Private mesh endpoints: webhooks only your agents can reach
Route6 gives every agent a public identity — its own address in your dedicated IPv6 /64, a hostname, port forwarding. That solves the inbound from the internet problem. But a lot of agent-to-agent traffic should never touch the internet at all: a webhook one of your agents exposes for another, an internal status API, a coordination endpoint between two halves of a pipeline.
Until now the options were the usual ones: put it on a public endpoint and bolt on auth, or wire up your own VPN between machines. The first makes internal surface area scannable by the whole internet. The second is exactly the kind of infrastructure work you adopted an agent platform to avoid.
This week we shipped private mesh endpoints. If your agents are in a team mesh, each agent's name now resolves inside the mesh as <name>.mesh.route6.me — straight to the agent's private tunnel address. The zone doesn't exist on the public internet; public resolvers get NXDOMAIN. There is no public binding to firewall, because the endpoint is private by addressing, not by filtering.
What it looks like
An agent exposes a service to its mesh through the same MCP tool it already uses, with one new parameter:
port_forward (action: create) { "port": 8080, "scope": "mesh" }
scope: "mesh" binds the forward to the agent's tunnel address only — it is unreachable from the internet by construction. ("public" and "both" are the other options; public behavior is unchanged.)
Any teammate agent then calls it by name:
curl http://codex.mesh.route6.me:8080/hook
That request rides the encrypted WireGuard tunnel, never leaves Route6's network, and arrives carrying verified caller identity: the receiving side sees x-route6-caller-agent and x-route6-caller-hostname headers derived from the caller's tunnel source address, which the network enforces — client-supplied x-route6-* headers are stripped. Your endpoint knows which agent is calling without any shared secrets.
It works behind corporate NAT too
Not every agent runs the Docker container with a WireGuard tunnel. The lite client (npm i -g @route6/agent / pip install route6) only makes outbound HTTPS — that's the point; it works from inside locked-down networks with no firewall tickets.
Lite agents are still first-class mesh peers. Our gateway holds the lite agent's private mesh address and relays inbound mesh traffic into the agent's existing outbound tunnel session, with the same caller-identity enforcement. A WireGuard agent in your mesh can call http://your-lite-agent.mesh.route6.me/ and reach a process sitting behind corporate NAT — and the lite agent can call mesh names through its web_fetch tool the same way.
Honest limitation: for lite targets, v1 is HTTP only (the relay speaks HTTP into the agent's tunnel). WireGuard-to-WireGuard is raw IPv6 — any TCP service works.
Access control, for humans
Mesh membership is the default boundary: same mesh, you can call it; different mesh, the traffic is dropped. On top of that, each endpoint can carry a per-agent allowlist, and a team can switch to strict mode — default-deny, every pair explicitly allowed.
ACLs are configured by humans in the dashboard, not by agents — an agent can't grant itself access to anything. Denied callers get one opaque 403 with no hint of why; the details land in a security event feed only the account owner sees. Changes propagate to enforcement in under a minute.
This matters most in cross-organization meshes: Route6 teams can invite an outside agent — a client's, a vendor's — as a guest. The guest gets a mesh name like everyone else, and you scope it to exactly the endpoints it should see, with an audit trail of every denial.
Nothing new to learn
There are no new tools and no config files. Names come from hostname_register (every agent is born with one); exposure is a parameter on port_forward { action: "create" }; discovery rides team_status and the mesh peer list. Your agent can set all of this up itself over MCP.
If you want to try it: sign up free — the free tier gives you two agents and the mesh between them — and the docs cover the details. If you'd rather poke at it first, curl -sSL route6.me/try | bash gives you a throwaway agent identity for an hour.