node

package

Go to main page

Versions in this module

v0

v0.2.0

Nov 2, 2026

Changes in this version

+ const PeerstoreKeyUnresolved

+ var ErrHandshakeRateLimited = errors.New("provider refused the handshake at its rate limit")

+ func LoadOrGenerateKey(s *Store) (crypto.PrivKey, error)

type AgentMeshNode

+ func (n *AgentMeshNode) AttachedRouterIDs() []peer.ID

+ func (n *AgentMeshNode) EgressHandler() http.Handler

+ func (n *AgentMeshNode) EnrollBootstrapCredential(ctx context.Context, controlPlaneURL, bootstrapToken string, trustedOnly bool) (*api.BootstrapEnrollResponse, error)

+ func (n *AgentMeshNode) InferenceHandler() http.Handler

+ func (n *AgentMeshNode) PreferredRouterIngressURL() string

+ func (n *AgentMeshNode) RouterIngressURLs() []string

+ func (n *AgentMeshNode) Services() *ServiceRegistry

+ func (n *AgentMeshNode) StartExternalIngressServer(ctx context.Context) error

+ func (n *AgentMeshNode) SyncTrustedKeys(ctx context.Context, controlPlaneURL string) error

+ type ExternalIngressGate interface

+ ExternalIngressAllowed func() bool

+ type IngressStateObserver interface

+ SetIngressActive func(active bool)

type Options

+ AllowInsecureControlPlane bool

+ DisableFatalExit bool

+ OnStreamRefused func(scope, protocol string)

+ type UnannouncedService interface

+ NoAnnounce func() bool

v0.1.1

Oct 18, 2026

Changes in this version

type Options

+ BootstrapTokenPath string

v0.1.0

Oct 15, 2026

Changes in this version

+ const ConnHighWaterMark

+ const ConnLowWaterMark

+ const DefaultConfigFile

+ const DefaultControlPlaneSyncInterval

+ const DefaultDiscoveryInterval

+ const DefaultRouterAuthAttempts

+ const DefaultRouterConnectTimeout

+ const DefaultRouterRedialAttempts

+ const DefaultRouterRedialDelay

+ const DefaultRouterShunDuration

+ const DefaultRouters

+ const DefaultSecretsDir

+ const DefaultSocketName

+ const ExtProcMethodPath

+ const FreshnessThreshold

+ const HeaderMeshEgressPort

+ const HeaderMeshMCPTool

+ const HeaderMeshTunnelUpgrade

+ const KeyPruningInterval

+ const PeerstoreKeyPrivateIPFailed

+ const RateLimiterSize

+ const RevocationCacheSize

+ const StateDirCredentialFile

+ const StateDirIdentityFile

+ const StoreFile

+ const VerificationCacheSize

+ var ConnsPerSourceIP = p2plimits.DefaultConnsPerSourceIP(ConnHighWaterMark)

+ var DefaultRenewalFallback = (api.BiscuitTokenTTL * 8) / 10

+ var ErrAuthRejected = errors.New("auth rejected")

+ var ErrFatalAuth = errors.New("fatal authentication error")

+ var ErrProviderNotGranted = errors.New("provider not granted the service")

+ var ErrProviderUnreachable = errors.New("provider unreachable")

+ var ErrStoreLocked = errors.New("another agentmesh-node instance is using this data directory")

+ var NewFileTokenSource = cpclient.NewFileTokenSource

+ var RenewalBuffer = api.BiscuitTokenTTL / 5

+ var RenewalThreshold = api.BiscuitTokenTTL / 4

+ func CallerBiscuitFromContext(ctx context.Context) []byte

+ func FetchControlPlaneInfo(ctx context.Context, controlPlaneURL string) (*api.ControlPlaneInfoResponse, error)

+ func FetchControlPlaneKeys(ctx context.Context, controlPlaneURL string, trusted []ed25519.PublicKey) ([]ed25519.PublicKey, error)

+ func GetDefaultDataDir() (string, error)

+ func GetOrGenerateKey(s *Store) crypto.PrivKey

+ func NewMCPHandler(node *AgentMeshNode) http.Handler

+ func NewMCPServer(node *AgentMeshNode) *mcp.Server

+ func NewUnauthenticatedMCPHandler(controlPlaneURL string) http.Handler

+ func NewUnauthenticatedMCPServer(controlPlaneURL string) *mcp.Server

+ func ProbeGCPMetadata(ctx context.Context, endpoint string, httpClient *http.Client) bool

+ func ReadStateDir(dir string) (privKey []byte, c *api.MemberCredential, err error)

+ func ReportNodeCatalog(ctx context.Context, controlPlaneURL string, biscuitToken []byte, ...) error

+ func SetAllowInsecureControlPlane(allow bool)

+ func StartMetricsServer(node *AgentMeshNode, addr string) (*http.Server, error)

+ func StartSidecarServer(node *AgentMeshNode, addr, socketPath, token, certFile, keyFile, caFile string) (*http.Server, error)

+ func StartUnauthSidecarServer(controlPlaneURL, addr, socketPath, certFile, keyFile string) (*http.Server, error)

+ func WithCallerBiscuit(ctx context.Context, biscuitBytes []byte) context.Context

+ func WriteStateDir(dir string, privKey []byte, c *api.MemberCredential) error

+ type A2AService struct

+ func (b *A2AService) Handler() http.Handler

+ func (b *A2AService) Info() *api.ServiceInfo

+ func (b *A2AService) Teardown() error

+ func (s *A2AService) Init(ctx context.Context) error

+ func (s *A2AService) Probe(ctx context.Context) error

+ type AgentMeshNode struct

+ AllowLoopback bool

+ BiscuitTimeout time.Duration

+ BoundHTTPAddr string

+ BoundSocketPath string

+ Directory Directory

+ Host host.Host

+ MeshPolicyMu sync.RWMutex

+ MeshPolicyRules []biscuit.Rule

+ PubSub *pubsub.PubSub

+ RouterPeerID peer.ID

+ Store *Store

+ func NewAgentMeshNode(cfg Options) (*AgentMeshNode, error)

+ func (n *AgentMeshNode) AttachedRouters() int

+ func (n *AgentMeshNode) Authorize(rawToken []byte, req RequestContext, pubKey ed25519.PublicKey) error

+ func (n *AgentMeshNode) CallMCPTool(ctx context.Context, targetPeer peer.ID, toolName string, params any, ...) (*mcp.CallToolResult, error)

+ func (n *AgentMeshNode) ConnectAndAuthWithRouter(ctx context.Context, addr multiaddr.Multiaddr) error

+ func (n *AgentMeshNode) ConnectMCPSession(ctx context.Context, targetPeer peer.ID, targetService string, ...) (*mcp.ClientSession, func(), error)

+ func (n *AgentMeshNode) DeviceLogin(ctx context.Context, deviceAuthURL, tokenURL, clientID, audience string, ...) (string, error)

+ func (n *AgentMeshNode) DiscoverEndpoints(ctx context.Context, issuerURL string) (tokenURL, authURL string, err error)

+ func (n *AgentMeshNode) DiscoverEndpointsWithDevice(ctx context.Context, issuerURL string) (*OIDCEndpoints, error)

+ func (n *AgentMeshNode) DiscoverRemoteServices(ctx context.Context, serviceType api.ServiceType, serviceName string) ([]*api.DiscoveredProvider, error)

+ func (n *AgentMeshNode) DiscoverRemoteServicesStream(ctx context.Context, serviceType api.ServiceType, serviceName string) (<-chan *api.DiscoveredProvider, error)

+ func (n *AgentMeshNode) DiscoverTokenURL(ctx context.Context, issuerURL string) (string, error)

+ func (n *AgentMeshNode) Enroll(ctx context.Context, controlPlaneURL string, jwt string) error

+ func (n *AgentMeshNode) EnrollBootstrap(ctx context.Context, controlPlaneURL string, bootstrapToken string) error

+ func (n *AgentMeshNode) ExchangeSubjectJWT(ctx context.Context, subjectToken, subjectTokenType string, ...) (*api.TokenExchangeResponse, error)

+ func (n *AgentMeshNode) FetchJWT(ctx context.Context, tokenURL, clientID, clientSecret string) (string, error)

+ func (n *AgentMeshNode) FindProvidersByName(ctx context.Context, serviceType api.ServiceType, serviceName string) ([]peer.AddrInfo, error)

+ func (n *AgentMeshNode) FindProvidersByType(ctx context.Context, serviceType api.ServiceType) ([]peer.AddrInfo, error)

+ func (n *AgentMeshNode) GetIdentity() []byte

+ func (n *AgentMeshNode) GetRequestIdentity(ctx context.Context) []byte

+ func (n *AgentMeshNode) HandleAuthHandshake(s network.Stream)

+ func (n *AgentMeshNode) HandleGoAway(ctx context.Context, s network.Stream)

+ func (n *AgentMeshNode) HandleMCPStream(s network.Stream, reqCtx RequestContext)

+ func (n *AgentMeshNode) InteractiveLogin(ctx context.Context, authURL, tokenURL, clientID, audience string, ...) (string, error)

+ func (n *AgentMeshNode) InteractiveLoginWithDeviceAuth(ctx context.Context, ...) (string, error)

+ func (n *AgentMeshNode) InteractiveLoginWithMode(ctx context.Context, ...) (string, error)

+ func (n *AgentMeshNode) IsBiscuitRevoked(b *biscuit.Biscuit) bool

+ func (n *AgentMeshNode) IsConnected() bool

+ func (n *AgentMeshNode) IsServiceRegistered(serviceName string) bool

+ func (n *AgentMeshNode) ListLocalServices(typeFilter api.ServiceType) []*api.ServiceInfo

+ func (n *AgentMeshNode) LoadControlPlaneURL() (string, error)

+ func (n *AgentMeshNode) LoadMeshConfig() ([]byte, []string, error)

+ func (n *AgentMeshNode) MintBorderJWT(ctx context.Context, callerBiscuit []byte, destination, audience string) (*api.STSTokenResponse, error)

+ func (n *AgentMeshNode) ReEnrollWithRefreshToken(ctx context.Context) error

+ func (n *AgentMeshNode) RefreshEnrollment(ctx context.Context) error

+ func (n *AgentMeshNode) RefreshJWT(ctx context.Context, tokenURL, clientID, clientSecret, refreshToken string) (string, string, error)

+ func (n *AgentMeshNode) RefreshRouters(ctx context.Context) error

+ func (n *AgentMeshNode) RegisterService(ctx context.Context, req *api.RegisterServiceRequest) error

+ func (n *AgentMeshNode) RegisterStaticServices(ctx context.Context, services []api.ServiceConfig) error

+ func (n *AgentMeshNode) RevokeBiscuitID(revocationID string, expiry time.Time)

+ func (n *AgentMeshNode) RevokeBiscuitToken(rawToken []byte, expiry time.Time) (string, error)

+ func (n *AgentMeshNode) SaveMeshConfig(pubKey []byte, addrs []string) error

+ func (n *AgentMeshNode) SetIdentityCache(b []byte)

+ func (n *AgentMeshNode) SetTokenSource(ts TokenSource)

+ func (n *AgentMeshNode) Start(ctx context.Context) error

+ func (n *AgentMeshNode) StartIngressServer(ctx context.Context) error

+ func (n *AgentMeshNode) StartRenewalLoop(ctx context.Context, issuerURL, clientID, clientSecret, jwtPath string)

+ func (n *AgentMeshNode) StartRenewalLoopWithSource(ctx context.Context, src TokenSource)

+ func (n *AgentMeshNode) SyncControlPlane(ctx context.Context) error

+ func (n *AgentMeshNode) Teardown() error

+ func (n *AgentMeshNode) TopUp(ctx context.Context) int

+ func (n *AgentMeshNode) UnregisterService(ctx context.Context, serviceName string) error

+ func (n *AgentMeshNode) UpdateRelays(addrs []multiaddr.Multiaddr)

+ func (n *AgentMeshNode) VerifyBiscuitToken(biscuitBytes []byte, reqCtx RequestContext) error

+ func (n *AgentMeshNode) VerifyLocalBiscuit(rawToken []byte) (*identity.VerifiedBiscuitClaims, error)

+ func (n *AgentMeshNode) VerifyPeerLabels(ctx context.Context, peerID peer.ID, required map[string]string) error

+ func (n *AgentMeshNode) VerifyProvider(ctx context.Context, peerID peer.ID, required map[string]string, ...) error

+ func (n *AgentMeshNode) WantRouters() int

+ func (n *AgentMeshNode) WithBiscuitAuth(next func(network.Stream, RequestContext)) network.StreamHandler

+ type AuthMode string

+ const AuthModeAuto

+ const AuthModeBrowser

+ const AuthModeDevice

+ const AuthModeOOB

+ func ParseAuthMode(s string) (AuthMode, error)

+ type CallRemoteToolParams struct

+ Arguments map[string]any

+ PeerID string

+ RequiredLabels string

+ ToolName string

+ type ClientCredentialsTokenSource struct

+ func NewClientCredentialsTokenSource(n *AgentMeshNode, issuerURL, clientID, clientSecret string) *ClientCredentialsTokenSource

+ func (s *ClientCredentialsTokenSource) FetchToken(ctx context.Context) (string, error)

+ type CloudTokenExchanger = credprovider.Exchanger

+ type DescribeRemoteToolParams struct

+ PeerID string

+ ToolName string

+ type Directory interface

+ FindPeer func(ctx context.Context, p peer.ID) (peer.AddrInfo, error)

+ FindProviders func(ctx context.Context, key []byte, limit int) ([]peer.AddrInfo, error)

+ Provide func(ctx context.Context, key []byte, service string) error

+ Withdraw func(ctx context.Context, key []byte) error

+ type DiscoverRemoteServicesParams struct

+ Limit int

+ Name string

+ Offset int

+ Type string

+ type EgressFacts struct

+ Host string

+ Port int

+ type EgressService struct

+ func (s *EgressService) Handler() http.Handler

+ func (s *EgressService) Info() *api.ServiceInfo

+ func (s *EgressService) Init(ctx context.Context) error

+ func (s *EgressService) ServeTunnel(ctx context.Context, w http.ResponseWriter, r *http.Request, reqPort int)

+ func (s *EgressService) SetExchanger(ex CloudTokenExchanger)

+ func (s *EgressService) Teardown() error

+ type FileTokenSource = cpclient.FileTokenSource

+ type FindRemoteToolsParams struct

+ Intent string

+ PeerID string

+ ServiceName string

+ ToolName string

+ type GCPMetadataTokenSource struct

+ func NewGCPMetadataTokenSource(audience, endpoint string, httpClient *http.Client) *GCPMetadataTokenSource

+ func (s *GCPMetadataTokenSource) FetchToken(ctx context.Context) (string, error)

+ type GetMeshInfoParams struct

+ type HTTPRequestFacts struct

+ Method string

+ Path string

+ type InferenceEngine interface

+ Models func(ctx context.Context) ([]string, error)

+ type InferenceService struct

+ func (b *InferenceService) Handler() http.Handler

+ func (b *InferenceService) Info() *api.ServiceInfo

+ func (b *InferenceService) Teardown() error

+ func (s *InferenceService) ActiveRequests() uint32

+ func (s *InferenceService) Init(ctx context.Context) error

+ func (s *InferenceService) Models(ctx context.Context) ([]string, error)

+ type ListLocalServicesParams struct

+ Type string

+ type MCPService struct

+ func (b *MCPService) Handler() http.Handler

+ func (b *MCPService) Info() *api.ServiceInfo

+ func (m *MCPService) HandleStreamPassThrough(s network.Stream, reqCtx RequestContext)

+ func (m *MCPService) Init(ctx context.Context) error

+ func (m *MCPService) Probe(ctx context.Context) error

+ func (m *MCPService) Teardown() error

+ func (m *MCPService) Tools(ctx context.Context) ([]string, error)

+ type NodeConfigComplete struct

+ Checks []biscuit.Check

+ EgressRequireLabels map[string]string

+ Labels map[string]string

+ Policies []biscuit.Policy

+ Rules []biscuit.Rule

+ Services []api.ServiceConfig

+ func CompleteNodeConfig(config api.NodeConfig) (*NodeConfigComplete, error)

+ func LoadNodeConfig(path string) (*NodeConfigComplete, error)

+ type OIDCEndpoints struct

+ AuthURL string

+ DeviceAuthURL string

+ TokenURL string

+ type Options struct

+ AllowLoopback bool

+ AnnouncePrivateAddrs *bool

+ AutoRelayBackoff time.Duration

+ AutoRelayBootDelay time.Duration

+ AutoRelayMinInterval time.Duration

+ BackendProbeTimeout time.Duration

+ BiscuitTimeout time.Duration

+ CatalogReportInitialDelay time.Duration

+ CatalogReportInterval time.Duration

+ ControlPlanePubKey ed25519.PublicKey

+ ControlPlaneSyncInterval time.Duration

+ ControlPlaneSyncJitter time.Duration

+ DHTLookupLimit int

+ DiscoveryConcurrency int

+ DiscoveryInterval string

+ EnableRelay bool

+ KeyGracePeriod time.Duration

+ ListenAddrs []string

+ MonitorBootstrap time.Duration

+ MonitorInterval time.Duration

+ NodeConfig *NodeConfigComplete

+ PrivKey crypto.PrivKey

+ Reachability Reachability

+ RequiredRole string

+ RouterAddrs []multiaddr.Multiaddr

+ RouterAuthAttempts int

+ RouterConnectTimeout time.Duration

+ RouterPrefer map[string]string

+ RouterRedialAttempts int

+ RouterRedialDelay time.Duration

+ RouterSelector map[string]string

+ RouterShunDuration time.Duration

+ Routers int

+ SecretsDir string

+ Store *Store

+ TokenSource TokenSource

+ func (o *Options) Default()

+ func (o *Options) Validate() error

+ type Reachability string

+ const ReachabilityAuto

+ const ReachabilityPrivate

+ type RefreshError struct

+ Message string

+ StatusCode int

+ func (e *RefreshError) Error() string

+ type RefreshTokenSource struct

+ func NewRefreshTokenSource(n *AgentMeshNode, clientSecret string) *RefreshTokenSource

+ func (s *RefreshTokenSource) FetchToken(ctx context.Context) (string, error)

+ type RequestContext struct

+ AllowMCPStreamInit bool

+ Egress *EgressFacts

+ Group string

+ HTTP *HTTPRequestFacts

+ Local bool

+ MCPTool string

+ PeerID peer.ID

+ Protocol string

+ Target string

+ TaskRules []*api.TaskAuthorizationRule

+ User string

+ type Service interface

+ Handler func() http.Handler

+ Info func() *api.ServiceInfo

+ Init func(ctx context.Context) error

+ Teardown func() error

+ func NewServiceFromRequest(req *api.RegisterServiceRequest) (Service, error)

+ type ServiceRegistry struct

+ func NewServiceRegistry(d directoryProvider, backendProbeTimeout time.Duration) *ServiceRegistry

+ func (r *ServiceRegistry) Get(name string) (Service, bool)

+ func (r *ServiceRegistry) GetTyped(t api.ServiceType, name string) (Service, bool)

+ func (r *ServiceRegistry) List(typeFilter api.ServiceType) []*api.ServiceInfo

+ func (r *ServiceRegistry) Register(ctx context.Context, svc Service) error

+ func (r *ServiceRegistry) ReprovideAll(ctx context.Context) int

+ func (r *ServiceRegistry) TeardownAll()

+ func (r *ServiceRegistry) Unregister(ctx context.Context, name string) error

+ func (r *ServiceRegistry) WithdrawAll(ctx context.Context)

+ type StdioBridge struct

+ func (b *StdioBridge) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ func (b *StdioBridge) Start()

+ type Store struct

+ func NewStore(dir string) (*Store, error)

+ func (s *Store) Close() error

+ func (s *Store) Credential() (*api.MemberCredential, error)

+ func (s *Store) LoadControlPlaneURL() (string, error)

+ func (s *Store) LoadIdentity() ([]byte, error)

+ func (s *Store) LoadIdentityExpiration() (int64, error)

+ func (s *Store) LoadIdentityKeySet() ([]ed25519.PublicKey, error)

+ func (s *Store) LoadKey() ([]byte, error)

+ func (s *Store) LoadMeshConfig() ([]byte, []string, error)

+ func (s *Store) LoadOIDCConfig() (string, string, string, error)

+ func (s *Store) LoadRefreshToken() (string, error)

+ func (s *Store) LoadTrustedKeys() ([]TrustedKey, error)

+ func (s *Store) ResetMeshIdentity() error

+ func (s *Store) SaveControlPlaneURL(url string) error

+ func (s *Store) SaveIdentity(biscuit []byte) error

+ func (s *Store) SaveIdentityExpiration(exp int64) error

+ func (s *Store) SaveIdentityKeySet(keys []ed25519.PublicKey) error

+ func (s *Store) SaveKey(key []byte) error

+ func (s *Store) SaveMeshConfig(pubKey []byte, addrs []string) error

+ func (s *Store) SaveOIDCConfig(issuer, clientID, audience string) error

+ func (s *Store) SaveRefreshToken(token string) error

+ func (s *Store) SaveTrustedKeys(keys []TrustedKey) error

+ func (s *Store) SetCredential(c *api.MemberCredential) error

+ type StreamTransport struct

+ func NewStreamTransport(s network.Stream) *StreamTransport

+ func (t *StreamTransport) Close() error

+ func (t *StreamTransport) Connect(ctx context.Context) (mcp.Connection, error)

+ func (t *StreamTransport) Read(ctx context.Context) (jsonrpc.Message, error)

+ func (t *StreamTransport) Send(data []byte) error

+ func (t *StreamTransport) SessionID() string

+ func (t *StreamTransport) Write(ctx context.Context, msg jsonrpc.Message) error

+ type TokenSource = cpclient.TokenSource

+ func ResolveTokenSource(ctx context.Context, cfg TokenSourceConfig) (TokenSource, bool, error)

+ type TokenSourceConfig struct

+ Audience string

+ ClientID string

+ ClientSecret string

+ CloudProvider string

+ HTTPClient *http.Client

+ IssuerURL string

+ JWTPath string

+ MetadataEndpoint string

+ Node *AgentMeshNode

+ type TrustedKey struct

+ Key ed25519.PublicKey

+ ReceivedAt time.Time

v0.1.0-rc.10

Oct 14, 2026

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL