CHchimpanzee2·Jun 24, 2026Submission
Microsoft Agent Package Manager
2 points · Open discussionmicrosoft
apm
Python2026–2026
microsoft / apm
apm
Agent Package Manager
5Distinct people
8Mentions
0Explicit recommenders
4.4KGitHub stars
What to know before exploring
What it is
Agent Package Manager
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by week8 dated mentions
Observed mentions: 2026-03-04 09:14:55 UTC to 2026-06-24 09:14:27 UTC. Weeks start Monday, UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Mar 2 | 2026-03-02 00:00:00 UTC | 2026-03-09 00:00:00 UTC | 1 | 1 | 0 |
| Mar 9 | 2026-03-09 00:00:00 UTC | 2026-03-16 00:00:00 UTC | 2 | 0 | 2 |
| Mar 16 | 2026-03-16 00:00:00 UTC | 2026-03-23 00:00:00 UTC | 2 | 2 | 0 |
| Mar 23 | 2026-03-23 00:00:00 UTC | 2026-03-30 00:00:00 UTC | 1 | 0 | 1 |
| Mar 30 | 2026-03-30 00:00:00 UTC | 2026-04-06 00:00:00 UTC | 1 | 1 | 0 |
| Apr 6 | 2026-04-06 00:00:00 UTC | 2026-04-13 00:00:00 UTC | 0 | 0 | 0 |
| Apr 13 | 2026-04-13 00:00:00 UTC | 2026-04-20 00:00:00 UTC | 0 | 0 | 0 |
| Apr 20 | 2026-04-20 00:00:00 UTC | 2026-04-27 00:00:00 UTC | 0 | 0 | 0 |
| Apr 27 | 2026-04-27 00:00:00 UTC | 2026-05-04 00:00:00 UTC | 0 | 0 | 0 |
| May 4 | 2026-05-04 00:00:00 UTC | 2026-05-11 00:00:00 UTC | 0 | 0 | 0 |
| May 11 | 2026-05-11 00:00:00 UTC | 2026-05-18 00:00:00 UTC | 0 | 0 | 0 |
| May 18 | 2026-05-18 00:00:00 UTC | 2026-05-25 00:00:00 UTC | 0 | 0 | 0 |
| May 25 | 2026-05-25 00:00:00 UTC | 2026-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 1 | 2026-06-01 00:00:00 UTC | 2026-06-08 00:00:00 UTC | 0 | 0 | 0 |
| Jun 8 | 2026-06-08 00:00:00 UTC | 2026-06-15 00:00:00 UTC | 0 | 0 | 0 |
| Jun 15 | 2026-06-15 00:00:00 UTC | 2026-06-22 00:00:00 UTC | 0 | 0 | 0 |
| Jun 22 | 2026-06-22 00:00:00 UTC | 2026-06-29 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
8 sourcesShow HN: A tool to solve the Agent Supply Chain pandora box
An OSS tool I built to manage agent configuration (plugins, skills, et al) as we do code dependencies. With a portable manifest, lockfile, and audits.
APM ships as a CLI. Install it first e.g. with brew or pip and then:
"apm install <org>/<repo>" or "apm install plugin@marketplace"
That will resolve the dependency (through Artifactory if configured too) and pin the sha or version to the lockfile after scanning for hidden unicode. It then deploys to any agent runtime you may be using (e.g. Copilot, Codex, Cursor, Claude).
I built this over a year working with large scale enterprises clamoring for it.
1 points · Open discussionThe distribution problem is harder than it looks because it's actually a composition problem in disguise. A single skill is trivially shareable — zip it, gist it, whatever.
But in practice you end up with skills that depend on other skills, or a skill that assumes specific instructions are already loaded, conflicting skills, versioning and supply chain issues - and suddenly you need dependency resolution.
I've built a package-manager approach for this (APM - github.com/microsoft/apm) and the thing that surprised me most was how quickly even small teams end up with config sprawl - and how much a manifest that travels with the project helps.
The "too small for a repo" thing is real, but one pattern that works is having a monorepo per dev team or org with all skills and building jointly over there.
In Skills are quietly becoming the unit of agent knowledgeShow HN: Agent Package Manager (APM) for Agent Configuration
I work at Microsoft/GitHub and built APM because I was managing agent configs — prompts, instructions, MCP servers — across Copilot, Claude Code, and Cursor. Every new project meant copying skill files, installing plugins by hand, hoping nothing drifted upstream. I realized we were missing the dependency management layer for this new category of config to unlock faster adoption, composability and innovation.
APM (Agent Package Manager) is an open-source CLI that installs and manages AI agent dependencies (plugins, skills, rules, hooks, mcp, etc). It resolves transitive dependencies, pins versions with a lock file, and scans content for supply-chain attacks.
This was posted a couple days ago without context (https://news.ycombinator.com/item?id=47421969). Here's the full story.
1 minute video: https://github.com/microsoft/apm/releases/down
Read the rest
load/v0.8.2/ap...
How it works:
apm install — resolves any Agent Primitive (plugins, skills, hooks, rules...) and their transitive dependency tree from any git host. Plugin A depends on Plugin B and a shared MCP server? APM walks the tree. One command deploys to Copilot, Claude Code, Cursor, and OpenCode. Full agent setup ready to go for any dev with 1 command.
apm.lock — every resolved dependency pinned to exact commit SHA. Diff it in PRs. Same plugin set, every developer, every CI run.
apm pack — author plugins that compose on other agent config dependencies via apm.yml. Bundle as portable archives; apm unpack for offline environments. You can import other skills, rules or plugins in the plugins you author.
apm audit — scans for hidden Unicode characters (variation selectors, bidi marks) and outputs SARIF for CI. Agent instructions have direct access to your codebase and terminal. Scanning what goes into them matters.
Why this won't come from plugin vendors: each tool governs its own ecosystem. GitHub governs Copilot. Anthropic governs Claude. Nobody governs across tools, resolves cross-plugin dependencies, or gives consumers a lock file for what they actually installed. We need portability.
Packages are git repos — no registry, no signup. apm pack outputs valid plugin-native format, so if you stop using APM your plugins still work. Too early for true package artifacts, maybe down the road.
MIT-licensed under the Microsoft OSS github org and community driven.
External contributors shipped Cursor, OpenCode, Artifactory and Windows support.
Docs: https://microsoft.github.io/apm
Repo: https://github.com/microsoft/apm
Love the concept and agree it can become a thing. On the schema, not sure about skillflows, tools, knowledge, memory - those aren't much standardized today, but agree they help as additional primitives, and standardizing would help.
I built Agent Package Manager at Microsoft - wondering if it may supercharge GitAgents with dependency modules so that they can become composable, same as for classic software. Many common core ideas on the paradigm, curious on your take https://github.com/microsoft/apm
Similar idea (rooted on "agents as markdown") but on the outer loop is taking shape at GitHub with GitHub Agentic Workflows.
In Show HN: GitAgent – An open standard that turns any Git repo into an AI agentThe three-file split is a clean design — separating personality from capabilities from config mirrors how most frameworks model agents internally, which probably makes the export layer more natural. Curious how you handle the capability gap when exporting though: if I define a SKILL.md that relies on tool-use patterns CrewAI supports but Claude Code doesn't (or vice versa), does the export silently drop it, or does `gitagent validate` catch that mismatch? That's where I've found portability across frameworks gets genuinely hard — the abstractions don't line up 1:1. I've been working on related problems from the dependency-management angle (github.com/microsoft/apm), more about making agent configuration reproducible across a team than portable across frameworks, and the framework divergence keeps being the hardest part.
In Show HN: GitAgent – An open standard that turns any Git repo into an AI agentAPM – Agent Package Manager (Microsoft)
2 points · Open discussion