Portable by manifest
One apm.yml, every harness, every machine. The lockfile pins exact versions and content hashes so a fresh clone reproduces the same agent setup byte-for-byte.
APM is a dependency manager for AI agents. Declare the skills, prompts, instructions, plugins, and MCP servers your project needs in one apm.yml, then any developer runs apm install and gets the same agent context across GitHub Copilot, Claude Code, Cursor, OpenCode, Codex, Gemini, and Windsurf.
Portable by manifest
One apm.yml, every harness, every machine. The lockfile pins exact versions and content hashes so a fresh clone reproduces the same agent setup byte-for-byte.
Secure by default
Every install scans for hidden Unicode, pins content hashes, and gates transitive MCP servers behind explicit trust prompts. No opt-in required.
Governed by policy
apm-policy.yml is enforced at install time, including transitive MCP. Tighten-only inheritance flows enterprise -> org -> repo. See the Governance Guide.
curl -sSL https://aka.ms/apm-unix | shirm https://aka.ms/apm-windows | iexThen try it on a sample package:
apm install microsoft/apm-sample-package# apm.yml -- ships with your repo, like package.jsonname: my-projectversion: 1.0.0dependencies: apm: # Skills, prompts, agents, plugins -- from any GitHub repo, with version pinning - anthropics/skills/skills/frontend-design - microsoft/apm-sample-package - github/awesome-copilot/plugins/context-engineering#v2.1 - github/awesome-copilot/agents/api-architect.agent.md # GitLab, Azure DevOps, Bitbucket, Gitea, any git server - git: https://gitlab.com/acme/coding-standards.git path: instructions/security ref: v2.0 - dev.azure.com/acme/platform/_git/prompts/review.prompt.md - bitbucket.org/team/agent-rules#main mcp: # MCP servers governed by the same manifest - io.github.github/github-mcp-server - io.github.microsoft/playwright-mcpgit clone <repo> && cd <repo> && apm installThat’s it. Copilot, Claude, Cursor, OpenCode, Codex, Gemini, Windsurf — every harness configured in one command, every dependency pinned, every MCP server policy-checked before it touches disk.
Use a package
Install someone else’s primitives and run them on your harness. Start in the consumer ramp.
Author and publish
Build skills, prompts, plugins, or full packages others can install. Start in the producer ramp.
Govern at fleet scale
Policy, audit, and CI gating across the org. Start in the enterprise ramp.
APM is open source under the microsoft org, MIT-licensed. Built on AGENTS.md, Agent Skills, MCP. See the changelog for what shipped recently.