
Security News
Package Maintainers Call for Improvements to GitHub’s New npm Security Plan
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
AI Configuration Manager
A CLI tool for managing Agentic configurations across projects
Modern AI-powered IDEs like Cursor and Agents like Codex enable developers to write custom instructions to maintain context across coding sessions. They also support MCPs for enhanced functionality. However, sharing these configurations across multiple projects is a challenge.
aicm solves this by enabling you to create reusable presets that bundle rules and MCP configurations together. With multi-target support, you can write your rules once and deploy them consistently across different AI tools and IDEs.
aicm accepts Cursor's .mdc
format as it provides the most comprehensive feature set. For other AI tools and IDEs, aicm automatically generates compatible formats:
.mdc
files with full feature support.windsurfrules
fileAGENTS.md
fileCLAUDE.md
fileThis approach ensures you write your rules once in the richest format available, while maintaining compatibility across different AI development environments.
The easiest way to get started with aicm is by using presets - npm packages containing rules and MCP configurations that you can install in any project.
npm install --save-dev @team/ai-preset
aicm.json
file in your project root:{ "presets": ["@team/ai-preset"] }
package.json
to install all preset rules and MCPs:{
"scripts": {
"prepare": "npx aicm -y install"
}
}
The rules are now installed in .cursor/rules/aicm/
and any MCP servers are configured in .cursor/mcp.json
.
@team/ai-preset
├── package.json
├── aicm.json
└── rules/
├── typescript.mdc
└── react.mdc
aicm.json
:{
"rulesDir": "rules",
"mcpServers": {
"my-mcp": { "url": "https://example.com/sse" }
}
}
aicm.json
:{ "presets": ["@team/ai-preset"] }
Note: This is syntactic sugar for
@team/ai-preset/aicm.json
.
For project-specific rules, you can specify rulesDir
in your aicm.json
config. This approach allows you to write rules once and automatically generate them for all configured targets.
{
"rulesDir": "path/to/rules/dir"
}
.cursor/rules/aicm/
and .aicm/
(for Windsurf/Codex) to .gitignore
if they do not want to track generated rules.You can disable or replace specific rules provided by presets using the overrides
field:
{
"presets": ["@company/ai-rules"],
"overrides": {
"rule-from-preset-a": "./rules/override-rule.mdc",
"rule-from-preset-b": false
}
}
We'll install an npm package containing a simple preset to demonstrate how aicm works.
npm install --save-dev pirate-coding
aicm.json
file in your project:echo '{ "presets": ["pirate-coding"] }' > aicm.json
npx aicm install
This command installs all configured rules and MCPs to their IDE-specific locations.
After installation, open Cursor and ask it to do something. Your AI assistant will respond with pirate-themed coding advice. You can also ask it about the aicm library which uses https://gitmcp.io/ to give you advice based on the latest documentation.
To prevent prompt-injection, use only packages from trusted sources.
aicm supports workspaces by automatically discovering and installing configurations across multiple packages in your repository.
You can enable workspaces mode by setting the workspaces
property to true
in your root aicm.json
:
{
"workspaces": true
}
aicm automatically detects workspaces if your package.json
contains a workspaces
configuration:
aicm.json
files in your repository.cursor/mcp.json
at the repository root containing all MCP servers from every packageEach directory containing an aicm.json
file is treated as a separate package with its own configuration.
For example, in a workspace structure like:
├── aicm.json (with "workspaces": true)
├── packages/
│ ├── frontend/
│ │ └── aicm.json
│ └── backend/
│ └── aicm.json
└── services/
└── api/
└── aicm.json
Running npx aicm install
will install rules for each package in their respective directories:
packages/frontend/.cursor/rules/aicm/
packages/backend/.cursor/rules/aicm/
services/api/.cursor/rules/aicm/
When you have a preset package within your workspace (a package that provides rules to be consumed by others), you can prevent aicm from installing rules into it by setting skipInstall: true
:
{
"skipInstall": true,
"rulesDir": "./rules",
"targets": ["cursor"]
}
This is useful when your workspace contains both consumer packages (that need rules installed) and provider packages (that only export rules).
Create an aicm.json
file in your project root, or an aicm
key in your project's package.json
.
{
"rulesDir": "./rules",
"targets": ["cursor"],
"presets": [],
"overrides": {},
"mcpServers": {},
"skipInstall": false
}
["cursor"]
.false
(disable) or a replacement file path.true
to enable workspace mode. If not specified, aicm will automatically detect workspaces from your package.json
.true
to skip rule installation for this package. Useful for preset packages that provide rules but shouldn't have rules installed into them..cursor/mcp.json
..mdc
files in the Cursor rules directory (.cursor/rules/aicm/
), mcp servers are installed to .cursor/mcp.json
.aicm
directory which should be added to your .gitignore
file. Our approach for Windsurf is to create links from the .windsurfrules
file to the respective rules in the .aicm
directory. There is no support for local mcp servers at the moment..aicm
directory and referenced from AGENTS.md
.These options are available for all commands:
--help
, -h
: Show help information--version
, -v
: Show version informationinit
Initializes a new configuration file in your current directory.
npx aicm init
Edit this file to add your rules, presets, or other settings.
install
Installs all rules and MCPs configured in your aicm.json
.
npx aicm install
Options:
--ci
: run in CI environments (default: false
)--verbose
: show detailed output and stack traces for debugging--dry-run
: simulate installation without writing files, useful for validating presets in CIIn addition to the CLI, aicm can be used programmatically in Node.js applications:
const { install, Config } = require("aicm");
install().then((result) => {
if (result.success) {
console.log(`Successfully installed ${result.installedRuleCount} rules`);
} else {
console.error(`Error: ${result.error}`);
}
});
// Install with custom options
const customConfig = {
targets: ["cursor"],
rulesDir: "rules",
presets: ["@team/ai-preset"],
};
install({
config: customConfig,
cwd: "/path/to/project",
}).then((result) => {
// Handle result
});
install(options?: InstallOptions): Promise<InstallResult>
Installs rules and MCP servers based on configuration.
Options:
cwd
: Base directory to use instead of process.cwd()
config
: Custom config object to use instead of loading from fileinstallOnCI
: Run installation on CI environments (default: false
)verbose
: Show verbose output and stack traces for debugging (default: false
)dryRun
: Simulate installation without writing files, useful for preset validation in CI (default: false
)Returns:
A Promise that resolves to an object with:
success
: Whether the operation was successfulerror
: Error object if the operation failedinstalledRuleCount
: Number of rules installedContributions are welcome! Please feel free to open an issue or submit a Pull Request.
pnpm test
npm run release
FAQs
A TypeScript CLI tool for managing AI IDE rules across different projects and teams
The npm package aicm receives a total of 3 weekly downloads. As such, aicm popularity was classified as not popular.
We found that aicm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.