apm: Manage Dependencies for AI Agent Setups

Overview

APM is a command-line dependency manager for the configuration and context used by AI coding agents. A project declares its agent-related dependencies in apm.yml; APM resolves packages and records the resulting setup in a lockfile so contributors can reproduce it across machines.

It is most useful when a team maintains agent context across multiple repositories or coding clients and wants shared, versioned configuration rather than manual setup. Its policy and security checks also target organizations that need to control which sources and package types are allowed.

Key Features

• Manages agent instructions, skills, prompts, agents, hooks, plugins, and MCP server dependencies from a project manifest.
• Resolves transitive dependencies and records resolved sources and integrity hashes in a lockfile.
• Installs packages from GitHub and other Git hosts, and supports plugin marketplaces.
• Compiles configuration for supported coding clients, including a Copilot instructions target.
• Scans installed content for hidden Unicode and supports on-demand auditing.
• Applies organization policies to constrain allowed sources, scopes, and primitives.
• Packages configuration for distribution and can export SBOM inventories from the lockfile.

Use Cases

• Development teams can check in a shared agent setup so new contributors can install consistent context with the project.
• Teams supporting several coding-agent clients can manage shared dependencies in one manifest rather than configure each client separately.
• Plugin authors can manage plugin dependencies and export packages in the standard plugin.json format.
• Security teams can define installation policies and use audits to detect disallowed sources or local configuration drift.
• CI maintainers can automate installation or audit checks as part of repository workflows.

Getting Started

Install with Homebrew on macOS:

brew install apm

Then run apm install in a project with an apm.yml manifest. See the README and quick start guide for other installation methods and setup details.

Considerations

APM manages what agent context gets installed; the README explicitly distinguishes this from the agent harness, which controls what runs. Agent clients may consume configuration differently, so check the documentation for supported targets and behavior. The repository metadata reports 228 open issues, which may be relevant when assessing project maturity or deciding whether a capability meets your needs.