Agents that
work together.
Let AI agents discover each other, talk, and delegate work — across teams inside one company, and across the boundary between two organizations that do not trust each other.
Every agent is an island.
Building one capable agent is close to a solved problem. Getting two of them to work together — especially when they belong to different teams, or different companies — is still done by hand, one integration at a time.
Without a protocol
- An agent can call tools, but it cannot find another agent. You hardcode an address, and it breaks the day something moves.
- Two teams wire their agents together with their own glue. Six months later nobody can say who asked for what, or prove it.
- Across two companies it stops entirely. Neither side hands over an API key that opens everything, so the work goes back to email.
With InterMesh
- Agents announce what they can do. Others address them by capability, not by a machine that may have moved.
- Registration, delegation and completion append to a chained log. Replay it and you have the whole history, or you find out it was edited.
- Two companies peer their hubs. Each keeps its own signing key, so either side can authenticate the other and neither can sign in its name.
The words used on this page
Eight terms carry most of the meaning here. They are worth two minutes, because everything below assumes them.
- Agent
- Any program that does one job and can be asked to do it — a Python function, a Go binary, an HTTP endpoint. It does not have to involve a model.
- Hub
- The router the agents of one organization connect to. It knows who is online and where to send a message. It cannot read the message.
- Capability
- A label an agent declares about itself, such as pricing or translation. You address work to a capability; the hub picks who answers.
- Delegation
- One agent handing a task to another and waiting for the result. The chain of who delegated to whom is recorded.
- Peering
- A declared link between the hubs of two different organizations. Nothing crosses between two organizations that have not peered.
- Egress policy
- Your rule for what may leave: drop a field, redact a pattern, or block the payload. It applies to outbound traffic only.
- Escrow
- Payment held aside when a paid task starts, released to the provider only once the task completes.
- Mesh
- The whole set — your agents, your hub, and the peered hubs you have chosen to reach.
Your agent already exists. Plug it in.
No SDK to learn on the foreign side. Your program reads JSON on stdin and writes JSON on stdout — that is the entire contract. A Go binary, a Node script, a shell one-liner, or an HTTP service already running.
// pricing-engine — no InterMesh SDK
func main() {
var in map[string]any
json.NewDecoder(os.Stdin).Decode(&in)
out := map[string]any{
"total": in["quantity"].(float64) * in["unit_price"].(float64),
}
json.NewEncoder(os.Stdout).Encode(out)
}The agent inherits end-to-end encryption, capability discovery and the audit log without a line of integration code. A program that overruns its timeout is killed along with its children.
Two companies. No mutual trust required.
Each organization keeps its own hub. Peering opens a verifiable link between them, without ever sharing a signing secret.
Its procurement agent addresses globex/pricing_engine as if it were local. The hub relays; the answer comes back.
Verifies every relayed message against the public key Acme published. It can authenticate, never impersonate.
Verifiable, unforgeable identity
Tokens are signed with an Ed25519 private key that never leaves its hub. Peers exchange public keys, never a shared secret — otherwise either side could sign in the other's name.
The link itself is protected
Plaintext peering to a remote host is refused: the handshake carries the public keys, so an in-path attacker could swap them. TLS with certificate and hostname verification, always on.
You decide what leaves
An egress policy drops a field, redacts a pattern, or blocks the payload. Enforced by the agent before encryption, and by the hub at relay time. Internal exchanges are never filtered.
Watch two mandates negotiate.
A distributor and a producer, each with a private mandate — what they want, what they will never cross. No human types the offers. Run it, or try the mandate that does not converge.
Pick a scenario and press Run — each line is a real offer evaluated against a private mandate.
This runs entirely in your browser — the same mandate-evaluation logic as examples/negociation_partenariat.py, ported to TypeScript. No hub, no network calls — the real script actually runs two hubs and two agent processes talking over InterMesh; this replays the same decision rules so you can watch the outcome without installing anything.
Four steps, from two scripts to a mesh
InterMesh is the layer underneath your framework of choice, not a replacement for it. A central hub routes messages between agents — it never reads their contents.
Signed identity
An agent declares its capabilities. The hub returns a token carrying a SHA-256 fingerprint of its roles and permissions — tampering with either breaks the other.
Discovery by capability
Agents are found by what they do, not by a hardcoded address that breaks the moment something moves.
Sealed delegation
The payload is encrypted with a single-use AES-256-GCM key, sealed with the recipient's RSA-2048 public key. The hub routes ciphertext.
Everything chains in
Registration, delegation and completion append to a Merkle-chained log. Edit one entry in the database and the chain breaks, loudly.
Three scenarios, available today
Not projections: each rests on mechanisms that exist in the repository and are covered by tests.
B2B supply chain
A factory agent detects a stock shortage and negotiates directly with the supplier's agent: offer, counter-offer, internal budget approval, signature. Payment is held in escrow and released on completion.
Due diligence and audit
The buyer requests documents; the seller's agent answers with real margin and bank details stripped out before transfer. The approved figures pass, the rest never crosses the boundary.
Single point of contact
A refund request pulls in support, finance and logistics in parallel. The pipeline resolves each agent by capability, so replacing one does not break the flow.
Complementary, not competing
The landscape is crowded, and honesty serves better than a rigged comparison. Here is what each piece actually solves.
| Layer | Connects | Brings |
|---|---|---|
| MCP | An agent to tools and data | Standardized tool access. A client/server relationship — asymmetric by design. |
| A2A | Agents to each other | A peer-to-peer exchange format, backed by a broad coalition. |
| InterMesh | Organizations to each other | The hub, end-to-end encryption, verifiable federated identity, control over what leaves, and payment escrow. |
Transport and message format are the easy part — they have been solved several times over. What was missing is identity between organizations, governance of outbound data, and accountability for payment. That is where InterMesh works.
What is in the box
End-to-end encryption
RSA-2048-OAEP and AES-256-GCM, client side. The hub routes without ever reading a plaintext payload.
Cross-language mesh
Native Python and Node.js SDKs, plus a universal bridge for everything else. A Python agent delegates to a Go binary transparently.
Immutable Merkle audit
A SHA-256 chained event log, replayed and verified at startup: an entry edited directly in the database is detected.
Hub-to-hub federation
Cross-organization peering with automatic reconnection, Ed25519 identity and verified TLS transport.
Runaway guardrails
Capped delegation depth, per-agent rate limiting, and a circuit breaker that isolates an agent after repeated violations.
Orchestration
Pipelines chaining steps by capability, parallel fan-out, payment escrow, and encrypted state snapshots.
RFC-001 is real, and it is not finished
A page that only lists strengths is not trustworthy. Here is what to know before relying on this in production.
Peering is manual
Each organization declares its peers by hand. There is no directory: ten partners means forty-five links to maintain.
No shared memory
Every task is an isolated request/response. Context travels only through the payloads you pass explicitly.
Egress filtering has a limit
It addresses leaks by negligence, not deliberate exfiltration. An insider agent that encrypts before sending gets through.
Resumed tasks can run twice
A task interrupted by a restart is reassigned on reconnect. Your executors must be idempotent.
The spec is public precisely so it can be argued with. Read RFC-001 and tell us where it is wrong.
The ones you would ask.
Answered straight, including where the answer is not flattering.
Do I have to rewrite my agents?
No. If your program reads JSON on stdin and writes JSON on stdout, one command puts it on the mesh. If it is already an HTTP service, point InterMesh at its URL and change nothing at all. The native Python and Node.js SDKs exist for agents you are writing from scratch, not as a requirement.
Does this replace LangChain, CrewAI or MCP?
No, and it is not trying to. Those help you build a single agent and connect it to tools and data. InterMesh starts after that: it connects agents that already work to each other, especially across a company boundary where neither side can be given the other’s credentials.
Can the hub read what my agents send?
Not the payload. It is encrypted on the sending agent with a single-use AES key sealed to the recipient’s public key, and the hub only routes ciphertext. The hub does see routing metadata — who talked to whom, when, and how large the message was — because it cannot deliver anything without it.
What happens if the hub goes down?
Agents reconnect on their own and state is restored from an encrypted snapshot, so work resumes. A task interrupted mid-flight is reassigned, which means your executors must be idempotent — running one twice must be safe. And a single hub is still a single point of failure today; that is on the roadmap, not in the box.
Do the agents have to be AI?
No. A shell script that echoes its input is a valid agent. The protocol cares about identity, routing and accountability, not about what runs behind the endpoint.
Is it ready for production?
The mechanisms described on this page exist and are covered by tests. The limitations further down are the ones that would bite you, and they are listed rather than hidden. Read them before deciding, and read RFC-001 before building on it.
Three commands, and your
agents are talking.
Open source under Apache-2.0. Free self-hosted tier up to 10 active agents, no account required to try it.