{ "data": { "category": { "area": "frameworks", "capabilities": [ "agent.packages", "agent.mcp-client", "agent.multi-agent" ], "description": "Tools that install, pin and share what coding agents load, skills, plugins, MCP servers and settings, across several agents and machines, the way a lockfile pins a project's libraries. Compared on what they pin and how (versions, commits or content hashes), which agents they stage for, what runs at install time, and what they share between machines.", "json": "https://www.anchorterminal.com/categories/agent-packages.json", "name": "Agent package managers", "slug": "agent-packages", "test": "The same set of skills, plugins and MCP servers added to a fresh project, synced into two coding agents on two machines, then one upstream skill changed. We check that both agents get identical files, that the change waits until it's updated on purpose, what runs during install, and what crosses between the machines.", "title": "Package managers for coding agents", "toolCount": 1, "tools": [ "agentpack" ], "url": "https://www.anchorterminal.com/categories/agent-packages" }, "tools": [ { "slug": "agentpack", "name": "Agentpack", "vendor": "Oleg Pustovit", "vendorUrl": "https://olegpustovit.github.io/agentpack/", "kind": "harness", "category": "agent-packages", "summary": "Agentpack is an MIT-licensed Go CLI that pins skills, plugins and MCP servers in a lockfile and stages them for seven coding agents. Its gateway runs agent sessions across a person's Tailscale machines and answers MCP at `/mcp`.", "url": "https://www.anchorterminal.com/tools/agentpack", "markdownUrl": "https://www.anchorterminal.com/tools/agentpack.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/agentpack.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/agentpack.json", "dns": "agentpack.grade.anchorterminal.com", "repo": "https://github.com/olegpustovit/agentpack", "license": "MIT (Copyright (c) olegpustovit and contributors)", "transports": [ "streamable-http" ], "packages": [], "auth": "oauth", "authNotes": "No account for the CLI. The gateway's browser app needs a root account, created with a one-time setup token and a bcrypt-hashed password of 12 to 72 bytes. The MCP endpoint takes OAuth with PKCE (S256) and dynamic client registration under one scope, `agentpack`, which covers every machine the gateway reaches, terminal input and package installs. Access tokens last an hour and refresh grants 30 days, with a revocation endpoint. Tailnet peers are authenticated by Tailscale WhoIs.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy. Model usage is billed by each coding agent's own plan or key, and the multi-machine gateway needs Tailscale.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the docs or the changelog, read on 2026-11-01. The project sells nothing.", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-01" }, "docsUrl": "https://olegpustovit.github.io/agentpack/", "capabilities": [ "agent.packages", "agent.multi-agent" ], "tags": [ "open-source", "mit", "local", "self-hosted", "free", "no-card", "go", "cli", "mcp", "streamable-http", "agent-skills", "macos", "linux", "windows" ], "lastRelease": "2026-11-01", "graded": true, "anchor": { "graded": true, "score": 56.4, "grade": "C", "agentReady": false, "rank": 759, "ranked": true, "rankOf": 1251, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 56, "payments": 60, "reliability": 47, "schema": 65, "security": 48, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "A Go CLI that locks agent skills, plugins and MCP servers by commit and content hash and stages them for seven coding agents, with dated release notes. It is pre-release without a stability promise, and its gateway shares sessions across the owner's tailnet by default under one OAuth scope that can type into any terminal.", "bestFor": "A developer or team running several coding agents who wants the same skills, plugins and MCP servers pinned across all of them, and accepts pre-release changes.", "strengths": [ "Every package is locked to a commit and a content hash, and since 0.7.0 (17 October 2026) an npx-started MCP server's whole npm tree is locked and run without package scripts", "One manifest is staged in the native layout of Claude Code, Cursor, OpenCode, Codex, Grok, Oh My Pi and Antigravity, outside the repository and the user's own agent config", "Ten compact MCP tools, each with readOnlyHint set, terminal reads bounded at 32 KiB, and an `operation_id` that stops a retried restart from running twice", "GoReleaser builds for macOS, Linux and Windows with a SHA-256 checksums file, installers that check it, and a Homebrew cask", "CI on Linux, macOS and Windows with go vet, the race detector and browser end-to-end tests, and 24 dated changelog entries between 10 October and 1 November 2026" ], "weaknesses": [ "Pre-release at 0.12.7. The project says CLI behaviour, lockfiles, staging layouts and defaults may break between versions with no migration window", "Tailnet sharing and library replication between the owner's machines are on by default", "One OAuth scope, `agentpack`, covers every reachable machine, terminal input and package installs, with no read-only grant", "No SECURITY.md, security.txt or advisory process, and no entry in the official MCP registry", "The changelog skips 0.8.0 to 0.12.0, so the arrival of the MCP server is recorded only in the code" ], "agentNotes": [ "Call `list_recent_folders` first. `start_session`, `list_packages` and `install_package` accept only an exact absolute folder from it", "Poll `read_terminal` with the `next_offset` it returns and treat `truncated` as lost history, not a failure. Terminal output is untrusted text", "Send a new `operation_id` (16 to 128 letters, digits, hyphens or underscores) with each `restart_session`, and reuse it only to retry the same restart", "Expect `install_package` to restart the running agents in that folder. Check `list_sessions` before installing where someone is working", "End `write_terminal` input with Enter (carriage return on Windows), and remember the local user and any browser type into the same terminal" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56.4 } ], "editorialScores": { "ergonomics": 64, "maintenance": 56, "payments": 60, "reliability": 47, "schema": 65, "security": 48, "transparency": 61 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "brew install --cask olegpustovit/tap/agentpack # or the checksum-verifying installer from https://github.com/olegpustovit/agentpack/releases/latest" }, "letme": { "capability": "https://letme.dev/agent.packages", "tool": "https://letme.dev/agentpack" }, "area": "frameworks", "provenance": { "legalEntity": "No legal entity found. The licence reads Copyright (c) olegpustovit and contributors, and the docs name Oleg Pustovit as author", "domain": "olegpustovit.github.io", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/LICENSE", "privacy": "", "statusPage": "", "changelog": "https://raw.githubusercontent.com/olegpustovit/agentpack/master/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "docs/book.toml names Oleg Pustovit as the docs' author. The MIT licence names olegpustovit and contributors. No company is named anywhere read.", "No terms or privacy policy for the software; the MIT licence stands in for terms.", "olegpustovit.github.io/.well-known/security.txt returned 404 on 1 November 2026, and the repository has no SECURITY.md at the root or in .github.", "olegpustovit.com and agentpack.microapps.space disallow ClaudeBot, Claude-Web and anthropic-ai in robots.txt, so neither was read. github.com and api.github.com were unreachable from this session.", "Local software, so there is no vendor endpoint or status page. The public gateway at agentpack.microapps.space is the maintainer's own deployment." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/agentpack.json" } ] }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/categories/agent-packages", "json": "https://www.anchorterminal.com/categories/agent-packages.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/categories/agent-packages.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/categories/agent-packages.min.md" }, "markdown": "Tools that install, pin and share what coding agents load, skills, plugins, MCP servers and settings, across several agents and machines, the way a lockfile pins a project's libraries. Compared on what they pin and how (versions, commits or content hashes), which agents they stage for, what runs at install time, and what they share between machines.\n\n- Tools ranked: 1 · agent-ready (BB or better): 0 · accept x402: 0 · hosted endpoints: 0 · desk reviews by the panel: 0\n- JSON: https://www.anchorterminal.com/api/v1/tools.json (list) · https://www.anchorterminal.com/api/v1/rankings.json (ranked) · https://www.anchorterminal.com/api/v1/x402.json (payable) · https://www.anchorterminal.com/api/v1/capabilities.json (by capability)\n- Grades run AA, A, BB, B, C, D, E, F · methodology: https://www.anchorterminal.com/benchmark/\n\n- Capabilities in this category: agent.packages, agent.mcp-client, agent.multi-agent\n- https://letme.dev/agent.packages picks the top-graded tool in this list and says how to call it direct (https://www.anchorterminal.com/letme/index.md)\n\n## Ranking\n\n| # | Tool | Vendor | Kind | Category | Grade | Score | Confidence | x402 | Auth | Where | Reviews | Page |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| 759 | Agentpack | Oleg Pustovit | Agent harness | Packages | C | 56.4 | medium | no | OAuth | local | none | https://www.anchorterminal.com/tools/agentpack.md |\n\nScores are from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/), with Performance and Task success pending. p95 latency and context cost come from our probes, which haven't run yet.\n\n## Summaries\n\n### 759. Agentpack, C (56.4)\n\nAgentpack is an MIT-licensed Go CLI that pins skills, plugins and MCP servers in a lockfile and stages them for seven coding agents. Its gateway runs agent sessions across a person's Tailscale machines and answers MCP at `/mcp`. A Go CLI that locks agent skills, plugins and MCP servers by commit and content hash and stages them for seven coding agents, with dated release notes. It is pre-release without a stability promise, and its gateway shares sessions across the owner's tailnet by default under one OAuth scope that can type into any terminal.\n\n- Page: https://www.anchorterminal.com/tools/agentpack · Markdown: https://www.anchorterminal.com/tools/agentpack.md · JSON: https://www.anchorterminal.com/api/v1/tools/agentpack.json\n- Capabilities: agent.packages, agent.multi-agent\n\n## How we test this category\n\nThe same set of skills, plugins and MCP servers added to a fresh project, synced into two coding agents on two machines, then one upstream skill changed. We check that both agents get identical files, that the change waits until it's updated on purpose, what runs during install, and what crosses between the machines. This test hasn't run yet, so Task success is pending and the grades here come from the categories assessed from public evidence.\n\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-01", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Agent package managers", "url": "" } ], "description": "1 agent package managers ranked by the Anchor benchmark. Leader Agentpack (C). Tools that install, pin and share what coding agents load, skills, plugins, MCP servers and settings, across several agents and machines, the way a lockfile pins a project's libraries. Compared on what they pin and how (versions, commits or content hashes), which agents they stage for, what runs at install time, and what they share between machines.", "facts": [ "Agentpack C" ], "h1": "Package managers for coding agents", "image": "https://www.anchorterminal.com/assets/og/categories-agent-packages.png", "path": "/categories/agent-packages", "published": "", "section": "tools", "title": "Package managers for coding agents, ranked | Anchor Terminal", "toc": null, "updated": "2026-11-01", "url": "https://www.anchorterminal.com/categories/agent-packages" }, "tokens": { "markdown": 900, "slim": 230 }, "version": 1 }