Agent Mesh
Govern how your AI agents talk to each other.
Agents now call other agents and the tools they use. A customer's card number can travel three hops, an injected instruction can ride along, two agents can loop all night, and nobody can say who asked. Agent Mesh sits between them: nothing calls anything without a rule, sensitive data is masked on every handoff, the person who started the chain travels with it, and runaway chains are stopped.
Agents calling agents directly
Every agent holds the others' credentials and trusts whatever it is sent. Data goes wherever the last model decided, and there is no record of who started it.
Hand-built checks in every agent
Each team writes its own auth, masking and logging, slightly differently, and rewrites it for every new agent. Nobody can see the whole conversation.
What it does
Default-deny between agents
Nothing calls anything until you write a rule for that pair. Without one, a caller cannot even read the other agent's card.
Data masked on every handoff
Emails, phone numbers, card numbers, SSNs, IPs, Aadhaar and PAN are found by fixed patterns, and structured data by field name. Each pair passes, masks or blocks each class. Fields holding passwords, tokens and API keys are blocked by default.
Rules only get stricter along a chain
If the first hop masked card numbers, no agent further down can unmask them. Every hop's rules travel with the chain, and the strictest one wins.
The person travels with the chain
Each call carries a signed token naming who started the chain and every agent that acted since. An agent three hops away still knows it is working for ann@acme.io.
Injected instructions stopped, both ways
Messages, answers, tool results, error text, tool descriptions and agent cards are scanned for text aimed at a model. By default the matched text is removed before the next agent reads it.
A firewall for MCP tools
Allow and deny tools by name pattern, and set rules on argument values, such as repo must equal acme/web or amount at most 500. A refused call comes back as a tool error the model can read, and the tool list shows only what is allowed.
Approvals for risky calls
Mark a pair as needing approval and the call waits as a task the caller can poll. The approver reads the message exactly as the agent will receive it, already masked.
Traces of every hop
Each chain is a tree of hops with timings, refusals and what was masked. The chain id is also the W3C trace id, so it lines up with your own tracing. Message content is never stored in the log.
Agents can refuse calls that skip the mesh
A small verify library (Python or TypeScript) checks the mesh's signature, that the call was meant for this agent, that it is fresh and that it was signed for this exact body. One click checks that an agent really refuses unsigned calls.
When a chain goes wrong
Rules decide who may talk. These are for the day an agent gets stuck, gets steered, or has to be stopped now.
Loop and runaway stops
A chain stops when it gets too deep, when an agent is called again in the same chain (A → B → A), when the same request repeats, when calls fan out too fast, or when it passes its call budget, reported cost or lifetime. You set the limits.
Kill switch
Pause one agent and every call to it or from it is refused from the next request (within seconds behind a self-hosted proxy). Resume is one click; its rules and key stay as they were.
Auto-quarantine
A caller that keeps getting refused (no rule, blocked data, loops, budget stops) is paused by itself after the number of refusals you set inside a window. Refusals caused by what an agent sent back do not count against the caller.
Stop one chain
See a conversation going wrong in the traces? Stop that chain: every further call in it is refused, while the agents keep serving everything else.
How it works
Register
Add your A2A agents (the mesh reads their cards), your MCP tool servers and the apps that start conversations.
Write rules
Pick who may call whom, what data may cross each pair, which tools, and which calls need a person.
Point agents at the mesh
Each agent and app gets a mesh key and calls other agents at their mesh address instead of directly.
Lock the back door
Add the verify library to each agent so a call that goes around the mesh is refused.
Standard protocols, no SDK to adopt
Agents keep speaking A2A and MCP exactly as they do now; only the address changes. Streaming works, and a long answer split across many events is still masked as a whole.
# An app or agent calls another agent through the mesh POST https://dbshifts.com/api/v1/mesh/a/<agent id> Authorization: Bearer msk_… # its own mesh key X-Mesh-User: ann@acme.io # apps you allow: who this is for X-Mesh-Chain: <the X-Mesh-Token it was called with, if any>
# Inside the agent: refuse calls that did not come through the mesh
from dbshifts_mesh import MeshVerifier, MeshMiddleware
verifier = MeshVerifier("https://dbshifts.com/api/v1/mesh/.well-known/jwks.json",
member_id="<this agent's id>")
app = MeshMiddleware(app, verifier) # any ASGI app, including the A2A SDK'sAgents inside your network
Run dbshift mesh-proxy run next to them. Their addresses and credentials stay in its config file, it signs with its own key, and it takes rules, keys and approval decisions from DBShifts every few seconds while reporting every call to your traces and live map. Revoke its key and it refuses everything.
Works with Agent Gateway
Agent Gateway governs what agents read from your databases. Agent Mesh governs what they then say to each other and to the tools they call. Use one or both on the same account.
How the gateway works →Frequently asked questions
What is an agent mesh?
An agent mesh is the layer AI agents go through when they call each other and the tools they use. Instead of every agent holding every other agent's credentials and trusting what it is sent, each call passes one place that decides whether this pair may talk, what data may cross, and records what happened. DBShifts Agent Mesh does this for A2A agents and MCP tool servers.
Does Agent Mesh support A2A (Agent2Agent)?
Yes. It speaks A2A 1.0 over JSON-RPC, accepts the 0.3 method names, and rewrites each agent's card so callers find the agent through the mesh. Sending, streaming, getting, listing and canceling tasks all work through it. Push notifications are refused, because they would have an agent call an address outside the mesh.
How do I stop one AI agent leaking customer data to another?
Put a rule on that pair. Each data class (email, phone, card, SSN, IP, Aadhaar, PAN, and classes you define for your own field names) is passed, masked or blocked on that edge. Masking happens before the message leaves the mesh, in both directions, inside structured data and plain-text files too. Along a chain the rules only tighten, so a later hop cannot undo an earlier mask.
How do I stop AI agents from looping or running up costs?
Set limits per chain: how deep it may go, how many times an agent may be called again, how often the same request may repeat, how many calls per 10 seconds, how many calls in total, how much reported cost (agents report it in an X-Mesh-Cost-Usd header) and how long it may run. A chain that crosses one is stopped and recorded with the reason.
How do I control which MCP tools an agent can call?
Allow and deny tools by name pattern for each caller and tool server, and add rules on argument values: equals, one of, prefix, glob pattern, at most or at least. Tools the caller may not use are removed from the tool list, a refused call is answered as a tool error, and resources and prompts stay off until you allow them.
What about instructions hidden in tool descriptions or agent cards?
They are scanned like any other text the next model reads. Tool, resource and prompt descriptions, agent card descriptions, answers, tool results and error messages all pass the same injection shield. Detection uses fixed rules, so it covers known shapes of attack rather than every possible wording.
Can an agent go around the mesh?
Only if the agent accepts unsigned calls. Every call the mesh forwards carries a signed token bound to that agent and to the exact request body. Add the verify library and the agent refuses anything without one. The member page has a check that sends an unsigned call and shows whether it was refused.
Does the mesh store what agents say to each other?
No. Each call is recorded with who called whom, for whom, timings, which data classes were seen and masked, and why anything was refused, never the message. The one exception is a call held for approval: its message, already masked, is kept until someone decides, at most 7 days, so it can be forwarded.
Can the agents stay inside my network?
Yes. Run the self-hosted proxy next to them with dbshift mesh-proxy run. Their addresses and credentials stay in its config file, it signs with its own key, and it takes its rules, keys and approval decisions from DBShifts every few seconds while reporting every call back. If its key is revoked it refuses everything.
Is AI used to make the mesh's decisions?
No. Rules, data classes, masking, the injection shield and the loop limits are all fixed, deterministic checks: the same call gets the same answer every time, and none of it is sent to a model.
How is Agent Mesh different from Agent Gateway?
Agent Gateway is the door between AI agents and your databases: scoped tokens, table and column rules, masked rows. Agent Mesh governs what happens between agents and the tools they call. They work together: an agent can read through a gateway and call other agents through the mesh.
Questions teams ask before agents work together
Short, straight answers. See them all.
Let agents work together without losing track of the data.
Free to start, no card. Default-deny, masked on every handoff, every hop traced.