Microsoft has quietly dropped APM, a dependency manager specifically engineered for AI agents, into the wild on November 7, 2026. This isn't just another package wrapper; it's a cross-harness solution that lets developers declare skills, prompts, instructions, plugins, and MCP servers in a single apm.yml file. The goal is straightforward: run apm install once, and let the tool deploy the correct primitives to whichever harness you're using, whether that's GitHub Copilot, Claude Code, or Cursor.

Portable by Manifest, Secure by Default

The core value prop here is portability and security. APM uses a lockfile that pins exact versions and content hashes, ensuring that a fresh clone resolves the same package content byte-for-byte. This eliminates the 'works on my machine' nightmare for agent configurations. More interestingly, the security model is aggressive. Every install scans for hidden Unicode characters, pins content hashes, and crucially, blocks transitive MCP servers unless they are explicitly declared or trusted. No opt-in required. It’s a defensive posture that recognizes MCP servers as potential attack vectors, not just utilities.

Governance and Policy Enforcement

For enterprise teams, APM introduces apm-policy.yml, which enforces governance at install time. This includes transitive MCP dependencies, with a tighten-only inheritance model flowing from enterprise to org to repo. This means you can lock down what agents can do at the organizational level, preventing rogue dependencies from slipping in. The runtime behavior remains the domain of the specific harness, but the supply chain is now governed by a central policy. The tool supports a wide array of git servers, including GitLab, Azure DevOps, Bitbucket, and Gitea, making it viable for diverse corporate infrastructures.

Installation and Ecosystem Integration

APM is open source under the Microsoft org with an MIT license, built on the emerging standards of AGENTS.md, Agent Skills, and MCP. Installation is straightforward via Homebrew on macOS, with support for pip, Scoop, and manual installs on Linux and Windows. A sample package microsoft/apm-sample-package is available for testing, showcasing how to pin dependencies from GitHub repos like anthropics/skills and github/awesome-copilot. The manifest supports version pinning and path-specific references, allowing for granular control over which agent skills are deployed.

Key Takeaways

  • APM standardizes AI agent dependencies across 9 major harnesses including Copilot, Claude, and Cursor.
  • Security is enforced by default, blocking untrusted transitive MCP servers and scanning for hidden Unicode.
  • Enterprise governance is handled via apm-policy.yml with tighten-only inheritance.
  • The tool is MIT-licensed and supports multiple git providers beyond just GitHub.

The Bottom Line

This is the plumbing layer the agent ecosystem desperately needed. By treating agent skills like npm packages, Microsoft is forcing a standard that will likely become the de facto baseline for enterprise agent deployment. The 'block by default' security model is a smart, if paranoid, move that signals Microsoft is serious about production-grade agent safety.