Security¶

MCP Mesh provides three layers of security for production agent deployments:

flowchart TB
    L3["<b>Layer 3: Authorization</b><br/>WHO can do WHAT<br/>Header propagation + application-layer auth"]
    L2["<b>Layer 2: Agent-to-Agent mTLS</b><br/>Every inter-agent call is mutually authenticated"]
    L1["<b>Layer 1: Registration Trust</b><br/>Identity verification before joining the mesh"]

    L3 --- L2 --- L1

    style L3 fill:#7ba7cc,color:#fff,stroke:#6b97bc
    style L2 fill:#6baa8e,color:#fff,stroke:#5b9a7e
    style L1 fill:#cca76b,color:#fff,stroke:#bc975b

Security is opt-in — local development works with no TLS by default. You can incrementally adopt stricter modes as you move toward production.

TLS Modes¶

Quick Start¶

# Zero-config TLS (auto-generates CA + certs)
meshctl start --registry-only --tls-auto -d
meshctl start my_agent.py --tls-auto

meshctl start --registry-only -d \
  --env MCP_MESH_TLS_MODE=strict \
  --env MCP_MESH_TLS_CERT=/etc/certs/registry.pem \
  --env MCP_MESH_TLS_KEY=/etc/certs/registry-key.pem

meshctl start my_agent.py \
  --env MCP_MESH_TLS_MODE=strict \
  --env MCP_MESH_TLS_PROVIDER=vault \
  --env MCP_MESH_VAULT_ADDR=https://vault:8200 \
  --env MCP_MESH_VAULT_PKI_PATH=pki_int/issue/mesh-agent \
  --env VAULT_TOKEN=s.xxxxx

meshctl start my_agent.py \
  --env MCP_MESH_TLS_MODE=strict \
  --env MCP_MESH_TLS_PROVIDER=spire \
  --env MCP_MESH_SPIRE_SOCKET=/run/spire/agent/sockets/agent.sock

Sections¶