// APM × Coding Agents

npm for agentic artifacts.

A library of Agent Package Manager (APM) stacks that lets engineering teams share skills, agents, hooks, and coding standards once — and have every teammate get the same setup, whether they use Claude Code, Copilot, Cursor, or OpenCode.

Get started on GitHub How it works Browse 20 stacks

apm.yml

# apm.yml
name: my-project
version: 1.0.0

dependencies:
  apm:
    - thinkjones/awesome-apm-stacks/code-core
    - thinkjones/awesome-apm-stacks/code-python
    - thinkjones/awesome-apm-stacks/security-core
    - thinkjones/awesome-apm-stacks/test-core

$ apm install && apm compile → one setup, every agent

Curated stacks

Battle-tested sources

300K+

Combined GitHub stars

Supported agents

Production-ready

// Workflow

Three commands. Any agent.

Author once in open formats — Agent Skills, AGENTS.md, MCP — and APM compiles to whichever runtime your team is using this quarter.

Declare

List the stacks your project needs in a single apm.yml — skills, agents, hooks, MCP servers, instructions.

dependencies:
  apm:
    - code-core
    - security-core

Install

apm install fetches packages, scans for hidden Unicode or compromised deps, and caches them locally.

$ apm install

✓ resolved 7 packages
✓ security scan clean

Compile

apm compile emits the right shape for your agent — CLAUDE.md, AGENTS.md, .cursor/, .opencode/.

$ apm compile

→ CLAUDE.md
→ AGENTS.md
→ .cursor/

// Why Teams Adopt This

Different teammates.
Different agents.
Same standards.

Reproducible across teammates

git clone && apm install and every developer gets the exact same agent setup. No more "works on my machine" for AI tooling.

Portable across runtimes

Switch from Claude Code to Copilot to Cursor without rewriting a single skill. Same apm.yml, re-compile, done.

Composable by concern

Small focused packages combine via transitive deps, just like npm. Pull in only what each project needs.

Versioned like real software

Pin exact versions, lock files, audit history. Treat agent config with the same discipline as application code.

Secure by default

apm install scans for hidden Unicode and compromised packages before your agent ever reads them.

Battle-tested sources only

Every dependency comes from a repo with 1,000+ GitHub stars. Most have 10K+. No abandoned forks, no homemade scripts.

// 20 Stacks, Six Concerns

Pick your stacks.
Compose like npm.

Each package is a small, opinionated bundle — 30 lines of YAML composing battle-tested dependencies from repos with 1,000+ GitHub stars. Open any apm.yml and comment out what you don't need.