
Security News
GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.
convoke-agents
Advanced tools
██████╗ ██████╗ ███╗ ██╗██╗ ██╗ ██████╗ ██╗ ██╗███████╗
██╔════╝██╔═══██╗████╗ ██║██║ ██║██╔═══██╗██║ ██╔╝██╔════╝
██║ ██║ ██║██╔██╗ ██║██║ ██║██║ ██║█████╔╝ █████╗
██║ ██║ ██║██║╚██╗██║╚██╗ ██╔╝██║ ██║██╔═██╗ ██╔══╝
╚██████╗╚██████╔╝██║ ╚████║ ╚████╔╝ ╚██████╔╝██║ ██╗███████╗
╚═════╝ ╚═════╝ ╚═╝ ╚═══╝ ╚═══╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝
Extends BMAD Method across the product lifecycle
Convoke is built in BMAD Method's format. Where BMAD Method is installed, it extends it. Where it isn't, it runs on its own.
BMAD builds. Convoke covers the lifecycle either side of the build — deciding what deserves building before you start, and finding out whether what you shipped is actually fit to run. It installs as teams of specialist agents, plus skills that add capabilities to agents you already have.
Portability is a direction, not yet a destination. The export tooling takes a standalone BMAD skill anywhere; Convoke's own team agents are not there yet — see Extending Convoke for exactly where the line falls today.
Convoke's teams sit either side of the build. Where a team exists, it's named. Where one doesn't, the scope is mapped and not built.
Discovery Design Build Readiness
╔══════════╗ ┌──────────┐ ┌──────────┐ ╔══════════╗
║ Vortex ║ │ WDS │ │ BMM │ ║ Gyre ║
║ 7 agents ║ │ │ │ TEA │ ║ 4 agents ║
╚══════════╝ └──────────┘ └──────────┘ ╚══════════╝
╚═╝ Convoke ships it └─┘ BMAD Method ecosystem — not ours
Strategy · Growth · Delivery · Security · Ops/Run · Sunset are mapped in the lifecycle vision, not built.
Convoke works standalone or as an extension — no BMAD Method installation is required either way.
npm install convoke-agents && npx -p convoke-agents convoke-install (details in INSTALLATION.md)_bmad/bme/_vortex/config.yaml (or _bmad/bme/_gyre/config.yaml) and replace {user} with your name, so agents know who they're talking to_bmad-output/vortex-artifacts/ or .gyre/How activation works. Each agent is a markdown file containing a persona, a menu, and its workflow instructions. When Claude reads it, it adopts that expertise and shows you a numbered menu. In Claude Code, agents are slash commands (/bmad-agent-bme-contextualization-expert is Emma); in the terminal or on Claude.ai, paste the agent file into the conversation. Full list in the Agent Guide.
Something not working? Run npx -p convoke-agents convoke-doctor, or check the FAQ.
Vortex takes you from "who are these users and what is actually wrong" to "here is what the evidence says we should do next" — a continuous loop, not a one-shot checklist. Each stream builds on the last, and when a gap appears the Compass routes you back to fill it.
Emma 🎯 · Isla 🔍 · Mila 🔬 · Liam 💡 · Wade 🧪 · Noah 📡 · Max 🧭
Job-to-be-Done: Eliminate the daily 5:30 PM dinner decision so I can feed my family well without the mental load of planning, shopping, and deciding under time pressure.
— Emma, framing the problem for a meal-planning product
Emma's user guide · The full journey, every stream →
Gyre detects your stack, builds a capabilities model specific to it, and tells you what is missing. No generic checklists — it reads your filesystem and reports absences, then keeps the model current as you close them. Findings land in .gyre/ as classifications and evidence summaries — never file contents or secrets, though evidence does name the files and modules a finding rests on. Committing the directory is the intended workflow.
Scout 🔎 · Atlas 📐 · Lens 🔬 · Coach 🏋️
DL-001 · reliability · blocker — 46 Python files with local tests (pytest/unittest) exist across BMB and Core modules, but CI pipeline (ci.yml) only runs Node.js tests (npm test, npm run test:integration). Python test failures are completely invisible to CI […]
— Lens, from Gyre's run against this repository. Since fixed:
ci.ymlnow has apython-testjob.
The Gyre team guide · The findings file that quote came from →
Teams do lifecycle jobs. These three do something different — they change what your agents can do, and how far they travel.
Enhance — skills for existing agents. A skill adds a workflow without editing the agent that offers it. The first one is RICE-scored backlog management: run /bmad-enhance-initiatives-backlog directly. It also declares a menu patch for the PM agent, which lands only where that agent exists as a file — on BMAD v6.3+ layouts, where agents are skills rather than .md files, the slash command is the working path. The Enhance Guide documents the pattern for writing your own.
Portability — take skills elsewhere. npx -p convoke-agents convoke-export <skill> turns a BMAD skill into a self-contained, LLM-agnostic instruction document, then writes an adapters/ staging tree beside it — adapters/claude-code/SKILL.md, adapters/copilot/copilot-instructions.md and adapters/cursor/<skill>.md (scripts/portability/generate-adapters.js in a Convoke checkout; inside an install it is under node_modules/convoke-agents/). It does not install them: the generated README tells you where to copy each one. Four skills drive it end to end: bmad-export-skill, bmad-validate-exports, bmad-generate-catalog and bmad-seed-catalog.
Skills are classified by tier: standalone exports cleanly, light-deps carries dependency notes, pipeline is flagged non-portable. Where that leaves Convoke today, precisely: all 12 Convoke agents are pipeline — every Vortex and Gyre agent, and Team Factory. Exporting one emits "Framework-only skill. This skill depends on the full Convoke installation and cannot run standalone. […]" The exception is the Enhance backlog skill, classified light-deps, which does export. So what travels cleanly today is the standalone slice of the upstream BMAD skill set plus that one — not the teams, and not all of upstream either: of BMAD's own 72 rows in the shipped manifest, 43 are standalone, 6 light-deps and 23 pipeline — and a pipeline skill is not refused, it exports with that same framework-only banner. ⚠ Count against BMAD proper, not against every non-Convoke row: the 15 _bmad/wds/ rows are a parallel extension that is neither BMAD's nor Convoke's, and all 15 are pipeline, so folding them in reports 38 instead of 23. Re-derive with a quote-aware parse of _bmad/_config/skill-manifest.csv grouped by the module and tier columns — a bare cut -d, splits inside the quoted description field. Making the teams portable is roadmap, not a shipped feature.
Team Factory — build your own team. /bmad-agent-bme-team-factory walks you through composition pattern, agent scope with overlap detection, contract design and integration wiring, and persists the decisions as a resumable spec. Output passes the same validation as the native teams. Adding an agent to an existing team, or a skill to an existing agent, is planned for Phase 3 and not yet available.
npm install convoke-agents@latest
npx -p convoke-agents convoke-install
That installs everything — both teams and the skill modules. convoke-install-vortex and convoke-install-gyre exist and currently do the same thing; per-team installation is not yet a real distinction.
INSTALLATION.md covers prerequisites, what lands where, configuration, verification and troubleshooting.
npm install convoke-agents@latest # fetch the new package first
npx -p convoke-agents convoke-version # what you have
npx -p convoke-agents convoke-update --dry-run # what would change
npx -p convoke-agents convoke-update # apply, with automatic backup
The @latest is not decoration: where convoke-agents is already a recorded dependency, a bare npm install convoke-agents respects the range in your package.json and will not cross a major version boundary — it appears to succeed while keeping you on your current major. And skipping the install step means convoke-update refreshes your project from the package version you already have, so it reconciles your files rather than upgrading them.
Your artifacts in _bmad-output/ and .gyre/ are never touched. UPDATE-GUIDE.md covers migration paths and troubleshooting.
| Document | What's in it |
|---|---|
| Installation | Prerequisites, install options, configuration, troubleshooting |
| Update Guide | Migration paths between versions |
| Changelog | Complete release history |
| Agent Guide | Every agent, workflow and handoff contract in detail |
| BMAD Compatibility | Which BMAD Method versions Convoke runs against |
| Testing | Test suite, CI pipeline, agent testing |
| Development Guide | Architecture, building agents, contributing |
| FAQ | Common questions |
Writing a Convoke skill? Read The Convoke Operator Covenant first — one axiom and seven Operator Rights every Convoke skill honours. Operator-facing behaviour is an architectural concern in agent systems, not a styling one: a skill that violates the Covenant erodes trust across the whole ecosystem, not just its own surface.
Contributions are welcome — agents and workflows, new teams, tests, and documentation.
Start with CONTRIBUTING.md: what to work on, the CI gates a change has to clear, and how changes land. Found a bug or want a capability that is not there? Open an issue. Security vulnerabilities go through private reporting, not the issue tracker.
MIT — see LICENSE.
Built on BMAD Method and the Innovation Vortex from Jurgen Appelo's unFIX model. The agents that built this — and there were a lot of them — are named in CREDITS.md.
Discover what has to be discovered. Ship what's ready to ship.
Get started · The lifecycle · Teams · Install · Update · Changelog
FAQs
Agent teams for complex systems, compatible with BMad Method
The npm package convoke-agents receives a total of 491 weekly downloads. As such, convoke-agents popularity was classified as not popular.
We found that convoke-agents demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.

Research
/Security News
A Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service.