Download
Get Primary Path
Free under Apache-2.0. Every release is signed by the workflow that built it; verify what you download before you run it in production. Release notes and every file are on the releases page.
Try it on one machine
Docker with Compose. It listens on 127.0.0.1 only and runs without authentication, for evaluation. Then run the demos against it.
curl -fsSLO https://github.com/om-er/primarypath-releases/releases/latest/download/docker-compose.yml
docker compose up -d --wait
# open http://127.0.0.1:8123Everything in a release
| What | Get it | For |
|---|---|---|
| Server image | docker pull ghcr.io/om-er/primarypath:latest | linux/amd64 and linux/arm64. Pin a version, then its digest. |
| Compose files | docker-compose.yml, docker-compose.prod.yml | Evaluation, and the production overlay (https, auth required). Install |
| Helm chart | helm install primarypath oci://ghcr.io/om-er/charts/primarypath --version X.Y.Z | Kubernetes, restricted Pod Security by default. Install |
| Python SDK | pip install primarypath-sdk | Govern an agent from Python, sync or async. |
| Framework integrations | pip install primarypath-langgraphpip install primarypath-openai-agentspip install primarypath-claude-agentpip install primarypath-dranguepip install primarypath-mcp | The framework's own pause, wired to the inbox; the MCP gateway needs no agent changes. Integrations |
| Verifier | pip install primarypath-verify | Auditors: check an exported bundle offline. Verifier guide |
| Demos | pip install primarypath-demos | The two walkthroughs from the home page. Demo guide |
| TypeScript SDK | primarypath-client-X.Y.Z.tgz on the releases page | npm install the tarball's URL. Install |
| Grafana dashboard | grafana-dashboard.json | A starting point for the service's metrics. Metrics |
| Checksums, SBOMs, signatures | SHA256SUMS, sbom-*.json, *.sigstore.json on the releases page | Verifying a download |
Check the proof yourself
A real signed audit bundle from the two demos, the key ring to pin, and a copy in which one fact was rewritten afterwards: the rejected €840 refund turned into €84. The verifier passes the first and names the exact record that changed in the second. No server involved.
- bundle.json and pubring.json
- bundle-tampered.json
- README.txt, and the verifier's output on each: OK, FAIL
pip install primarypath-verify primarypath-verify bundle.json --pubring pubring.json primarypath-verify bundle-tampered.json --pubring pubring.json