Start with one agent.

01Install Edge

macOS and Linux:

curl -fsSL https://github.com/commonmeasure/commonmeasure/releases/latest/download/install.sh | sh

Downloads the release binary, verifies its checksum and installs it to ~/.local/bin. The installer does not edit your shell profile.

If the installer says ~/.local/bin is not on your PATH, add it for this terminal and for new ones (zsh, the macOS default):

export PATH="$HOME/.local/bin:$PATH"
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc

Checkpoint. commonmeasure --version prints a version, such as commonmeasure 0.4.10.

git clone https://github.com/commonmeasure/commonmeasure
cd commonmeasure
cargo install --path crates/commonmeasure-cli

02Connect your agent

commonmeasure install claude
commonmeasure doctor claude

commonmeasure install codex
commonmeasure doctor codex

commonmeasure install pi
commonmeasure doctor pi

Checkpoint. doctor lists the host as ✓ registered. Lines marked · are information, such as “policy absent; observe mode”; act on any marked !. Then quit and reopen your agent: a session loads Common Measure only when it starts.

claude plugin marketplace add commonmeasure/commonmeasure
claude plugin install commonmeasure@commonmeasure

03Make a read. See the record.

In a new session, ask your agent:

Read https://www.gov.uk using context_fetch.

Then inspect the latest source record in your terminal:

commonmeasure session

crossings
  mediated   grounded  https://www.gov.uk/

Checkpoint. The record lists https://www.gov.uk/ as mediated and grounded: Common Measure fetched the page and its text went into the model’s context. “identity: unsigned” is expected on an Edge that is not enrolled with Hub.

04Refuse a read.

Create a personal source policy that refuses example.com. Use this example if you do not already have a policy.json; if you do, edit your existing policy using the source policy contract.

cat > "${COMMONMEASURE_HOME:-$HOME/.commonmeasure}/policy.json" <<'EOF'
{
  "policy_mode": "strict",
  "constraints": [
    {"kind": "denied_source_host", "host": "example.com"}
  ]
}
EOF
commonmeasure policy check "${COMMONMEASURE_HOME:-$HOME/.commonmeasure}/policy.json"

The check reports the mode and the rule count:

mode          strict
constraints   1

Start a new session in your agent so it loads the policy, then ask:

Read https://example.com using context_fetch.

The tool refuses the read before fetching the page. Inspect the record:

commonmeasure session

crossings
  mediated   refused   https://example.com/
      refused: The job denies host example.com.

Checkpoint. The refused crossing names the rule that refused it. Other hosts, such as www.gov.uk, are still admitted.

These output excerpts omit file paths, empty policy sections, session metadata, totals and policy digests. Removing this policy.json returns a local Edge to observe mode. Start a new agent session after removing it.

05Add a provider key.

Optional: bring a supplier’s API key to search through that supplier. List the supported suppliers and the variable each needs:

commonmeasure credentials

Keys for a local Edge go in ~/.commonmeasure/credentials.env, or $COMMONMEASURE_HOME/credentials.env if you set a different home. Create the file if it is missing and restrict access to your user:

touch "${COMMONMEASURE_HOME:-$HOME/.commonmeasure}/credentials.env"
chmod 600 "${COMMONMEASURE_HOME:-$HOME/.commonmeasure}/credentials.env"

Open that file in a text editor. For Exa, add EXA_API_KEY= followed by your key on the same line. For Tavily, use TAVILY_API_KEY=. Keep any existing entries, with one KEY=VALUE per line.

Checkpoint. commonmeasure credentials shows ✓ exa configured (EXA_API_KEY from the operator file). It never prints the key. A variable in the launching environment takes precedence over the file.

Restart your agent, then ask it to search using context_search with your chosen provider, such as exa. Supplier searches may be charged to your account; your source policy still applies. A configured key does not establish access or available credit.

06Open the console.

The console shows the same records in your browser. It listens on your machine only and has no sign-in. On macOS, keep it running as a login service:

commonmeasure service install console

On other systems, or for this terminal only, run commonmeasure serve and stop it with Ctrl-C.

Checkpoint. commonmeasure console prints ✓ console: http://127.0.0.1:4173 answers. Open that address. Under Record, the example.com refusal from step 04 names its rule; Sources shows the keys from step 05.

After changing credentials.env, run commonmeasure service install console again to restart the console. The console describes its pages.