[opensourcedex]

apm is a free, open source ai development platforms project written in Python and released under MIT. It has 4,175 GitHub stars, 413 forks and 215 open issues, and was last pushed 13 hours ago. On this registry it ranks #117 of 155 tracked projects in AI Development Platforms, with 5 head-to-head comparisons available. It gained 252 stars over the last 30 tracked days.

What is apm?

APM is an open-source, community-driven dependency manager for AI agents that lets a team declare its agentic dependencies once in an apm.yml manifest and reproduce the same agent configuration on every machine and in every supported client.

What it is

APM is a package manager for AI agent configuration. It lives in the AI development tooling ecosystem alongside the coding agents it configures — GitHub Copilot, Claude Code, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf, and Kiro — and it is written in Python under the MIT licence. The project describes itself as the equivalent of package.json, requirements.txt, or Cargo.toml, but for the standards, prompts, skills, plugins, agents, hooks, and MCP servers that an AI coding agent needs in order to be useful. Configuration is declared in a single apm.yml file that ships with the repository, and a resolved dependency tree is pinned in apm.lock.yaml, the way package-lock.json pins a Node.js tree.

The concrete problem it solves is the absence of a manifest for agent context. Today each developer sets up agent context by hand, so nothing is portable and nothing is reproducible: a colleague who clones a repository gets no agent configuration at all. APM replaces that manual, per-developer setup with a declarative manifest plus a single install command, and it adds transitive dependency resolution so that packages can depend on other packages and the full tree resolves automatically. It also positions itself as the first tool that allows authoring plugins with a real dependency manager and exporting them as standard plugin.json packages.

Key capabilities

  • Declares instructions, skills, prompts, agents, hooks, plugins, and MCP servers in one apm.yml manifest, then reproduces that setup across every supported client with apm install.
  • Pins the resolved dependency tree in apm.lock.yaml for reproducibility.
  • Resolves transitive dependencies, so packages may depend on other packages and the complete tree is computed.
  • Installs dependencies from GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, Gitea, Gogs, or any git host.
  • Configures MCP servers declaratively in the mcp block, including transport selection such as http, and installs them into every detected client.
  • Generates client-specific output, for example apm compile -t copilot, which writes .github/copilot-instructions.md with no further configuration.
  • Packs and distributes configuration with apm pack, producing a zipped package or a standalone plugin, and supports exporting standard plugin.json.
  • Installs plugins from curated marketplaces in one command, deployed across all targets and locked.
  • Acts as a drop-in replacement for npx skills add, supporting both whole-bundle installs and single-skill installs that persist into apm.yml.

Who uses it and how

  • Development teams whose members run different AI coding clients: one manifest deploys the same configuration across Copilot, Claude, Cursor, Codex, Gemini, Windsurf, Kiro, Grok Build, and OpenCode.
  • New contributors cloning a repository, for whom git clone && cd apm install produces a fully configured agent setup in seconds instead of manual setup.
  • Teams migrating from npx skills add, which can keep the same install gesture while gaining a manifest, lockfile, and reproducibility.
  • Organisations running curated internal or public marketplaces, which install plugins from those registries in one command.
  • CI/CD pipelines, via the apm-action GitHub Action for automated workflows, and repositories that dogfood a compile target — APM does this on its own repository.

Getting started

Install is driven from the repository: clone the project, then run apm install, which reads apm.yml and configures every detected agent client. Zero-configuration Copilot output is produced with apm compile -t copilot, which writes .github/copilot-instructions.md, and packages are described in apm.yml alongside MCP servers.

How it compares

Among the tools named in the facts, APM sits at the same layer as npm and pip for JavaScript and Python, and as Cargo.toml for Rust, but it manages agent primitives rather than runtime libraries. It also overlaps with npx skills add, from which it offers a drop-in install gesture while adding a manifest, lockfile, and transitive resolution.

When to use it — and when not to

APM suits teams that run AI coding agents in more than one client, or that need agent configuration to be reproducible and reviewable in version control. Teams using a single agent client, or developers who configure one machine by hand, get less from the added manifest and lockfile layer. The README excerpt provided is truncated mid-sentence in the "Secure by default" section, so the third stated promise — "governed by policy" — is not documented here, and the 215 open issues against 3,838 stars indicate an actively developed project with a sizeable open backlog that adopters should expect to navigate.

project readme (upstream, from github) — read inline

APM – Agent Package Manager

An open-source, community-driven dependency manager for AI agents.

Think package.json, requirements.txt, or Cargo.toml — but for AI agent configuration.

GitHub Copilot | Claude Code | Grok Build | Cursor | OpenCode | Codex | Gemini | Windsurf | Kiro

Documentation · Quick Start · CLI Reference · Roadmap

Portable by manifest. Secure by default. Governed by policy. One file describes every agent's context; one command reproduces it everywhere; one policy controls what an org will allow.

Why APM

AI coding agents need context to be useful — standards, prompts, skills, plugins — but today every developer sets this up manually. Nothing is portable nor reproducible. There's no manifest for it.

APM fixes this. Declare your project's agentic dependencies once in apm.yml, and every developer who clones your repo gets a fully configured agent setup in seconds — with transitive dependency resolution, just like npm or pip. It's also the first tool that lets you author plugins with a real dependency manager and export standard plugin.json packages.

# apm.yml — ships with your project
name: your-project
version: 1.0.0
dependencies:
  apm:
    # Skills from any repository
    - anthropics/skills/skills/frontend-design
    # Plugins
    - github/awesome-copilot/plugins/context-engineering
    # Specific agent primitives from any repository
    - github/awesome-copilot/agents/api-architect.agent.md
    # A full APM package with instructions, skills, prompts, hooks...
    - microsoft/apm-sample-package#v1.0.0
  mcp:
    # MCP servers -- installed into every detected client
    - name: io.github.github/github-mcp-server
      transport: http   # MCP transport name, not URL scheme -- connects over HTTPS

git clone <org/repo> && cd <repo>
apm install    # every agent is configured

Coming from npx skills add? Drop-in:

apm install vercel-labs/agent-skills                            # whole bundle, like npx skills add
apm install vercel-labs/agent-skills --skill deploy-to-vercel   # one skill, persisted to apm.yml

Same install gesture. You also get a manifest, lockfile, and reproducibility.

Zero-config Copilot:

apm compile -t copilot   # writes .github/copilot-instructions.md

One command, no configuration -- VS Code and GitHub Copilot read the file automatically. APM dogfoods this target on its own repository.

The three promises

1. Portable by manifest

One apm.yml describes every primitive your agents need — instructions, skills, prompts, agents, hooks, plugins, MCP servers — and apm install reproduces the exact same setup across every client on every machine. apm.lock.yaml pins the resolved tree the way package-lock.json does for npm.

  • One manifest for everything -- declared once, deployed across Copilot, Claude, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf, Kiro
  • Install from anywhere — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, Gitea, Gogs, any git host
  • Transitive dependencies — packages can depend on packages; APM resolves the full tree
  • Author plugins — build Copilot, Claude, and Cursor plugins with dependency management, then export standard plugin.json
  • Marketplaces — install plugins from curated registries in one command, deployed across all targets and locked
  • Pack & distribute — apm pack bundles your configuration as a zipped package or a standalone plugin
  • CI/CD ready — GitHub Action for automated workflows

2. Secure by default

Agent context is executable in effect — a prompt is a program for an LLM. APM treats it that way. Every install scans for hidden Unicode that can hijack agent behavior; the lockfile pins integrity hashes; transitive MCP servers are gated by trust prompts.

  • Content security — apm install blocks compromised packages before agents read them; apm audit runs the same checks on demand
  • Lockfile integrity — apm.lock records resolved sources and content hashes for full provenance
  • SBOM export — apm lock export --format cyclonedx|spdx emits a standard inventory of what reached disk, straight from the lockfile — provenance for procurement, not a compliance attestation
  • Drift detection — apm audit rebuilds your agent context in scratch and diffs it against your working tree to catch hand-edits before they ship
  • MCP trust boundaries — transitive MCP servers require explicit consent

3. Governed by policy

apm-policy.yml lets a security team say "these are the only sources, scopes, and primitives this org will allow" and have every apm install enforce it — with tighten-only inheritance from enterprise to org to repo, a published bypass contract, and audit-mode CI gates.

apm-policy.yml governs what gets installed; your agent harness governs what runs. The two planes do not overlap.

Get Started

macOS with Homebrew
brew install apm

No custom tap is required. Homebrew manages installation and updates: use brew upgrade apm, not apm self-update.

Linux / macOS without Homebrew
curl -sSL https://aka.ms/apm-unix | sh
Windows
irm https://aka.ms/apm-windows | iex

Native release binaries are published for macOS, Linux, and Windows x86_64. For standalone installations, apm self-update reuses the matching platform installer. You do not need Homebrew to use APM.

Other install methods: pip, WinGet, and Scoop
Linux / macOS
# pip (Python 3.10+)
pip install apm-cli
Windows
# WinGet
winget install --id Microsoft.APM --exact --source winget

# Scoop
scoop bucket add apm https://github.com/microsoft/scoop-apm
scoop install apm
# pip
pip install apm-cli

Already using the Microsoft Homebrew tap? See the migration guide.

Then start adding packages:

apm install microsoft/apm-sample-package#v1.0.0

Or install from a marketplace:

apm marketplace add github/awesome-copilot
apm install azure-cloud-development@awesome-copilot

Or add an MCP server (wired into Copilot, Claude, Cursor, Codex, OpenCode, Gemini, Windsurf, and Kiro):

apm install --mcp io.github.github/github-mcp-server --transport http   # connects over HTTPS

See the Getting Started guide for the full walkthrough.

Works with agentrc

agentrc analyzes your codebase and generates tailored agent instructions — architecture, conventions, build commands — from real code, not templates.

Use agentrc to author high-quality instructions, then package them with APM to share across your org. The .instructions.md format is shared by both tools — no conversion needed when moving instructions into APM packages.

Community

Created by @danielmeppiel. Maintained by @danielmeppiel and @sergio-sisternes-epam.

Built on open standards: AGENTS.md · Agent Skills · MCP

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

Frequently asked questions

Is apm free to use?

apm is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does apm do?

Agent Package Manager

What is apm written in?

apm is primarily written in Python. Its source is publicly available at https://github.com/microsoft/apm, and it has 4,175 GitHub stars.