APM: dependency manager for AI agents
APM is an open-source, community-driven dependency manager for AI agents.
Verified
Core facts
Read by a script from the official API, not rewritten by a model.
- Repository
- https://github.com/microsoft/apm
- License
- MIT
- Languages
- Python
- Maintainer
- microsoft
- Homepage
- https://microsoft.github.io/apm/
- Verified
What it is
APM is an open-source, community-driven dependency manager for AI agents. With it, a project's agentic dependencies are declared once in apm.yml. AI coding agents need context to be useful, such as standards, prompts, skills and plugins. The project's tagline is "Portable by manifest. Secure by default. Governed by policy."
Main features
Packages can depend on packages, and APM resolves the full tree.
APM builds Copilot, Claude, and Cursor plugins with dependency management, then exports standard plugin.json.
APM marketplaces install plugins from curated registries in one command.
The apm pack command bundles configuration as a zipped package or a standalone plugin.
APM provides a GitHub Action for automated workflows.
An APM manifest, declared once, is deployed across Copilot, Claude, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf and Kiro.
Getting started
APM publishes native release binaries for macOS, Linux, and Windows x86_64.
When APM is installed with Homebrew, Homebrew manages installation and updates, and no custom tap is required.
For standalone installations, apm self-update reuses the matching platform installer.
Other install methods are pip, WinGet, and Scoop.
APM can also add an MCP server, wired into Copilot, Claude, Cursor, Codex, OpenCode, Gemini, Windsurf, and Kiro.
Who it is for
You do not need Homebrew to use APM. Agent context is executable in effect, since a prompt is a program for an LLM. Every install scans for hidden Unicode that can hijack agent behavior.
The apm install command blocks compromised packages before agents read them. The apm audit command runs the same checks on demand. The lockfile pins integrity hashes.
The apm.lock.yaml file pins the resolved tree. Transitive MCP servers are gated by trust prompts. Transitive MCP servers require explicit consent.
The apm audit command rebuilds agent context in scratch and diffs it against the working tree to catch hand-edits before they ship. SBOM export emits a standard inventory of what reached disk, straight from the lockfile; it is provenance for procurement, not a compliance attestation. The apm-policy.yml file governs what gets installed, while the agent harness governs what runs.
The two planes do not overlap.
Related tools
Related tools listed on this site.
EveryGen AI
Video generator and creative studio describing scene planning, clips, image editing, voices, music and video assembly.
QwenPaw
Personal AI assistant and agent workstation running in your own environment. Its primary description presents local/cloud deployment, multiple channels and extension through Skills and MCP.
Cursor
A coding agent for understanding repositories, planning features, changing code, and reviewing diffs.
CodeBuddy IDE
AI coding workspace for product, design and development. Its dedicated IDE documentation describes technical conversations, code completion, Figma-to-code, diagnostics and a design-to-deployment workflow.
InfCode
Enterprise AI coding agent from TokensInfinity. Its site describes using enterprise code and knowledge through IDE, extension and CLI forms for completion, cross-file changes and engineering tasks.
阿里云百炼
Alibaba Cloud Bailian is a model-service and application-development platform for model inference, knowledge bases, agents and workflows.
千问云
The discovered Qianwen Cloud entry currently presents the Qianwen AI Platform for model discovery, online trials, API access, Skills/CLI tooling and usage/cost management.
Figma AI
Collection of AI workflows and capabilities within Figma products for design exploration, content editing and connecting prototypes with code.
Pixso AI
AI design capability integrated into the Pixso canvas. Its official page describes generating editable web and mobile interfaces from text, sketches or screenshots and continuing to refine existing designs.
Ardot
AI design and collaboration tool. Its official site describes text/image-to-editable UI, vector editing, dynamic layouts and design systems, plus collaboration, annotations and design-to-development handoff.
纳米AI
Nano AI is an AI search and agent assistant whose site says it can generate videos, reports and slides from one sentence and integrates several large models.
Exa AI
Exa is a web-retrieval service for AI applications and agents, describing search, content retrieval, deep research and structured-output APIs.
Related guides
- skill-creator: Anthropic's skill for writing, editing and evaluating skillsAnthropic's skill-creator skill: draft a skill, run evals, revise it and tune its trigger description. Not tested here; follow the official text and docs.
- webapp-testing Skill: drive local web apps with PlaywrightOfficial Anthropic webapp-testing Skill: Python Playwright scripts for local web apps, not tested
- frontend-design: avoiding templated defaults in UI designAnthropic's frontend-design skill: plan the visual direction, check it against the brief, avoid templated defaults. Not tested; follow the official text.
- gh-address-comments: work through GitHub PR review commentsOfficial OpenAI Codex skill: fetch comments on the current branch's PR with the gh CLI, number them, then fix only the ones you pick; not tested.
- security-best-practices: language- and framework-specific security reviewOfficial OpenAI Codex skill: load security references matching the project's language and framework, then write safer code or a report; not tested.
Sources
This page is written from the official sources below. Open them to check the original text.
- GitHub READMEhttps://github.com/microsoft/apmFetched
Verified ·
This page is written by AI from the official sources above and checked automatically. This site has not tested it. Found a mistake? Tell us.