aojea · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026
@@ -19,7 +19,7 @@ Two properties hold everywhere:
   configuration says so, and no node may call a service the mesh policy has
   not granted. Grants are evaluated on service names, never on addresses.
 - **Identity comes from your identity provider.** A node enrolls with an
-  OpenID Connect token or a one-time bootstrap token, and the control plane
+  OpenID Connect token or a bootstrap token, and the control plane
   turns that into a short-lived, offline-verifiable credential bound to the
   node's own key.
 

@@ -33,7 +33,7 @@ Sidecar API lands on `127.0.0.1:9099` with token `devtoken`.
 ## 4. Find the provider peer
 
 ```sh
-./bin/mcp-client -url http://127.0.0.1:9099/mcp -token devtoken \
+AGENTMESH_API_TOKEN=devtoken ./bin/mcp-client -url http://127.0.0.1:9099/mcp \
   -tool discover_remote_services -args '{"type":"a2a","name":"chat"}'
 ```
 

@@ -286,8 +286,8 @@ echo
 echo "To drive the mesh, enroll a local node in another shell (it stays in the foreground):"
 echo "  make build && make kind-local-node"
 echo "then call its MCP API on 127.0.0.1:9099:"
-echo "  ./bin/mcp-client -url http://127.0.0.1:9099/mcp -token devtoken -tool get_mesh_info -args '{}'"
-echo "  ./bin/mcp-client -url http://127.0.0.1:9099/mcp -token devtoken -tool find_remote_tools -args '{}'"
+echo "  AGENTMESH_API_TOKEN=devtoken ./bin/mcp-client -url http://127.0.0.1:9099/mcp -tool get_mesh_info -args '{}'"
+echo "  AGENTMESH_API_TOKEN=devtoken ./bin/mcp-client -url http://127.0.0.1:9099/mcp -tool find_remote_tools -args '{}'"
 
 if [[ "${1:-}" != "-s" ]]; then
   show_cluster_logs

@@ -27,7 +27,7 @@ Two rules apply to every mesh:
   configure one, and a node cannot call a service unless the mesh policy
   grants it. Policy is written in terms of service names, not IP addresses.
 - **Identity comes from your identity provider.** A node enrolls with an
-  OpenID Connect token or with a one-time bootstrap token. The control plane
+  OpenID Connect token or with a bootstrap token. The control plane
   turns that into a short-lived credential
   ([Biscuit](https://www.biscuitsec.org/)) that is bound to the node's own
   key and that any node can verify offline.

@@ -123,7 +123,7 @@ To use the mesh from a node built from your working tree:
 make kind-local-node                   # mints a bootstrap token, runs ./bin/agentmesh-node, API on 127.0.0.1:9099 with token "devtoken"
 make kind-local-node ARGS="--config my-node.yaml"
 
-./bin/mcp-client -url http://127.0.0.1:9099/mcp -token devtoken -tool find_remote_tools -args '{}'
+AGENTMESH_API_TOKEN=devtoken ./bin/mcp-client -url http://127.0.0.1:9099/mcp -tool find_remote_tools -args '{}'
 ```
 
 `make kind-e2e-mesh` runs the whole loop without interaction. It deploys

@@ -4,9 +4,12 @@ linkTitle: "Getting started"
 weight: 1
 ---
 
-Every Agent Mesh has a **control plane** (which enrolls members, distributes
-policy, and runs the router) and the **members** (`agentmesh-node` or native SDK
-programs) that connect to it.
+Every Agent Mesh has a **control plane**, one or more **routers** and the
+**members** (`agentmesh-node` or native SDK programs). The control plane
+enrolls members and distributes policy. The routers keep the directory of
+members and their services. A router relays traffic between two members
+that cannot connect directly. The members enroll with the control plane and
+connect to the routers.
 
 To connect an agent or machine to a mesh, you need **a running control plane
 and its URL** (`https://...`).

@@ -87,37 +87,39 @@ address of the running node and exits.
 ## 4. Call a tool on the mesh
 
 The node's local API is an MCP server. `mcp-client` is installed together
-with `agentmesh-node` and is the quickest way to talk to it. Export the token once:
+with `agentmesh-node` and is the quickest way to talk to it. `mcp-client`
+reads the token from `AGENTMESH_API_TOKEN` or from the file named by
+`-token-path`. Export the token once:
 
 ```bash
-export TOKEN=$(cat ~/.config/agentmesh/api-token)
+export AGENTMESH_API_TOKEN=$(cat ~/.config/agentmesh/api-token)
 ```
 
 List the tools the node itself offers:
 
 ```bash
-mcp-client -url http://127.0.0.1:8080/mcp -token "$TOKEN" -list
+mcp-client -url http://127.0.0.1:8080/mcp -list
 ```
 
 Find MCP services other nodes are publishing:
 
 ```bash
-mcp-client -url http://127.0.0.1:8080/mcp -token "$TOKEN" \
+mcp-client -url http://127.0.0.1:8080/mcp \
   -tool discover_remote_services -args '{"type":"mcp"}'
 ```
 
 Each result carries a `peer_id`. Ask one of them which tools it hosts:
 
 ```bash
-mcp-client -url http://127.0.0.1:8080/mcp -token "$TOKEN" \
+mcp-client -url http://127.0.0.1:8080/mcp \
   -tool find_remote_tools -args '{"peer_id":"<peer-id>"}'
 ```
 
 Then call one. The testnet runs the MCP reference `everything` server as a
 demo. Its `add` tool adds two numbers:
 
 ```bash
-mcp-client -url http://127.0.0.1:8080/mcp -token "$TOKEN" \
+mcp-client -url http://127.0.0.1:8080/mcp \
   -tool call_remote_tool \
   -args '{"peer_id":"<peer-id>","tool_name":"mcp://everything/add","arguments":{"a":2,"b":3}}'
 ```

@@ -159,10 +159,13 @@ caller's credential and the mesh policy on every request.
 
 The service `type` is a contract. `inference` is an OpenAI-compatible API,
 `mcp` an MCP server, `a2a` an A2A agent, and the node speaks that protocol
-to the backend and to nobody else: an `inference` backend is offered for the
-models it lists on `/v1/models`, an `mcp` server once the node has completed
-an MCP session with it, an `a2a` agent once it has served its agent card. A
-plain web server declared under any of these types is never advertised.
+to the backend and to nobody else. Before the node advertises an `mcp`
+server, the node completes an MCP session with the server. Before the node
+advertises an `a2a` agent, the node fetches the agent card. The node does
+not advertise a backend that fails its probe. An `inference` backend has no
+probe, so the node advertises the service as declared. The node offers the
+models that the backend lists on `/v1/models`. The node therefore advertises
+a plain web server declared as `inference`.
 
 ## 3. See it in the console
 

@@ -157,7 +157,7 @@ A member whose role grants `egress://api.github.com` reaches the same
 destination through its own node, which finds the serving node by name:
 
 ```bash
-curl -sS -H "X-Mesh-Authentication: Bearer $TOKEN" \
+curl -sS -H "X-Mesh-Authentication: Bearer $AGENTMESH_API_TOKEN" \
   "http://127.0.0.1:8080/mesh/$PEP_PEER_ID/egress/api.github.com/repos/acme/dubbing/pulls"
 ```
 

@@ -235,10 +235,11 @@ and the `granted_*` facts), plus `service($type, $name)` for the request and
 
 ## Checking that it worked
 
-From another enrolled node:
+From another enrolled node, with `AGENTMESH_API_TOKEN` set to that node's API
+token as in the [quick start](../../getting-started/quickstart/#4-call-a-tool-on-the-mesh):
 
 ```bash
-mcp-client -url http://127.0.0.1:8080/mcp -token "$TOKEN" \
+mcp-client -url http://127.0.0.1:8080/mcp \
   -tool discover_remote_services -args '{"type":"mcp","name":"calculator"}'
 ```
 

@@ -179,10 +179,11 @@ kind cluster. See [Contributing](../../contributing/#a-local-mesh-in-kind).
 kubectl -n agentmesh-nodes logs deploy/calc-mcp -c agentmesh-node | grep -E "Online|PeerID"
 ```
 
-From a node enrolled anywhere in the mesh:
+From a node enrolled anywhere in the mesh, with `AGENTMESH_API_TOKEN` set to
+that node's API token as in the [quick start](../../getting-started/quickstart/#4-call-a-tool-on-the-mesh):
 
 ```bash
-mcp-client -url http://127.0.0.1:8080/mcp -token "$TOKEN" \
+mcp-client -url http://127.0.0.1:8080/mcp \
   -tool discover_remote_services -args '{"type":"mcp","name":"calculator"}'
 ```
 

@@ -368,11 +368,14 @@ app in the foreground.
 
 ## Calling the phone from elsewhere
 
-From any enrolled node, the phone is a peer with an MCP service:
+From any enrolled node, the phone is a peer with an MCP service. Set
+`AGENTMESH_API_TOKEN` to the calling node's API token as in
+the [quick start](../../getting-started/quickstart/#4-call-a-tool-on-the-mesh),
+then run:
 
 ```bash
-mcp-client -url "http://127.0.0.1:8080/mesh/<phone-peer-id>/mcp/phone-sensors" -token "$TOKEN" -list
-mcp-client -url "http://127.0.0.1:8080/mesh/<phone-peer-id>/mcp/phone-sensors" -token "$TOKEN" -tool get_battery_status
+mcp-client -url "http://127.0.0.1:8080/mesh/<phone-peer-id>/mcp/phone-sensors" -list
+mcp-client -url "http://127.0.0.1:8080/mesh/<phone-peer-id>/mcp/phone-sensors" -tool get_battery_status
 ```
 
 ```json

@@ -270,7 +270,7 @@ curl -s --unix-socket $SOCK $URL \
   -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'
 ```
 
-Over TCP, add `-H "X-Mesh-Authentication: Bearer $TOKEN"` and use
+Over TCP, add `-H "X-Mesh-Authentication: Bearer $AGENTMESH_API_TOKEN"` and use
 `http://127.0.0.1:8080` as the base URL.
 
 ### Talking A2A through the proxy
@@ -291,7 +291,7 @@ line; `X-Mesh-Required-Labels` goes in the same variable, comma-separated:
 
 ```bash
 CARD=http://127.0.0.1:8080/mesh/<peer-id>/a2a/triage/.well-known/agent-card.json
-export A2ACLI_SVC_PARAM="X-Mesh-Authentication=Bearer $TOKEN"
+export A2ACLI_SVC_PARAM="X-Mesh-Authentication=Bearer $AGENTMESH_API_TOKEN"
 a2a card get $CARD
 a2a send -a $CARD "hello"
 ```

@@ -104,7 +104,7 @@ The local node is your entry point. Its API listens on
 ### 4. Find the provider peer
 
 ```bash
-./bin/mcp-client -url http://127.0.0.1:9099/mcp -token devtoken \
+AGENTMESH_API_TOKEN=devtoken ./bin/mcp-client -url http://127.0.0.1:9099/mcp \
   -tool discover_remote_services -args '{"type":"a2a","name":"chat"}'
 ```