agentmesh_marketplace

---

Note: This package was extracted from agentmesh.marketplace. The old import path still works via a backward-compatibility shim but new code should import from agent_marketplace directly.

What is Agent Marketplace?

Agent Marketplace provides governed plugin lifecycle management for AI agent ecosystems:

• Plugin Discovery — Browse and search registered plugins by capability, trust level, or framework
• Verified Installation — Install plugins with cryptographic integrity verification (SHA-256 + Ed25519)
• Plugin Signing — Sign plugin manifests with Ed25519 keys for supply-chain security
• Manifest Validation — Declarative plugin manifests with schema validation (capabilities, permissions, dependencies)
• Registry Management — Register, update, and deprecate plugins with version tracking

Artifact distribution vs. manifest-registration

PluginInstaller.install() operates in one of two modes depending on the manifest:

The Ed25519 signature covers both the manifest metadata and artifact_sha256, so a valid signature cryptographically binds the manifest to the artifact. list_installed() re-verifies the manifest signature and the stored artifact hash on every call.

Quick Start

pip install agentmesh-marketplace

from agent_marketplace import PluginRegistry, PluginInstaller, PluginManifest

# Create a registry
registry = PluginRegistry()

# Register a plugin
manifest = PluginManifest(
    name="web-search",
    version="1.0.0",
    capabilities=["search", "browse"],
    permissions=["network:read"],
)
registry.register(manifest)

# Install with verification
installer = PluginInstaller(registry=registry, verify_signatures=True)
result = installer.install("web-search")

CLI

# List available plugins
agentmesh-marketplace list

# Install a plugin
agentmesh-marketplace install web-search

# Verify plugin integrity
agentmesh-marketplace verify web-search

# Sign a plugin manifest
agentmesh-marketplace sign manifest.yaml --key signing-key.pem

Ecosystem

Agent Marketplace is one of 7 packages in the Agent Governance Toolkit:

License

MIT — see LICENSE.