MicrosoftAPM (Agent Package Manager) is a dependency manager for AI coding-agent configuration, in the role that package.json, requirements.txt, or Cargo.toml play for code. A project declares the instructions, skills, prompts, agents, hooks, plugins, and MCP servers its agents need in one apm.yml; a single APM command then resolves the full tree, including transitive dependencies, and deploys each primitive to the agent harnesses present on that machine. An apm.lock.yaml pins the resolved sources and content hashes so a fresh clone reproduces the same setup.
Targets include GitHub Copilot, Claude Code, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf, and Kiro. Dependencies can be pulled from GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, Gitea, Gogs, or any git host, and a dependency can be a whole package, a single skill, a single agent primitive file, or a curated marketplace entry. Pointing APM at a repo works as a drop-in for npx skills add, adding a manifest and lockfile.
APM treats agent context as executable: each dependency resolution scans content for hidden Unicode that could alter agent behaviour, the lockfile records integrity hashes, and transitive MCP servers require explicit consent before they are wired in. apm audit reruns those checks on demand and rebuilds the agent context in a scratch location to diff it against the working tree, catching hand edits. apm lock export emits a CycloneDX or SPDX inventory from the lockfile.
For organisations, an apm-policy.yml restricts which sources, scopes, and primitives a project may pull in. Policy inheritance is tighten-only from enterprise to org to repo, with a documented bypass contract and an audit-mode CI gate (apm audit --ci) that can be attached to branch protection. The policy governs what reaches disk; runtime behaviour remains the harness's concern.
APM also authors plugins: a package with dependency management can be exported as a standard plugin.json for Copilot, Claude, or Cursor, and apm pack bundles a configuration as a zipped package or standalone plugin. It pairs with agentrc, which generates .instructions.md files from a codebase in a format APM packages consume without conversion.
Features
- Single manifest: apm.yml declares instructions, skills, prompts, agents, hooks, plugins, and MCP servers in one file
- Lockfile: apm.lock.yaml pins the resolved tree, sources, and content hashes so every clone resolves the same content
- Multi-harness targets: Copilot, Claude Code, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf, and Kiro
- Any git host: GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, Gitea, Gogs
- Transitive resolution: packages depend on packages and the full tree is resolved
- Content security: hidden-Unicode scanning at resolution time, apm audit on demand, and trust prompts for transitive MCP servers
- Drift detection: apm audit rebuilds context in scratch and diffs it against the working tree
- SBOM export: apm lock export --format cyclonedx|spdx emits a standard inventory from the lockfile
- Policy governance: apm-policy.yml with tighten-only inheritance, a bypass contract, and apm audit --ci for branch protection
- Plugin authoring: build with dependency management and export standard plugin.json packages
- Marketplaces and packing: pull plugins from curated registries, and apm pack bundles a configuration for distribution
- Copilot compile: apm compile -t copilot writes .github/copilot-instructions.md with no extra configuration
