← Documentation

Agent Mesh: Connecting Agents, Tools and Apps

Once agents call other agents and the tools they use, each call is a handoff of data and of instructions. The Agent Mesh puts one control point on every handoff: a rule for each caller and target, data classes passed, masked or blocked on the way in and on the way back, a signed token that carries the person and the chain's restrictions to the next hop, limits that stop a runaway chain, and a trace of every hop. Agents keep speaking A2A and MCP; only the address they call changes.

Before you start

  • Agents that speak A2A (1.0, or the 0.3 method names), and/or MCP servers over Streamable HTTP.
  • Agents reachable from DBShifts over HTTPS, or a machine inside your network for the self-hosted proxy.
  • A view of which agents should call which: the mesh is default-deny.

Steps

  1. 1

    Open Agent Mesh (pick it when you sign in, or from the Agent Gateway sidebar) and register your A2A agents (the mesh reads their cards), MCP tool servers and the apps that start conversations

  2. 2

    Copy each agent's and app's mesh key: it is shown once

  3. 3

    Write rules in the Rules matrix: each caller and target pair, its data actions, injection shield, approval, and for tool servers the allowed tools and argument rules

  4. 4

    Point callers at the mesh: send Authorization: Bearer msk_… to the target's mesh address; apps you allow may name the person with X-Mesh-User

  5. 5

    When an agent calls onward while handling a call, send the X-Mesh-Token it received back as X-Mesh-Chain

  6. 6

    Add the verify library (Python or TypeScript) to each agent and tool server, then use 'Check it refuses unsigned calls'

  7. 7

    Watch Overview and Traces, and set data defaults and chain limits in Settings. Agents inside your network go behind a proxy: dbshift mesh-proxy run

What goes wrong

Forgetting X-Mesh-Chain starts a new chain

Without it the onward call looks like a fresh conversation: the person who started it is lost, an earlier hop's masking no longer applies, and loop limits cannot see the chain. Pass the token you were called with on every onward call.

An agent without the verify library can be called around the mesh

The mesh can only govern calls that go through it. Until an agent checks X-Mesh-Token, anyone who can reach it directly can skip every rule. The member page shows whether it refuses unsigned calls.

Masking inside a PDF means refusing it

Plain-text files are rewritten with the sensitive spans masked. A PDF or HTML file cannot be edited in place, so if a rule says to mask something found inside one, the call is refused. Send text formats when data has to pass masked.

Push notifications are refused

They would have the agent call an address outside the mesh later. Poll the task with GetTask or use streaming instead.

Next

Agent Gateway: Connecting an AI Agent

Give an AI agent a scoped, audited door into a database — structured tools instead of raw SQL, with writes gated behind approval.

Data Console: Browsing a Database Safely

Give people access to production data without giving them production credentials, with PII masked unless explicitly granted.