
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@cleocode/caamp
Advanced tools
Central AI Agent Managed Packages - unified provider registry and package manager for AI coding agents
One CLI to manage Skills, MCP servers, and instruction files across 44 AI coding agents.
CAAMP is a unified provider registry and package manager for AI coding agents. It replaces the need to manually configure each agent's MCP servers, skills, and instruction files individually -- handling the differences in config formats (JSON, JSONC, YAML, TOML), config keys (mcpServers, mcp_servers, extensions, mcp, servers, context_servers), and file paths across all supported providers.
CAAMP adopts LAFS for agent-facing output contracts. Protocol authority lives in the standalone LAFS repository and package.
# Global install (recommended)
npm install -g @cleocode/caamp
# Or run directly with npx
npx @cleocode/caamp <command>
After global install, use caamp directly:
caamp providers list
caamp providers detect
caamp mcp install fetch --provider claude-desktop -- npx -y @modelcontextprotocol/server-fetch
caamp skills install owner/repo
CAAMP also exports a full programmatic API:
npm install @cleocode/caamp
import {
getAllProviders,
getInstalledProviders,
listAllMcpServers,
installSkill,
detectAllProviders,
} from "@cleocode/caamp";
// Get all registered providers
const providers = getAllProviders();
// Detect which agents are installed on this system
const installed = getInstalledProviders();
// List MCP servers across all installed providers
const servers = await listAllMcpServers(installed, "global");
import {
getProviderCapabilities,
getSpawnCapableProviders,
getProvidersByHookEvent,
buildSkillsMap,
} from "@cleocode/caamp";
// Get capabilities for a specific provider
const caps = getProviderCapabilities("claude-code");
console.log(caps?.spawn.supportsSubagents); // true
console.log(caps?.hooks.supported); // ["onSessionStart", ...]
// Find all providers that support spawning subagents
const spawnCapable = getSpawnCapableProviders();
// Find providers supporting a specific hook event
const hookProviders = getProvidersByHookEvent("onToolComplete");
// Get full skills precedence map
const skillsMap = buildSkillsMap();
See API Reference for full programmatic API documentation.
caamp providers list # List all supported providers
caamp providers list --tier high # Filter by priority tier
caamp providers detect # Auto-detect installed providers
caamp providers detect --project # Detect project-level configs
caamp providers show <id> # Show provider details + all paths
caamp skills install <source> # Install from GitHub/URL/marketplace
caamp skills remove [name] # Remove skill(s) + symlinks
caamp skills list [-g] # List installed skills
caamp skills find [query] # Search marketplace (agentskills.in + skills.sh)
caamp skills find [query] --recommend --top 5 # Ranked recommendations + CHOOSE flow
caamp skills find [query] --recommend --json # LAFS envelope JSON for agent consumers
caamp skills init [name] # Create new SKILL.md template
caamp skills validate [path] # Validate SKILL.md format
caamp skills audit [path] # Security scan (46+ rules, SARIF output)
caamp skills check # Check for available updates
caamp skills update # Update all outdated skills
Recommendation criteria flags:
--must-have <term> # repeatable and comma-delimited
--prefer <term> # soft preference signal
--exclude <term> # hard exclusion signal
--details # expanded JSON evidence fields
--select <index> # select from ranked CHOOSE list
caamp mcp detect # Auto-detect MCP-configured providers
caamp mcp list # List servers across every MCP-capable provider
caamp mcp list --provider cursor # List for a specific provider
caamp mcp install <name> --provider <id> -- <command> [args] # Install via inline command
caamp mcp install <name> --provider <id> --from server.json # Install via JSON file
caamp mcp install <name> --provider <id> --env KEY=VAL -- ... # With env vars
caamp mcp remove <name> --provider <id> # Remove from a single provider
caamp mcp remove <name> --all-providers # Remove from every provider
caamp instructions inject # Inject blocks into instruction files
caamp instructions check # Check injection status across providers
caamp instructions update # Update all instruction file injections
caamp config show <provider> # Show provider config contents
caamp config path <provider> # Show config file path
caamp doctor # Diagnose configuration and health issues
caamp advanced providers --min-tier medium --details
caamp advanced batch --mcp-file ./mcp-batch.json --skills-file ./skills-batch.json
caamp advanced conflicts --mcp-file ./mcp-batch.json
caamp advanced apply --mcp-file ./mcp-batch.json --policy skip
caamp advanced instructions --content-file ./AGENT-BLOCK.md --scope project
caamp advanced configure -a claude-code --global-mcp-file ./global-mcp.json --project-mcp-file ./project-mcp.json
| Flag | Description |
|---|---|
-a, --agent <name> | Target specific agent(s), repeatable |
-g, --global | Use global/user scope (default: project) |
-y, --yes | Skip confirmation prompts |
--all | Target all detected agents |
--json | JSON output format |
--dry-run | Preview changes without writing |
CAAMP supports 44 AI coding agents across 3 priority tiers:
| Priority | Providers |
|---|---|
| High | Claude Code, Cursor, Windsurf |
| Medium | Codex CLI, Gemini CLI, GitHub Copilot, OpenCode, Cline, Kimi, VS Code, Zed, Claude Desktop, Amazon Q Developer, GitHub Copilot CLI |
| Low | Roo, Continue, Goose, Antigravity, Kiro, Amp, Trae, Aide, Pear AI, Void AI, Cody, Kilo Code, Qwen Code, OpenHands, CodeBuddy, CodeStory, Aider, Tabnine, Augment, JetBrains AI, Devin, Replit Agent, Mentat, Sourcery, Blackbox AI, Double, Codegen, SWE-Agent, Forge, Gemini Code Assist |
Each provider uses a different key name for MCP server configuration:
| Config Key | Providers |
|---|---|
mcpServers | Claude Code, Cursor, Windsurf, Gemini CLI, GitHub Copilot, Cline, Kimi, and 12 others |
mcp_servers | Codex |
extensions | Goose |
mcp | OpenCode |
servers | VS Code |
context_servers | Zed |
| File | Providers |
|---|---|
CLAUDE.md | Claude Code, Claude Desktop |
GEMINI.md | Gemini CLI |
AGENTS.md | All other providers (Cursor, Windsurf, Codex, Kimi, etc.) |
┌─────────────────────────────────────────────────┐
│ CLI Layer │
│ providers │ skills │ mcp │ instructions │ config│
├─────────────────────────────────────────────────┤
│ Core Layer │
│ registry │ formats │ skills │ mcp │ │
│ marketplace │ sources │ instructions │
├─────────────────────────────────────────────────┤
│ Data Layer │
│ providers/registry.json │ lock files │ configs │
└─────────────────────────────────────────────────┘
providers/registry.json with all provider definitions~/.agents/.caamp-lock.jsonRead the full documentation on GitBook
| Document | Description |
|---|---|
| API Reference | Full library API (signatures and examples) |
| Advanced CLI | LAFS-compliant advanced command wrappers and input/output schemas |
| Advanced Recipes | Production TypeScript patterns for tier filtering, rollback, conflict handling, and dual-scope operations |
| Provider Configuration Guide | Config keys, formats, scopes, and provider mapping guidance |
| Migration Guide | Upgrade notes for moving to v1.0.0 |
| Troubleshooting | Common failure modes and remediation steps |
| CLI Help Examples | --help command examples for every command group |
| Skills Recommendations | Marketplace search and recommendation engine |
| Contributing | Development workflow and PR expectations |
| Security Policy | Private vulnerability disclosure process |
| LAFS Compliance Profile | CAAMP-specific LAFS adoption scope and compliance mapping |
| Agents Directory Standard | .agents/ standard directory structure |
| LAFS Specification | Canonical cross-language LLM-agent-first protocol |
| Technical Specification | RFC 2119 spec covering all subsystems |
| Vision & Architecture | Project vision, design philosophy, and architecture |
| Gap Analysis & Roadmap | Current state vs plan, v0.2.0+ roadmap |
Provider definitions live in providers/registry.json. To add a new AI coding agent:
providers/registry.json with all required fieldsnpm test to validate the registrySee the Technical Specification for the full provider schema.
MIT
FAQs
Central AI Agent Managed Packages - unified provider registry and package manager for AI coding agents
The npm package @cleocode/caamp receives a total of 256 weekly downloads. As such, @cleocode/caamp popularity was classified as not popular.
We found that @cleocode/caamp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.