agentmd-cli

The package manager for AI coding-agent engineering standards.

npx agentmd-cli init

Scans your project, shows what it found, and installs the standards that match.

agentmd  scanning project…

  ✓ Docker                   Dockerfile
  ✓ TypeScript               tsconfig.json
  ✓ Prisma                   prisma/
  ✓ Next.js                  package.json (next)
  ✓ PostgreSQL               package.json (pg)

Recommended packages for claude:

  Backend        nextjs
  Database       prisma, orm, migration, schema-design, postgres, indexes
  Frontend       typescript, nextjs, server-components, routing, react
  Security       authentication, authorization, oauth, owasp
  Testing        unit, test-strategy, e2e, accessibility

  31 to install

Install these? [Y/n]

Then wire them into whichever agent you use:

npx agentmd-cli link

That writes the installed package list into CLAUDE.md, AGENTS.md, .cursor/rules/agentmd.mdc, GEMINI.md or .github/copilot-instructions.md — inside a delimited block, so your own content is never touched.

Commands

| Command | What it does | | --- | --- | | init | Scan the project, install what matches | | link | Wire installed packages into your agent config files | | search <query> | Search names, categories, descriptions | | list [model/category] | Browse the registry | | list --installed | What this project has | | info <package> | Details for one package | | install <package> | Install a package, or a whole category | | remove <package> | Uninstall | | outdated | What's changed upstream, and what you've edited | | update | Pull current versions | | validate | Check registry + manifest integrity | | agents | List supported agent config targets |

Package paths are <model>/<category>/<package>. A trailing slash installs the whole category:

agentmd install claude/Security/owasp    # one
agentmd install claude/Testing/          # all 11

Full reference: docs/cli.md

Updates respect your edits

agentmd update never overwrites a package you've edited. It reports the conflict and leaves it alone until you pass --force.

$ agentmd outdated

  ↑  claude/Testing/unit       update available
  ✎  claude/Security/owasp     edited locally

1 outdated, 1 modified, 24 current

The distinction comes from a SHA-256 checksum recorded at install time.

Where things go

| Path | What | | --- | --- | | .agentmd/presets/ | Package content | | .agentmd/manifest.json | What's installed, with version, checksum and source |

Commit both — that's how a team shares one set of standards, and how changes to your agent's instructions show up in code review.

Registry

3,157 packages across 20 categories and 11 model families (287 each): claude, deepseek, gemini, glm, grok, kimi, minimax, mistral, open-ai, qwen and sarvam-ai.

agentmd list claude              # all categories
agentmd list claude/Security     # packages, with descriptions

Security

This CLI distributes content your agent reads as instructions, so:

• Package content is never executed — it's markdown written to disk.
• HTTPS only; a redirect to plaintext HTTP is refused.
• Writes are resolved against .agentmd/presets/ and refuse to escape it.
• Fetches are bounded by timeout, redirect count and response size.
• No accounts, no telemetry, one runtime dependency (picocolors).

Packages are not signed — see SECURITY.md for the full threat model, including what is not guaranteed.

Environment

| Variable | Meaning | | --- | --- | | AGENTMD_REGISTRY_BASE | Override the registry base URL (mirrors, testing) | | AGENTMD_TIMEOUT_MS | Per-request timeout, default 30000 | | AGENTMD_DEBUG | Print a stack trace on error |

Requires Node 18+.

Contributing

Adding a package is a directory and one markdown file — see CONTRIBUTING.md.

cd packages/cli && npm ci && npm test

MIT licensed.