The Next Dependency Problem Is Inside Your AI Agent
Managing external dependencies for a software project has become an integral part of the software supply chain. Whether it’s application dependencies with tools like npm, Yarn, Composer, and so on. Or dependencies used by CI/CD workflows with tools like GitHub Actions, we’ve made considerable progress in managing dependencies across these layers.
Now that AI agents are an indispensable part of how we build our software, it’s important that we manage dependencies around them as well. You might wonder what dependencies an AI agent actually relies on.
Well, when we think about an AI coding agent, we tend to focus on the model and the instructions we give it. But an agent’s behaviour increasingly depends on external components like skills, prompts, instructions, plugins, MCP servers, and so on.
These components need the same things traditional application dependencies do: versioning, reproducible installation, update management, and security controls.
The good news is that we have a tool to manage that as well. It’s called Agent Package Manager, abbreviated as APM. It’s like npm but for agent context.
It essentially lets you reuse capabilities maintained elsewhere, potentially across multiple projects.
You can declare the external skills, prompts, instructions, plugins, and MCP servers your project needs in one apm.yml, then any developer runs apm install to deploy each primitive to the harnesses that support it.
A typical apm.yml file for a React project could look like so.
name: my-react-app
version: 1.0.0
description: "A simple React app"
targets: [claude, copilot, cursor]
type: hybrid
includes: auto
dependencies:
apm:
# Teach the agent to build better frontend interfaces
- anthropics/skills/skills/frontend-design
# Reusable engineering and context-management guidance
- github/awesome-copilot/plugins/context-engineering
# React best practices and performance guidelines
- vercel-labs/agent-skills/skills/react-best-practices
mcp:
# Model Context Protocol server providing live
# documentation access for coding assistants
- io.github.modelcontextprotocol/servers-docs
Running apm install resolves and installs these dependencies, while apm.lock.yaml records their resolved versions, exact commits, and content hashes to make subsequent installations reproducible.
APM supports several coding-agent environments, including GitHub Copilot, Claude Code, Cursor, Codex, and others.
How is this useful?
Imagine another developer clones your React project. They don’t need to manually configure Claude Code, search for useful skills, or copy instructions from another repository.
They simply run
apm install, APM reads the manifest and lockfile, and installs the same pinned dependencies. Both developers now have the same declared agent capabilities and instructions.
A sweet addition to this is Dependabot version updates now support Agent Package Manager. This means Dependabot can now automatically open pull requests to update supported git dependencies declared in your apm.yml files, saving you from manually tracking upstream changes in agent skills, prompts, and instructions. It automatically regenerates apm.lock.yaml files when they are present, ensuring your locked versions stay clean and consistent without manual intervention.
By adding an apm entry into your .github/dependabot.yml configuration, you can integrate agent package updates into your existing GitHub maintenance workflow.
# .github/dependabot.yml
version: 2
updates:
- package-ecosystem: "apm"
# Replace with the subfolder path if your
# apm.yml is not in the root directory
directory: "/"
schedule:
# Options include "daily",
# "weekly", or "monthly"
interval: "weekly"
One thing to keep in mind is that a changed skill or instruction can change an agent’s behaviour without changing application source code. And so, reviewing the actual content of an update PR matters, particularly when an agent has access to tools, repositories, or external services.
This also introduces a new responsibility for developers. We’re no longer just maintaining the dependencies that make our applications work; we’re also maintaining the dependencies that influence how our AI agents work.
As AI agents become a more regular part of software development, treating their skills, instructions, and tools as versioned dependencies will become just as important as managing application and CI/CD dependencies.
Because the code your AI agent writes is only as reliable as the context and capabilities it works with.
👋 Hi there! This is Amit, again. I write articles about all things web development. If you enjoy my work (the articles, the open-source projects, my general demeanour... anything really), consider leaving a tip & supporting the site. Your support is incredibly appreciated!
