microsoft/apm

APM – Agent Package Manager

What it is

• An open‑source dependency manager specifically for AI‑driven coding agents (Copilot, Claude, Gemini, etc.).
• Works like npm or pip but the manifest (apm.yml) lists agent primitives: skills, prompts, plugins, MCP servers, and whole agent packages.

Core ideas

1. Portable by manifest – One apm.yml (plus a lockfile) fully describes the agent’s context. Running apm install reproduces the exact same setup on any machine.
2. Secure by default – Packages are scanned for hidden Unicode, content hashes are stored in apm.lock.yaml, and an apm audit command can detect drift or compromised assets.
3. Governed by policy – An optional apm-policy.yml lets organisations whitelist sources, scopes, and primitives, and integrates with GitHub rulesets for CI enforcement.

Key features

• Transitive dependency resolution – Packages can depend on other packages; the lockfile pins the whole tree.
• Plugin authoring – Build Copilot/Claude/Cursor plugins with proper dependency tracking and export a standard plugin.json.
• Marketplace support – Install bundles from curated registries with a single command.
• Packaging – apm pack creates a zip or standalone plugin for distribution.
• CI/CD integration – Microsoft‑maintained GitHub Action (microsoft/apm-action) runs audits and lockfile checks automatically.
• SBOM export – Generate CycloneDX or SPDX inventories directly from the lockfile.
• MCP (Model Context Protocol) server handling – Declare remote context‑servers in the manifest; installation enforces explicit trust.

Getting started

# macOS (Homebrew)
brew install apm

# Linux/macOS (script)
curl -sSL https://aka.ms/apm-unix | sh

# Windows (PowerShell)
irm https://aka.ms/apm-windows | iex

Other options: pip install apm-cli, WinGet, or Scoop.

Typical workflow

# apm.yml – placed in your repo
name: my‑project
version: 1.0.0
dependencies:
  apm:
    - anthropics/skills/skills/frontend-design   # a skill collection
    - github/awesome-copilot/plugins/context-engineering
    - microsoft/apm-sample-package#v1.0.0
  mcp:
    - name: io.github.github/github-mcp-server
      transport: http

# After cloning the repo
apm install          # resolves, verifies, and writes the agent context
apm compile -t copilot   # emits .github/copilot‑instructions.md
apm audit               # checks for drift or security issues

Who might use it

• Teams building AI‑coding assistants that need reproducible skill sets and prompts.
• Enterprises that want to enforce security and policy around what LLM‑agents can execute.
• Plugin developers who want a formal package format and dependency graph.
• CI pipelines that need to verify agent configurations before deployment.

Project health

• Actively maintained by Microsoft contributors (Daniel Meppiel, Sergio Sisternes).
• Documentation site, quick‑start guide, and road‑map are provided.
• Releases are published as native binaries for macOS, Linux, and Windows, plus package managers (Homebrew, pip, WinGet, Scoop).
• Community channels: Discussions, GitHub Action, and a roadmap project.

---

All information is taken directly from the repository’s README.