How google/sam works
SAM is a private network for AI agents: operators enroll nodes, the control plane verifies identity and issues credentials, and nodes connect through a router to discover and invoke policy-authorized services. Nodes also publish local tools and models, expose MCP and OpenAI-compatible interfaces to agents, and support direct connections or relay. The map preserves control-plane administration, persistence, standalone deployment, and sandboxing. README establishes the product workflow; sampled source supports selected control-plane, inference, console, and sandbox details, so uncertain wiring is omitted.
Main entry points: node.go Mesh node · server.go Control plane · standalone.go Standalone server · router.go Mesh router
Components 23
Identity and policy
- Node CLI
cmd/sam-node/main.go - Node enrollment
internal/node/enroll.go - Control plane
internal/controlplane/server.go - Identity verification
internal/identity/oidc.go - Policy model
api/policy.go - Control-plane state
internal/storage/sql_store.go
Mesh runtime
- Mesh node
internal/node/node.go - Control-plane sync
internal/node/controlplane_sync.go - Service discovery
internal/node/discovery/discovery.go - Mesh router
internal/router/router.go - Published services
internal/node/service_registry.go
Agent access
- MCP access
internal/node/mcp_service.go - Model inference
internal/node/inference_service.go - OpenAI facade
internal/node/openai_facade.go - Local backends
internal/node/backend_target.go - Client SDKs
sdk/js/src/index.ts
Operations and deployment
- Standalone server
internal/standalone/standalone.go - Web console
internal/console/server.go - Console UI
internal/console/public/app.js - Agent sandbox
internal/sambox/connect.go - Public tunnel
internal/tunnel/tunnel.go
Other components
- Operator
- Agent
Connections 30
- Operator → Node CLI: starts enrollment
- Node CLI → Node enrollment: initiates enrollment
- Node enrollment → Control plane: requests credential
- Control plane → Identity verification: verifies identity
- Control plane → Control-plane state: reads and writes
- Control plane → Policy model: manages policy
- Node CLI → Mesh node: starts node
- Mesh node → Control-plane sync: synchronizes config
- Control-plane sync → Control plane: fetches node config
- Mesh node → Mesh router: connects to mesh
- Mesh node → Service discovery: announces services
- Service discovery → Mesh router: publishes discovery
- Mesh node → Published services: registers services
- Agent → MCP access: uses local tools
- MCP access → Service discovery: finds mesh services
- MCP access → Mesh router: calls remote services
- Agent → OpenAI facade: requests models
- OpenAI facade → Model inference: routes inference
- Model inference → Local backends: proxies requests
- Published services → Local backends: serves configured backends
- Agent → Client SDKs: integrates client
- Client SDKs → Mesh node: uses mesh APIs
- Operator → Standalone server: runs deployment
- Standalone server → Control plane: starts control plane
- Standalone server → Mesh router: starts router
- Operator → Console UI: administers mesh
- Console UI → Web console: calls console routes
- Web console → Control plane: queries control-plane info
- Mesh node → Agent sandbox: connects sandbox
- Standalone server → Public tunnel: opens public access