Agent Package Manager

Same AI coding superpowers. Every developer. By default.

An open-source dependency manager for AI agents. Think package.json, requirements.txt, or Cargo.toml — but for AI agent configuration.

AI coding agents need context and capabilities to be useful — instructions, skills, prompts, plugins, MCP servers. But today every developer configures theirs differently. Nothing is portable. Nothing is reproducible. Nothing is governed.

APM fixes this. You declare your project’s agent configuration once in apm.yml — and every developer who clones your repo gets a fully configured agent setup in seconds, locked to exact versions, scanned for hidden threats, and gated by the policies your organization defines.

Portable by manifest

One apm.yml declares skills, instructions, prompts, agents, hooks, plugins, and MCP servers. Transitive dependencies resolve like npm or pip; apm.lock.yaml pins exact versions for reproducible installs across Copilot, Claude Code, Cursor, OpenCode, Codex, and Gemini.

Secure by default

Skills, prompts, instructions, hooks — everything agents execute is an attack surface. apm install scans packages for hidden Unicode and other tampering before they reach your agents; apm audit reports the full chain of trust.

Governed by policy

apm-policy.yml lets platform teams allow-list dependencies, restrict deploy targets, and enforce trust rules at install time — across every repo, from a single source of truth. See the Governance Guide.

Any git host

Install from GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, or any self-hosted git server. No registry to run, no central service to depend on.

curl -sSL https://aka.ms/apm-unix | sh

irm https://aka.ms/apm-windows | iex

Then add packages to your project:

apm install microsoft/apm-sample-package
apm install anthropics/skills/skills/frontend-design

Example: apm.yml

# apm.yml — ships with your project, like package.json
name: your project
version: 1.0.0
dependencies:
  apm:
    # Skills from any GitHub repository
    - anthropics/skills/skills/frontend-design
    - microsoft/GitHub-Copilot-for-Azure/plugin/skills/azure-compliance
    # A full package with rules, skills, prompts, hooks...
    - microsoft/apm-sample-package
    # Plugins
    - github/awesome-copilot/plugins/context-engineering#v2.1
    # Agents
    - github/awesome-copilot/agents/api-architect.agent.md
    # GitLab, Azure DevOps, any git host — with version pinning
    - git: https://gitlab.com/acme/coding-standards.git
      path: instructions/security
      ref: v2.0
    - git: dev.azure.com/org/project/repo
      path: prompts/review.prompt.md

New developer joins the team:

git clone <org/repo> && cd <repo> && apm install

That’s it. Copilot, Claude, Cursor, OpenCode, Codex, Gemini — every harness is configured with the right context and capabilities. The manifest defines the project’s custom and portable Agentic SDLC setup installable in a single command.

Open Source & Community

APM is an open-source, MIT-licensed community project under the microsoft org. It’s early days — the tool is evolving fast, shaped by developers building real agent workflows. We ship frequently, welcome contributions, and value feedback over perfection.

Built on the standards the community has already adopted: AGENTS.md · Agent Skills · MCP

We’ve enforced dependency management on code for decades. It was only a matter of time before AI agents needed it too.