Technology Radar
Agent Package Manager is an open-source dependency manager for AI agent configuration. It works via a manifest that declares plugins, skills, instructions and MCP servers. We use it to publish versioned skills from a central repository instead of copy-pasting files around. It treats agent context as a supply chain, installing from Git repos or an agent plugin marketplace and scanning for hidden Unicode that could hijack behavior. Its lock files record content hashes and provenance, while its SBOMs export to CycloneDX and SPDX formats. Auditing detects drift, and a policy file constrains sources, scopes and primitives, making an enterprise harness reproducible and governed. It's still a pre-1.0, community-driven project, albeit one sponsored by a major player, so we place it in Trial rather than Adopt and expect competing solutions to follow.
