microsoft/apm

What it solves

AI coding agents require specific context—such as prompts, skills, plugins, and standards—to be effective. Currently, developers must set these up manually, making agent configurations non-portable and difficult to reproduce across different machines or team members.

How it works

APM acts as a dependency manager for AI agents, similar to how npm or pip works for software libraries. It uses a manifest file (apm.yml) to declare agentic dependencies, including instructions, skills, prompts, and MCP servers. When a user runs apm install, the tool resolves the dependency tree (including transitive dependencies), fetches the required primitives from git hosts or marketplaces, and configures the agent setup. It also generates a lockfile (apm.lock.yaml) to ensure reproducibility and can compile these configurations into formats recognized by specific clients like GitHub Copilot.

Who it’s for

Developers and security teams who want to standardize, share, and govern the configuration of AI coding agents across an organization or project.

Highlights

• Cross-Client Compatibility: Deploys configurations across multiple agents including Copilot, Claude, Cursor, Gemini, and Windsurf.
• presentable Manifests: Uses apm.yml for declarations and apm.lock.yaml for pinned, reproducible environments.
• Security Scanning: Scans for hidden Unicode hijacks and uses integrity hashes to prevent compromised packages from reaching the agent.
• Enterprise Governance: Allows security teams to enforce allowed sources and primitives via apm-policy.yml.
• MCP Integration: Simplifies the installation and management of Model Context Protocol (MCP) servers.