AMP — Agent Mesh Protocol

An open protocol for agent-to-agent communication — trust, delegation and compliance built in, and interoperable with A2A, PACT and MCP out of the box. ampro is the Python reference implementation; the protocol itself is language-agnostic.

Website: ampro.sh · Spec: WIRE-BINDING.md · Changelog: CHANGELOG.md

⚠️ Pre-1.0. The wire format is stabilising toward 1.0 but may still evolve between minor versions. Receivers MUST ignore unknown fields. See RELEASING.md for the stability contract.

Why?

Agents increasingly talk to other agents — across frameworks, companies and trust boundaries. The industry is converging on A2A as the transport, PACT for personal agents acting for users, and MCP for tools. What none of them standardise is the hard part of a real mesh: who may act for whom, how far a delegation reaches, what it may spend, and which data may cross which border.

AMP adds exactly that, and speaks the other protocols natively, so you don't have to choose:

• One agent, every protocol. Write handlers once; serve them over AMP, A2A 1.0, PACT and MCP from the same process.
• Trust you can verify. RFC 9421 signed messages, DID/JWT/API-key/mTLS authentication, four trust tiers, key revocation.
• Delegation with limits. Signed multi-hop delegation chains with scope narrowing, depth, fan-out and budget enforcement.
• Compliance primitives. PII classification, jurisdiction and data residency, erasure propagation, audit attestation.

AMP rides on top of A2A rather than competing with it: AMP agents publish an A2A Agent Card, accept A2A calls, and carry AMP's delegation and compliance data through A2A's extension mechanism (https://github.com/agentmeshpro/agent-mesh-protocol/ext/amp/v1). Plain A2A clients simply ignore it.

Install

pip install "ampro[all]"

Extras: server (uvicorn), a2a / pact (JWT verification), mcp, flask, conformance (JSON Schema validation in ampro-conformance), all. The core package depends only on pydantic, cryptography, base58 and httpx.

30-Second Tour — AMPI

AMPI (Agent Message Processing Interface) is the declarative framework for building an agent. Think ASGI, but for agents.

# agent.py
from ampro.ampi.app import AgentApp

agent = AgentApp(
    agent_id="agent://my-bot.example.com",
    endpoint="https://my-bot.example.com/agent/message",
)

@agent.on("task.create")
async def handle(msg, ctx):
    return {"echo": msg.body["description"], "via": ctx.protocol, "trust": ctx.trust_tier.value}

@agent.tool("add", description="Add two numbers")
def add(a: int, b: int) -> dict:
    return {"sum": a + b}

Serve it over every protocol at once:

ampro-server agent:agent --port 8000 --protocols amp,a2a,mcp

Test without a server:

from ampro.server.test import TestServer

response = await TestServer(agent).send(incoming_message)

The server binds to 127.0.0.1 by default. Before exposing it, read Production deployment.

Interoperability

Calling other agents:

from ampro.interop.a2a import A2AClient

async with A2AClient("https://agent.example.com/.well-known/agent-card.json") as a2a:
    reply = await a2a.send_message("Where is my order?")

What's in the box

Production deployment

The reference server runs the full request pipeline of WIRE-BINDING Appendix D: size limit → authentication → rate limit → validation → sender binding → recipient check → loop detection → caller-scoped dedup → concurrency limit → handler timeout. Exception details never reach clients.

from ampro.server import AgentServer
from ampro.server.auth import SignatureAuthenticator
from ampro.server.security import SecurityPolicy

server = AgentServer.from_app(
    agent,
    security=SecurityPolicy.production([
        SignatureAuthenticator("https://my-bot.example.com", key_owner=lookup_agent_for_key),
    ]),
)
asgi_app = server.asgi()   # run with any ASGI server, behind TLS

Checklist:

• Require authentication (SecurityPolicy.production, require_auth=True on the A2A/MCP adapters) before binding beyond loopback.
• Register your key infrastructure: register_public_key_resolver, a RevocationStore, and API keys via register_api_key.
• Share state across workers: every store (replay caches, dedup, rate limits, tasks, contexts, sessions, grants) is a small protocol with a bounded in-memory default that is correct only for one process. With more than one worker, call ampro.stores.redis.configure(server, url="redis://...") (or run ampro-server --store redis://...). See docs/SCALING.md for the full inventory, readiness and graceful shutdown, and Kubernetes / gunicorn deployment.
• Terminate TLS in front of the server, and set public_url so signatures and Agent Cards use your external origin.
• Read docs/SECURITY-MODEL.md: what the protocol guarantees, and what it leaves to you.

Choose your path

Building an agent → the tour above, then examples/ (41-45 AMPI, 46 A2A, 47 MCP, 48 PACT) and docs/ARCHITECTURE.md.

Implementing AMP in another language → see below.

Evaluating the protocol → docs/ARCHITECTURE.md, docs/WIRE-BINDING.md, docs/SECURITY-MODEL.md, and the audit retrospectives SECURITY-AUDIT.md / SECURITY-AUDIT-V2.md.

Contributing → CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md.

Implementing AMP in another language

AMP is an open protocol. Nothing in it requires Python, and everything you need to build and verify an implementation is published here in a language-neutral form:

pip install "ampro[conformance]"
ampro-conformance --url https://your-agent.example.com --level 1
ampro-conformance --url https://your-agent.example.com \
    --signing-key key.pem --keyid "agent://your-agent.example.com#key-1"   # + RFC 9421 checks

The schemas and registries are generated from the reference implementation (python scripts/generate_spec.py), and CI fails on any drift. To extend AMP without forking, follow docs/EXTENSIONS.md. Changes to the protocol itself follow GOVERNANCE.md.

Protocol vs platform

AMP specifies the wire contract and nothing else. How an agent is — how you create, configure, operate and observe it — is the host platform's job.

Security

Please do not open public issues for vulnerabilities. Report them privately through GitHub private vulnerability reporting or by email to vedant@catlyst.com. See SECURITY.md.

License

Apache License 2.0. Copyright 2026 AMP Contributors.