Agent Package Manager
npm for AI agent configs with transitive deps and unicode attack scanning.
Engineering teams using AI coding agents like Copilot, Cursor, or Claude Code
npm · MCP Registry · Cursor shared settings
APM ships as a CLI. Install it first e.g. with brew or pip and then:
"apm install <org>/<repo>" or "apm install plugin@marketplace"
That will resolve the dependency (through Artifactory if configured too) and pin the sha or version to the lockfile after scanning for hidden unicode. It then deploys to any agent runtime you may be using (e.g. Copilot, Codex, Cursor, Claude).
I built this over a year working with large scale enterprises clamoring for it.
Deterministic dependency review with cross-stack scanning, but Dependabot, Snyk, and Renovate dominate CI dependency automation.
Self-hosted patch manager for homelabs, but Ansible and Spacewalk already solve this.
Dependabot already does this without the AI agent overhead.
Tarball diffing plus Claude analysis catches build.rs backdoors cargo-audit misses.
White-box agent red teaming finds 5x more vulns than black-box prompt injection.
Reimplements dependency functions locally with test verification, challenging the "dependencies are good" mantra.