Set Up Every AI Coding Agent From One File for €0 With Microsoft APM
In short
- APM is a free, MIT-licensed package manager from Microsoft. It installs the same agent skills, prompts, plugins and MCP servers into nine different coding tools from one file.
- You write an apm.yml, run apm install, and every teammate gets the same setup after a git clone.
- The money angle: no more hand-copying agent setup into every project. On my example numbers that saves about €670 a year for a four-person team.
You set up your coding agent once. Then you start a new project and set it up again. Then a teammate joins and sets it up a third way. That is paid time, thrown away.
The old fix is a wiki page and a folder of files to copy. The new fix is a package manager for agent context. Cost: nothing.
What APM is
APM stands for Agent Package Manager. The docs describe it as npm for agent context. You list what your agents need in one file, and a single command puts it in the right place for each tool.
It lives in Microsoft’s GitHub organization and is open source under the MIT license. The docs page I used was last updated on October 22, 2026. Microsoft’s docs list these supported tools: GitHub Copilot, Claude Code, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf and Kiro.
What it costs
| Item | Price |
|---|---|
| APM itself (MIT, open source) | €0 |
| Installing packages from git servers | €0, you pay only for hosting you already have |
| The agent tools it feeds | Whatever you already pay for them |
How to set it up
I list only the steps the official docs show. Check the docs for your own platform.
- Install APM. On macOS with Homebrew, run
brew install apm. The docs also cover pip, Scoop, manual installs and standalone Unix installers. On Unix you may need to adjust your PATH. - Try the sample package. Run
apm install microsoft/apm-sample-package. This is Microsoft’s own example, so you see what lands where before you trust anything of your own. - Create apm.yml in your project root. It has a name, a version and a dependencies section.
- Fill the two lists. Under
apmyou put packages from GitHub, GitLab, Azure DevOps, Bitbucket or any git server, with an optional path and a version reference such as#v2.1. Undermcpyou put MCP servers, for exampleio.github.github/github-mcp-server. - Run apm install. It deploys what you declared to the supported tools on your machine.
- Commit apm.yml. A teammate then runs
git clone <repo> && cd <repo> && apm installand gets the same setup.
Pin versions with the # reference. If a package changes tomorrow, your agents should not change with it.
The security part, which matters
Skills and prompts are instructions to an agent that can run commands. A bad one is a real attack. The APM docs say installs scan for hidden Unicode, pin content hashes, and block transitive MCP servers unless you declared or trusted them.
There is also an apm-policy.yml file that is enforced at install time. Policy can only get stricter as it moves from enterprise to organization to repository. A repo cannot loosen what the company set. For a team with clients’ data, that is the feature that matters most.
Do the math
These are my assumptions, not Microsoft’s numbers. A four-person team starts 10 projects a year. Setting up agent skills and servers by hand takes 45 minutes per person per project. At €25 an hour, that is 4 × 0.75 h × €25 = €75 per project, or €750 a year.
With APM, each person spends about 5 minutes on a clone and an install. That is 4 × 5 min = 20 minutes, about €8 per project, or about €83 a year. The saving is roughly €667 a year. Not life-changing. But it also removes the “works on my setup” problem, and that one costs more than the minutes.
Where it fits
Three cases where it clearly pays. First, a small agency with several client repos that all need the same agent rules. Second, a team that mixes tools, say one person on Claude Code and another on Cursor. One apm.yml serves both. Third, an owner who wants the same MCP servers on a new laptop in five minutes.
If you work alone in one tool and one repo, you do not need it. Keep your files in a folder and move on.
A safe rollout plan for a team
Do not switch everyone on Monday. Pick one small repo and one person. Run the sample package, then write a minimal apm.yml with two or three packages you have already read. Pin each one with a version reference.
After a week, ask what broke. If nothing did, add the file to a second repo and let one more teammate clone and install. Only then write it into your onboarding page. A month of this costs you maybe three hours and gives you a setup you can actually trust.
nnLimits and weak spots
Be honest about what it is. The docs say the manifest example follows a working-draft contract and omits the $schema line. They also say older published schemas reject the git-plus-path form. In plain words: the format is still moving.
APM installs things. It does not control runtime behavior, because each tool decides how it uses a skill. The same package can behave a bit differently in two tools. And a package manager is only as safe as the packages you choose. Read what you install, and prefer sources you trust.
Alternatives
- A shared folder in your repo. Copy skills and prompt files by hand. Free, simple, and it breaks the moment you use two tools.
- Symlinks between config files. One developer wrote this month that keeping AGENTS.md and CLAUDE.md in sync by copy or symlink was one of his daily annoyances. Works for two files, not for twenty.
- Each tool’s own plugin install. Fine if you use one tool. You repeat the work for every extra one.
Ivan’s Take
Worth it if you have a team or more than one tool. It is free, it is MIT, and the policy file is the right idea. I would test it on one non-critical repo first, pin every version, and read each package before it touches my machine. For a solo builder in one tool, skip it for now. Come back when the format is stable.
Sources: Microsoft · Caleb Software
If it doesn’t save you time or money, you won’t see it here
- Facts, not hypeEvery price and number is checked against the official source
- Always the real priceYou see what it costs before you click
- I say when it’s weakEven when it’s OpenAI or Google
