APM – Agent Package Manager

An open-source, community-driven dependency manager for AI agents.

Think package.json, requirements.txt, or Cargo.toml — but for AI agent configuration.

Documentation · Quick Start · CLI Reference · Roadmap

Portable by manifest. Secure by default. Governed by policy. One file describes every agent's context; one command reproduces it everywhere; one policy controls what an org will allow.

Why APM

AI coding agents need context to be useful — standards, prompts, skills, plugins — but today every developer sets this up manually. Nothing is portable nor reproducible. There's no manifest for it.

APM fixes this. Declare your project's agentic dependencies once in apm.yml, and every developer who clones your repo gets a fully configured agent setup in seconds — with transitive dependency resolution, just like npm or pip. It's also the first tool that lets you author plugins with a real dependency manager and export standard plugin.json packages.

# apm.yml — ships with your project
name: your-project
version: 1.0.0
dependencies:
  apm:
    # Skills from any repository
    - anthropics/skills/skills/frontend-design
    # Plugins
    - github/awesome-copilot/plugins/context-engineering
    # Specific agent primitives from any repository
    - github/awesome-copilot/agents/api-architect.agent.md
    # A full APM package with instructions, skills, prompts, hooks...
    - microsoft/apm-sample-package#v1.0.0
  mcp:
    # MCP servers -- installed into every detected client
    - name: io.github.github/github-mcp-server
      transport: http   # MCP transport name, not URL scheme -- connects over HTTPS

git clone <org/repo> && cd <repo>
apm install    # every agent is configured

Coming from npx skills add? Drop-in:

apm install vercel-labs/agent-skills                            # whole bundle, like npx skills add
apm install vercel-labs/agent-skills --skill deploy-to-vercel   # one skill, persisted to apm.yml

Same install gesture. You also get a manifest, lockfile, and reproducibility.

Zero-config Copilot:

apm compile -t copilot   # writes .github/copilot-instructions.md

One command, no configuration -- VS Code and GitHub Copilot read the file automatically. APM dogfoods this target on its own repository.

The three promises

1. Portable by manifest

One apm.yml describes every primitive your agents need — instructions, skills, prompts, agents, hooks, plugins, MCP servers — and apm install reproduces the exact same setup across every client on every machine. apm.lock.yaml pins the resolved tree the way package-lock.json does for npm.

One manifest for everything -- declared once, deployed across Copilot, Claude, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf, Kiro
Install from anywhere — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, Gitea, Gogs, any git host
Transitive dependencies — packages can depend on packages; APM resolves the full tree
Author plugins — build Copilot, Claude, and Cursor plugins with dependency management, then export standard plugin.json
Marketplaces — install plugins from curated registries in one command, deployed across all targets and locked
Pack & distribute — apm pack bundles your configuration as a zipped package or a standalone plugin
CI/CD ready — GitHub Action for automated workflows

2. Secure by default

Agent context is executable in effect — a prompt is a program for an LLM. APM treats it that way. Every install scans for hidden Unicode that can hijack agent behavior; the lockfile pins integrity hashes; transitive MCP servers are gated by trust prompts.

Content security — apm install blocks compromised packages before agents read them; apm audit runs the same checks on demand
Lockfile integrity — apm.lock records resolved sources and content hashes for full provenance
SBOM export — apm lock export --format cyclonedx|spdx emits a standard inventory of what reached disk, straight from the lockfile — provenance for procurement, not a compliance attestation
Drift detection — apm audit rebuilds your agent context in scratch and diffs it against your working tree to catch hand-edits before they ship
MCP trust boundaries — transitive MCP servers require explicit consent

3. Governed by policy

apm-policy.yml lets a security team say "these are the only sources, scopes, and primitives this org will allow" and have every apm install enforce it — with tighten-only inheritance from enterprise to org to repo, a published bypass contract, and audit-mode CI gates.

apm-policy.yml governs what gets installed; your agent harness governs what runs. The two planes do not overlap.

Governance Guide — the canonical enterprise reference: enforcement points, bypass contract, air-gapped story, failure semantics, rollout playbook
Policy reference — every check, every field, every default
Adoption playbook — staged rollout from warn to block across hundreds of repos
GitHub rulesets integration — wire apm audit --ci into branch protection

Get Started

macOS with Homebrew

brew install apm

No custom tap is required. Homebrew manages installation and updates: use brew upgrade apm, not apm self-update.

Linux / macOS without Homebrew

curl -sSL https://aka.ms/apm-unix | sh

Windows

irm https://aka.ms/apm-windows | iex

Native release binaries are published for macOS, Linux, and Windows x86_64. For standalone installations, apm self-update reuses the matching platform installer. You do not need Homebrew to use APM.

Other install methods: pip, WinGet, and Scoop

Linux / macOS

# pip (Python 3.10+)
pip install apm-cli

Windows

# WinGet
winget install --id Microsoft.APM --exact --source winget

# Scoop
scoop bucket add apm https://github.com/microsoft/scoop-apm
scoop install apm
# pip
pip install apm-cli

Already using the Microsoft Homebrew tap? See the migration guide.

Then start adding packages:

apm install microsoft/apm-sample-package#v1.0.0

Or install from a marketplace:

apm marketplace add github/awesome-copilot
apm install azure-cloud-development@awesome-copilot

Or add an MCP server (wired into Copilot, Claude, Cursor, Codex, OpenCode, Gemini, Windsurf, and Kiro):

apm install --mcp io.github.github/github-mcp-server --transport http   # connects over HTTPS

See the Getting Started guide for the full walkthrough.

Works with agentrc

agentrc analyzes your codebase and generates tailored agent instructions — architecture, conventions, build commands — from real code, not templates.

Use agentrc to author high-quality instructions, then package them with APM to share across your org. The .instructions.md format is shared by both tools — no conversion needed when moving instructions into APM packages.

Community

Created by @danielmeppiel. Maintained by @danielmeppiel and @sergio-sisternes-epam.

Roadmap
Discussions
Contributing
AI Native Development guide — a practical learning path for AI-native development

Built on open standards: AGENTS.md · Agent Skills · MCP

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

Release files for apm-cli 0.32.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for apm-cli 0.32.0
File	Size	Uploaded
apm_cli-0.32.0.tar.gz	1.8 MB	Sep 25, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for apm-cli 0.32.0
File	Interpreter	ABI	Platform	Reset
apm_cli-0.32.0-py3-none-any.whl 1.9 MB Sep 25, 2026	Python 3	none	any	Details

Total release size: 3.7 MB

Release files / apm_cli-0.32.0.tar.gz

Download URL	apm_cli-0.32.0.tar.gz
Size	1.8 MB
Tags	Source
SHA-256 checksum How to use checksums	`761b774078975e3b028c332d8c5e43a7227baf022a96b0f0c42fc966e37f5d32`
BLAKE2b-256 checksum How to use checksums	`1ff18da7ba1848916dd5eafd8d94c52c6ca235eda293b9a92b2dde145094aa22`
Upload date	Sep 25, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/microsoft/apm
Publishing commit: github.com/microsoft/apm/tree/f0509d75f2b35d11c8e983456e90e101768f1ecc

Workflow

Publishing configuration: github.com/microsoft/apm/blob/f0509d75f2b35d11c8e983456e90e101768f1ecc/.github/workflows/build-release.yml
Publishing logs: github.com/microsoft/apm/actions/runs/36164394630/attempts/1

Artifact

Subject: apm_cli-0.32.0.tar.gz
SHA-256 checksum: 761b774078975e3b028c332d8c5e43a7227baf022a96b0f0c42fc966e37f5d32 Verifying attestations

Release files / apm_cli-0.32.0-py3-none-any.whl

Download URL	apm_cli-0.32.0-py3-none-any.whl
Size	1.9 MB
Tags	Python 3
SHA-256 checksum How to use checksums	`3697576c238105e0d22eb30595b158113994d1f5c246c9e4677517339c3980d4`
BLAKE2b-256 checksum How to use checksums	`bc93d8ed1ab4fb526fa17592b9d2a8a0930e5191a29973e28dc220fb2e33acdf`
Upload date	Sep 25, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/microsoft/apm
Publishing commit: github.com/microsoft/apm/tree/f0509d75f2b35d11c8e983456e90e101768f1ecc

Workflow

Publishing configuration: github.com/microsoft/apm/blob/f0509d75f2b35d11c8e983456e90e101768f1ecc/.github/workflows/build-release.yml
Publishing logs: github.com/microsoft/apm/actions/runs/36164394630/attempts/1

Artifact

Subject: apm_cli-0.32.0-py3-none-any.whl
SHA-256 checksum: 3697576c238105e0d22eb30595b158113994d1f5c246c9e4677517339c3980d4 Verifying attestations