
  Findings: 11
    [error] tessera/injection-detected

23 HTTP Endpoints

OpenAPI docs available at /docs when the proxy is running.

Framework SDK

Drop-in adapters for 10 frameworks that call the proxy instead of running Tessera in-process:

Examples:

# LangChain
from agentmesh.sdk.langchain import MeshCallbackHandler
handler = MeshCallbackHandler(proxy_url="http://localhost:9090")
chain = agent.with_config(callbacks=[handler])

# LlamaIndex
from agentmesh.sdk.llamaindex import MeshLlamaIndexHandler
from llama_index.core.callbacks import CallbackManager
handler = MeshLlamaIndexHandler(proxy_url="http://localhost:9090")
Settings.callback_manager = CallbackManager([handler])

# LangGraph (node functions, not callbacks)
from agentmesh.sdk.langgraph import MeshLangGraphGuard
guard = MeshLangGraphGuard(proxy_url="http://localhost:9090")
graph.add_node("check_tool", guard.check_tool_call)
graph.add_node("label_output", guard.label_tool_output)

# Any framework (manual control)
from agentmesh.sdk.generic import MeshGuard
with MeshGuard() as guard:
    guard.start_session("Find hotels and email me the best one")
    ok, reason = guard.before_tool("search_hotels")
    guard.after_tool("search_hotels", results)

Architecture

Agent (any framework)
  |
  v
AgentMesh SDK adapter (or direct HTTP)
  |
  v
AgentMesh Proxy (23 endpoints, 51 Tessera modules)
  |-- Identity (SPIRE JWT-SVID, mTLS, liveness)
  |-- Content scanning (heuristic, directive, intent, unicode, PII)
  |-- Policy evaluation (taint tracking, CEL rules, plan verification)
  |-- RAG guard (retrieval chunk scanning, pattern tracking)
  |-- Risk forecasting (salami detection, irreversibility scoring)
  |-- Compliance (SARIF export, signed evidence, audit chain)
  |
  v
Upstream MCP server (agentgateway or direct)

Performance

Measured on Apple M-series, FastAPI TestClient (in-process), 2,000 iterations per endpoint per config.

Feature overhead is small. Default vs minimal adds 77us p50 to the evaluate pipeline (+6%). Full config adds 73us (+5%). The scanner cost on tainted text (8.5ms) is the fixed work of running the sliding-window injection detector, which is unaffected by feature flags.

Headline: AgentMesh adds ~1.4ms p50 and ~2.1ms p99 per tool call at the default configuration. Reproduce with python benchmarks/bench_proxy.py.

Defense layers

1. Prompt screening before context entry (delegated injection defense)
2. Content scanning (heuristic, directive, intent, unicode, schema, PII, secrets)
3. LLM guardrail (optional, fires only on ambiguous FREE_TEXT)
4. Taint tracking (min_trust floor blocks side-effecting tools)
5. Value-level taint (per-argument provenance via DependencyAccumulator)
6. Read-only guard (path traversal, mutation detection)
7. Plan verification (tool sequence vs user intent)
8. Risk forecasting (salami detection, drift, commitment creep, irreversibility scoring)
9. Toxic flow (blocks egress when context has both untrusted and sensitive data)
10. RAG guard (retrieval chunk scanning, poisoned document detection)
11. Tool shadow detection (cross-server typosquatting)
12. MCP baseline drift (rug-pull detection)
13. Canary tokens (output manipulation confirmation)
14. Output provenance (n-gram echo detection, task relevance)
15. Trust decay (time-based and anomaly-driven trust degradation)
16. Cooldown escalation (adaptive denial response)
17. Policy invariant (control-flow bypass detection)
18. Provenance manifests (signed segment chains)
19. Evidence bundles (signed forensic event export)
20. SARIF compliance (security events in standard format)
21. Side-channel mitigations (loop guard, structured results)
22. CEL deny rules (expression-based policy extension)

Tests

pip install -e '.[dev]' tessera-mesh[agentmesh,cel,sessions]
pytest tests/ -v
# 106 passed in 5.5s

Install from PyPI:

pip install agentmesh-mesh

Repository structure

src/agentmesh/
    proxy.py          Proxy with 23 endpoints (1,172 lines)
    identity.py       Signing, SPIRE, mTLS, liveness (141 lines)
    transport.py      MCP interceptor, baseline, RAG guard (173 lines)
    exports.py        SARIF, telemetry, evidence, control plane (148 lines)
    client.py         HTTP client for the proxy API (191 lines)
    sdk/              Framework adapters (LangChain, OpenAI, CrewAI, ADK)
tests/
    test_proxy.py     Core proxy tests (19)
    test_tier2_tier3.py  Production hardening tests (31)
    test_tier_ab.py   Defense-in-depth tests (38)
    test_sdk.py       SDK and client tests (18)
deployment/
    docker/           Docker Compose (SPIRE + agentgateway + proxy + OTel)
examples/
    demo_agent.py     Exercises all 23 endpoints
    demo_tools_server.py  Mock MCP tool server
docs/
    ARCHITECTURE.md   Component contracts
    OPERATOR_GUIDE.md Operations procedures

License

AGPL-3.0-or-later.