Keep evidence in your agent workflow.

1. Install the dependency-free client

Python 3.10 or newer. The install adds the localmark command and Python library. No API key is required.

python -m pip install https://localmark.ai/static/downloads/localmark_client-0.4.1-py3-none-any.whl

Source, licence and examples ↗ · REST, MCP and A2A reference →

2. Save the requirements once

Save this as pdf-policy.json. These are selection filters, not a permission to run a task.

{
  "q": "extract text from PDF documents",
  "checked_within_hours": 24,
  "tls_reachable": true,
  "limit": 5
}

localmark recommend --policy pdf-policy.json
localmark plan 123
localmark gate agent.example.com/a2a --card-hours 24 --a2a-hours 24 --tls

Replace the example address and ID with a real individual listing. Explicit arguments override saved fields; --no-tls turns a saved TLS filter off. Unknown fields, credentials, duplicate JSON keys and invalid types are rejected. A price ceiling also needs a payment network and asset, with amounts in human-readable asset units.

3. Read the connection plan

from localmark_client import LocalMarkClient

client = LocalMarkClient()
matches = client.recommend(policy="pdf-policy.json")
for agent in matches["items"]:
    plan = client.connection_plan(agent["id"])
    print(plan["interfaces"], plan["authentication"], plan["evidence"])
    # Inspect the plan. No agent task is invoked by this code.

The plan describes advertised endpoints, transports, protocol versions, authentication scheme metadata, input/output modes and skill names. It includes stored evidence and never returns credentials. A publisher domain may match multiple agents; use a listing ID for an unambiguous plan.

Review the publisher’s documentation, obtain credentials separately and authorize the actual task before connecting. Relevance, domain control, card signatures, reachability and task correctness are different signals.

4. Check dependencies in GitHub Actions

permissions:
  contents: read
jobs:
  dependency-check:
    runs-on: ubuntu-latest
    steps:
      # Replace main with a reviewed full commit SHA.
      - uses: dustingarner1975/localmark-tools@main
        with:
          target: https://agent.example.com/a2a
          card-hours: '24'
          a2a-hours: '24'
          tls: 'true' 

The reusable action runs the client code at the selected revision with the runner’s Python. It installs no packages. The default mode checks stored evidence and fails when a required observation is absent, stale or unsuccessful. It also fails on API errors and rate limits.

For a publisher’s own card, set mode: check-card and supply the full public /.well-known/agent-card.json URL. This performs a bounded read-only preflight and never executes an agent task or sends payment. A daily scheduled check is enough for most projects.

Complete CI example ↗

5. Watch an agent or a capability policy

Choose your evidence requirements and opt in with your own email. Confirmation is required before activation. Watches can report availability, requirements, risk changes and new matches. Alternatives explain the same requirements; LocalMark never switches providers or shares credentials automatically.

Set up an opt-in watch → · API opt-in example ↗

Private confirmation and management links must stay out of source control and logs. The service does not import publishers’ email addresses.

Understand what was measured

• Search benchmark: reproducible retrieval cases with stated limits.
• Prospective external judging: a new frozen query set awaiting external relevance judgments.
• Publisher-authorized capability tests: separate, synthetic tests with explicit permission and published limits.
• State of the agent web reports: reproducible observations from dated public snapshots.
• Daily open data: LocalMark observations under CC BY 4.0; publisher content remains separate.

Optional project-use measurement is disabled by default. Developers may explicitly send a random UUIDv4 project identifier; it is a public self-reported integration count, not verified unique people. See the client README and privacy notice for retention.