StackMap
Subscribe
Explore / apm
microsoft

apm

Microsoft's dependency manager for agent context — declare skills, prompts, plugins and MCP servers in apm.yml; one install reproduces the setup across 8 clients with lockfile pinning and org policy.

3,254 290 Python MITupdated today
codingskills
View on GitHubDispute this mapping →
Curator's take

The team/enterprise answer: apm.yml ships with the repo, so `git clone && apm install` gives every developer identical agent context — lockfile, transitive dependencies, drift detection, and an apm-policy.yml a security team can enforce with tighten-only inheritance. It's the only skill manager with a real governance story (SBOM export, MCP trust gates). NOT for quick personal use — manifest ceremony is overkill for 'just install this skill', where skillkit or asm is faster — and it targets 8 major clients, not the 40+ long tail. Young project; treat the roadmap as direction, not promise.

Mapped by ShipWithAI editors · links verified
README.md

APM – Agent Package Manager

An open-source, community-driven dependency manager for AI agents.

Think package.json, requirements.txt, or Cargo.toml — but for AI agent configuration.

GitHub Copilot · Claude Code · Cursor · OpenCode · Codex · Gemini · Windsurf · Kiro

Documentation · Quick Start · CLI Reference · Roadmap

Portable by manifest. Secure by default. Governed by policy. One file describes every agent's context; one command reproduces it everywhere; one policy controls what an org will allow.

Why APM

AI coding agents need context to be useful — standards, prompts, skills, plugins — but today every developer sets this up manually. Nothing is portable nor reproducible. There's no manifest for it.

APM fixes this. Declare your project's agentic dependencies once in apm.yml, and every developer who clones your repo gets a fully configured agent setup in seconds — with transitive dependency resolution, just like npm or pip. It's also the first tool that lets you author plugins with a real dependency manager and export standard plugin.json packages.

# apm.yml — ships with your project
name: your-project
version: 1.0.0
dependencies:
  apm:
    # Skills from any repository
    - anthropics/skills/skills/frontend-design
    # Plugins
    - github/awesome-copilot/plugins/context-engineering
    # Specific agent primitives from any repository
    - github/awesome-copilot/agents/api-architect.agent.md
    # A full APM package with instructions, skills, prompts, hooks...
    - microsoft/apm-sample-package#v1.0.0
  mcp:
    # MCP servers -- installed into every detected client
    - name: io.github.github/github-mcp-server
      transport: http   # MCP transport name, not URL scheme -- connects over HTTPS

git clone <org/repo> && cd <repo>
apm install    # every agent is configured

Coming from npx skills add? Drop-in:

apm install vercel-labs/agent-skills                            # whole bundle, like npx skills add
apm install vercel-labs/agent-skills --skill deploy-to-vercel   # one skill, persisted to apm.yml

Same install gesture. You also get a manifest, lockfile, and reproducibility.

Zero-config Copilot:

apm compile -t copilot   # writes .github/copilot-instructions.md

One command, no configuration -- VS Code and GitHub Copilot read the file automatically. APM dogfoods this target on its own repository.

The three promises

1. Portable by manifest

One apm.yml describes every primitive your agents need — instructions, skills, prompts, agents, hooks, plugins, MCP servers — and apm install reproduces the exact same setup across every client on every machine. apm.lock.yaml pins the resolved tree the way package-lock.json does for npm.

  • One manifest for everything — declared once, deployed across Copilot, Claude, Cursor, OpenCode, Codex, Gemini, Windsurf, Kiro
  • Install from anywhere — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, Gitea, Gogs, any git host
  • Transitive dependencies — packages can depend on packages; APM resolves the full tree
  • Author plugins — build Copilot, Claude, and Cursor plugins with dependency management, then export standard plugin.json
  • Marketplaces — install plugins from curated registries in one command, deployed across all targets and locked
  • **[Pack

Continue your stack

What teams reach for next — and why each earns a place beside apm. Ranked by curator confidence.

Alternative to See all + compare →
skillkit

Package manager for AI agent skills — install from 400K+ skills across 31 sources, auto-translate between 46 agents' incompatible formats, security-scan on install, sync to every agent at once.

Why it fitsOverlapping job, different model: skillkit is an imperative installer + format translator chasing breadth (46 agents, 400K skills); apm is declarative — manifest, lockfile, transitive deps, org policy — chasing reproducibility. apm's README even ships a 'coming from npx skills add' migration.
asm

Scriptable skill manager for AI coding agents — install, search, dedupe-audit and security-scan skills across 19 providers, with --json/--yes on every command so agents and CI can drive it.

Why it fitsBoth manage agent skills across tools, at different layers: asm is an imperative, machine-driven CLI for installing and auditing skills on one workstation; apm is a declarative project manifest — apm.yml + lockfile ships with the repo so the whole team reproduces the same agent context.
ECC

Cross-harness 'operating system' for coding agents — 268 skills, 66 agents, hooks, rules, memory persistence, instinct-based continuous learning and AgentShield security scanning. MIT.

Why it fitsBoth ship reproducible agent-context setups across many clients. apm is a lean dependency manager (declare skills/prompts/MCP in apm.yml, lockfile-pinned installs); ECC ships the content itself — a batteries-included catalog of skills, agents, hooks and rules.