apm-cli

What it is and what it does

APM is a package manager designed specifically for AI coding agents. It lets you declare agent dependencies—skills, prompts, plugins, MCP servers, and agent configurations—in a single `apm.yml` manifest file, then installs and resolves them with transitive dependency support, just like npm or pip do for code. Every developer who clones your repository runs `apm install` and gets an identical, reproducible agent setup across Copilot, Claude, Cursor, and other supported agents.

The tool treats agent context as executable (since prompts are programs for LLMs) and enforces security by default: it scans for hidden Unicode that could hijack agent behavior, pins integrity hashes in a lockfile, and gates transitive MCP servers behind trust prompts. It also supports organizational governance through `apm-policy.yml`, letting security teams restrict which sources, scopes, and primitives developers can install. You can compile configurations into agent-specific formats (e.g., `.github/copilot-instructions.md` for Copilot) with a single command.

Use it for:

• Declare and share agent skills, prompts, and plugins across a team in one manifest file, ensuring every developer gets identical setup.
• Install MCP servers into multiple agent clients (Copilot, Claude, Cursor) from a single `apm install` command.
• Enforce organizational security policies on agent dependencies, blocking unapproved sources or primitives before they reach disk.
• Export agent configurations as standard plugin.json packages or zipped distributions for sharing across teams.
• Audit and detect drift in agent context by rebuilding from the manifest and comparing against the working tree.
• Integrate agent dependency management into CI/CD pipelines using GitHub Actions or branch protection rules.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

APM is a dependency manager and configuration tool for AI agents that resolves and installs agent primitives (skills, prompts, plugins, MCP servers) from git repositories into a reproducible, lockfile-pinned setup.

Yes. APM solves a real problem—reproducible, portable agent configuration—that has no established standard tool. It is actively maintained, has low install friction, carries a permissive MIT license, and integrates with major agent platforms. Install it if you manage agent setups across a team or need to version-control and audit agent dependencies. The 18 runtime dependencies are all common, well-maintained libraries (click, requests, GitPython, rich), so dependency risk is low.

Install

apm-cli on PyPI

pip install apm-cli

uv add apm-cli

poetry add apm-cli

Installing apm-cli

Before you install

Low friction: pure Python wheel with 18 runtime dependencies including click, requests, GitPython, and LLM integrations. Active maintenance with a release 8 days ago. Requires Python 3.10 or later.

License in practice

MIT License permits commercial and private use with minimal restrictions. You may use, modify, and distribute the software freely provided you include the original copyright notice and license text.

Quickstart

pip install apm-cli

apm install microsoft/apm-sample-package#v1.0.0

apm compile -t copilot

Requires Python 3.10 or later; git must be available for repository operations.

Verify before relying

• Whether APM's transitive dependency resolution handles circular dependencies or version conflicts in agent packages.
• Performance characteristics when resolving large dependency trees across multiple git hosts.
• Whether the security scanning (Unicode hijacking detection, content hashing) is cryptographically audited.
• How policy enforcement behaves when a package violates apm-policy.yml rules in CI/CD contexts.

Package facts

Evidence: apm_cli-0.28.0-py3-none-any.whl

Tags

More Build Tools packages

Further reading