Package your agent setup once.Install it anywhere.
AgentPack is the compiler and governance layer for agent configuration. Bundle your instructions, skills, MCP servers, hooks and subagents into one pack — then install it with a lockfile, govern what agents can do, and carry it to every Claude surface. No account. No SaaS. Works from a fresh clone.
agentpack install github:owner/repo@ref#subpathOne command. Git is the default distribution — no registry required.
The problem
Agent configs are copy-pasted, ungoverned, and stuck on one platform.
Ungoverned copy-paste
Agent configs spread by pasting CLAUDE.md snippets and MCP blocks between projects. No versions, no review, no idea what a config actually lets an agent do.
No cross-surface reach
A setup tuned for the terminal doesn’t follow you to Cowork, Codex, or claude.ai. You rebuild it by hand for every surface — and the pieces drift.
No provenance or trust
Where did this config come from? Was it tampered with? What does it install? Today there’s no signature, no lockfile, no answer.
How it works
Pack → compile → install.
One source of truth, compiled to every surface’s native format.
agentpack packPack
Describe your setup once in a single AGENTPACK.yaml — skills, rules, hooks, slash commands, subagents, MCP servers. The smallest unit is an atom; a pack is a governed bundle of them.
agentpack pack exportCompile
AgentPack compiles that pack to each surface’s native format: .claude/ + .mcp.json for Claude Code, a plugin for Cowork, a chat bundle for claude.ai, .codex/ + AGENTS.md for Codex — and an Agent Plugins 1.0 directory for VS Code, Copilot, Cursor, ChatGPT, and Kiro.
agentpack installInstall
Install with a lockfile and a hash-chained history. Risk, permissions, and the exact file plan are shown before anything writes to disk — then it lands atomically, with rollback.
Compiles to the surfaces your team already uses:
- Claude Code
- Cowork
- Claude Desktop
- claude.ai (Chat)
- Codex
- Cursor
- ChatGPT Apps
- AGENTS.md
- Agent Plugins 1.0
Quickstart
Up and running in under a minute.
AgentPack isn’t on npm yet — that’s planned for the v0.3.0 promotion. Today you build the CLI from source. The same commands will work vianpx agentpackor a global install once it ships.
1. Build the CLI from source
git clone https://github.com/jckeen/agent-pack
cd agent-pack
pnpm install
pnpm build
alias agentpack="node $(pwd)/packages/cli/dist/index.js"2. Compile an existing CLAUDE.md into a pack
agentpack import ./CLAUDE.md --id you.my-pack --from claudeimport reads a CLAUDE.md / AGENTS.md and emits a structured pack.
3. Export it to a target surface
agentpack pack export . --target claude-code --profile safeProfiles gate capability: safe → standard → full → enterprise.
4. Install from git, then verify
agentpack install github:jckeen/agent-pack@master#examples/pr-quality \
--target claude-code --profile safe \
--project ./my-project --yesagentpack verify you.my-pack --chain--chain validates the hash-chained install history — works on any install today. Add --sig to enforce Sigstore signatures once a pack is published to the registry.
Governance — why teams choose it
A compiler gets you cross-platform. Governance is the moat.
The durable value isn’t the adapters — it’s the signed, versioned, policy-governed layer over them.
Signing & verification
Published packs are signed with Sigstore cosign keyless— OIDC identity → Fulcio cert → Rekor transparency log. No publisher-managed keys. verify --sigenforces signing by default; --expected-signerpins the identity you trust.Publishing & signing land with the hosted registry (not yet live); git-source install and --chain verification work today.
Risk & permission consent at install
Permissions, risk level (low/medium/high/critical), and the exact file plan are shown before anything writes to disk. A critical plan won’t install without an explicit --allow-critical.
Policy controls
A project-level agentpack.policy.json sets the rules every install must obey — require signatures, restrict profiles, allow only specific signers or publishers, deny atom types. Violations fail closed.
Optional registry for org distribution
Git is the default — you never need a server. An optional hosted registry adds cross-org discovery, schema-validated metadata, and admin-side quarantine of compromised versions.(Hosted registry is not yet live; git-source install works today.)
Portability — with honest ceilings
Most things cross cleanly. We tell you what doesn’t.
Skills and remote MCP servers are the universal crossers — they reach every Claude surface. Ambient instructions and rules have no globally- ambient home off the terminal, so they downgrade to on-invoke skills. A pack’s overall reach is bounded by its least-portable atom.
| Atom | Claude Code | Cowork | Claude Chat | Codex |
|---|---|---|---|---|
| skill | Full | Full (plugin) | Full — universal | Full |
| mcp_server (remote) | Full | Full | Full — connector | Full |
| command | Full | Plugin | Re-express as skill | Full |
| subagent | Full | Plugin | Not portable | Full |
| hook | Full | Plugin | Not portable | Full |
| instruction / rule | Full (CLAUDE.md) | On-invoke skill | Project instructions | AGENTS.md |
Source:docs/integration-roadmap.md. AgentPack reports each atom’s ceiling at compile time — no surprises after install.