bastionmesh
gateRuntime A2A security gateway
A security gateway between A2A agents: scans what peer agents send back for prompt injection, catches an agent relaying an injected payload to another, and stops runaway delegation.
pip install bastionmesh The A2A sibling of bastiongate (MCP). Detectors ship in warn (shadow) mode; policy rules, caps and cycles always enforce. Composes with agentgateway: keep it at the edge and run the mesh behind it.
What it does
- One proxy in front of every peer agent (A2A v1.0 and v0.3), so it sees each agent-to-agent hop
- Scans peer replies (task artifacts, status, history, streamed chunks) for injection, and flags an agent passing a payload on to another peer
- Pins and rewrites agent cards: bastionsupply checks at startup, drift blocked, callers can only reach the mesh endpoint
- Caps delegation depth, blocks A → B → A cycles and fan-out without any change to the agents; per-caller keys, peer and method allow lists, webhook allow list
- Decodes encoded payloads (base64, hex, binary...) in replies, delegations and relays, so an encoded injection cannot hop between agents unseen
- Optional bastiontrace v3 trace of every hop, so a cascade can be reconstructed after the fact
Quickstart
bastionmesh demo # offline replay: a peer injects, the host relays it
bastionmesh check --policy mesh.yaml --lock
bastionmesh run --policy mesh.yaml --log mesh.jsonl
Version 0.2.0 · MIT