┌┬┐┌─┐┌─┐┬ ┬┌─┐
│││├┤ └─┐├─┤  │   agents ──▶ mesh7 ──▶ tools
┴ ┴└─┘└─┘┴ ┴  ┴   policy · approval · trace

flux7-mesh

A governance proxy between AI agents and their tools. Policy, human approval and signed traces on every tool call, without changing agent code.

One Go binary, one YAML file, fail closed. Works with Claude Code, Cursor, Anthropic Managed Agents, the Agent SDK, LangChain, or anything that calls tools over MCP, HTTP or a CLI.

Full documentation: docs.flux7.art/mesh7

What it does

Related MCP server: agent-sudo-mcp

How it sits

flowchart LR
    A["Agents<br/>Claude Code · Cursor · Agent SDK<br/>LangChain · Managed Agents"]
    M["mesh7<br/>identity → rate limit → policy<br/>→ approval → forward → trace"]
    T["Tools<br/>MCP servers · REST APIs (OpenAPI)<br/>CLI binaries"]
    O["Traces<br/>JSONL · OTLP"]
    A -- "MCP stdio / HTTP · HTTP" --> M --> T
    M --> O

Agents see an ordinary tool surface. The operator sees every decision.

Install

curl -fsSL https://raw.githubusercontent.com/KTCrisis/flux7-mesh/main/install.sh | sh

Installs mesh7 (the proxy) and mesh (the approval CLI) in ~/.local/bin. Add -s -- --service to also run mesh7 as a systemd user service, or --system where the user manager is unavailable (some WSL setups). By hand:

curl -L https://github.com/KTCrisis/flux7-mesh/releases/latest/download/mesh7_linux_amd64.tar.gz | tar xz
sudo mv mesh7 mesh /usr/local/bin/

Other targets: mesh7_darwin_arm64.tar.gz, mesh7_linux_arm64.tar.gz, mesh7_windows_amd64.zip… (releases). From source (Go 1.24+): make install. Python SDK and the Claude Code harness hook: pip install flux7-mesh (Python SDK).

Quick start

# config.yaml
mcp_servers:
  - name: filesystem
    transport: stdio
    command: npx
    args: ["-y", "@modelcontextprotocol/server-filesystem", "/home/me/projects"]

policies:
  - name: claude
    agent: "claude"
    rules:
      - tools: ["filesystem.read_*", "filesystem.list_*"]
        action: allow
      - tools: ["filesystem.write_file", "filesystem.edit_file"]
        action: human_approval
  - name: default
    agent: "*"
    rules:
      - tools: ["*"]
        action: deny

mesh7 discover --config config.yaml --generate-policy   # or start from a commented draft
claude mcp add mesh7 -- mesh7 --mcp --config config.yaml

Restart Claude Code: the tools are there, the rules apply, every call is traced. When a call needs approval, the agent relays an id: run mesh approve <id> (or use the console), and its retry of the same call goes through. For a long-running daemon, OpenAPI and CLI sources, and every YAML key, see Getting started and Configuration.

Documentation

• Configuration · Writing policies · Tool classification

• Approval flow · CLI tools · Supervisor protocol

• JWT authentication · Control-plane auth · Agent security

• Trace integrity · Observability · Deployment modes

• Reference: commands, flags, HTTP API, project layout, tests

Next

1. Policy on the delegation: rules on the pair this agent, for this user, from the identity the token already carries.

2. Conditions v2: AND/OR, claims from the token, parsed arguments instead of text matching.

3. Policy on content: a local classifier annotates arguments and results (indirect injection first); the condition engine decides.

Shipped features are listed per version in the releases.

Why a mesh

Envoy sits between services and adds identity, policy and telemetry without changing their code. mesh7 does the same between agents and their tools: invisible to the agent, visible to the operator.

License

Apache 2.0