APM (Agent Package Manager)

APM (Agent Package Manager) is an open-source, MIT-licensed command-line dependency manager for AI agents, published under the Microsoft GitHub organization. Projects declare the skills, prompts, instructions, plugins, and MCP servers they need in one apm.yml, and apm install deploys each primitive to the agent harnesses that support it. The latest release listed is v0.35.0.

What It Is

APM works like package.json or requirements.txt, but for AI agent configuration. A developer who clones a repo runs apm install and gets a configured agent setup, with transitive dependency resolution. An apm.lock.yaml lockfile pins resolved versions and content hashes so installs reproduce the same package content. Packages can be pulled from GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, Gitea, Gogs, or any git host.

The docs list support for GitHub Copilot, Claude Code, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf, and Kiro. Primitive types include instructions, skills, prompts, agents, hooks, plugins, and MCP servers.

Security and policy model

The project says every install scans for hidden Unicode, pins content hashes, and gates transitive MCP servers behind explicit declaration or trust. apm audit runs the checks on demand and can detect drift between a rebuilt agent context and the working tree. apm lock export can emit CycloneDX or SPDX inventories.

For organizations, apm-policy.yml is enforced at install time with tighten-only inheritance from enterprise to org to repo. The docs state that it governs what gets installed while the agent harness governs what runs. apm audit --ci can be wired into GitHub rulesets.

Authoring and distribution

Package authors can build skills, prompts, plugins, and full packages, then export standard plugin.json packages or bundle configuration with apm pack. Plugins can be installed from marketplaces, and a GitHub Action (apm-action) supports CI/CD workflows. apm compile -t copilot writes .github/copilot-instructions.md. Installation options include Homebrew, a shell script, a PowerShell script, pip, WinGet, and Scoop.