Is the Era of Dependency Management for AI Coding Agents Here?

We've long been accustomed to managing application dependencies with npm and Composer, and we've started to take the dependencies of CI/CD workflows seriously. But who manages the dependencies of the AI coding agents we use every day? Skills, prompts, instructions, and MCP servers all influence agent behavior—just like application dependencies, they need version control, lockfiles, and update mechanisms. Recently, Microsoft's Agent Package Manager (APM) brought package management concepts to AI agent skills and context, and more importantly, Dependabot now supports updating APM dependencies. This sends a signal: agent dependency management may become a new link in the software supply chain.

Agent Dependencies: The Overlooked Blind Spot in the Supply Chain

AI coding agent behavior doesn't arise from nowhere—it's driven by a set of configurable components: Skills define what it can do, Prompts and Instructions dictate how it thinks and responds, and MCP servers extend the external tools and data sources it can access. Together, these components form the agent's "runtime environment."

The problem is that these components are currently mostly scattered across various project config files or exist as free-form text, lacking unified version management. When a team has multiple projects and multiple agents, keeping shared skills and instructions in sync becomes a nightmare. You might copy the same prompt across ten different repositories, and when it needs adjustment, you have to manually edit each one—eerily similar to the chaos before enterprise-grade application dependency management emerged.

An even more insidious risk lies in supply chain security. If a third-party skill or MCP server is maliciously tampered with, agent behavior could be silently manipulated. Without version locking and source verification, such risks are nearly impossible to audit.

MCP (Model Context Protocol) is a standardized protocol proposed and open-sourced by Anthropic in late 2024, aimed at establishing a unified connection between AI models and external tools and data sources. You can think of an MCP server as a kind of "adapter": it wraps resources like file systems, databases, and APIs into standard interfaces that models can invoke, so agents don't need to write separate integration code for each tool. MCP uses a client-server architecture, supporting both local processes and remote services. Because of its openness, anyone can publish an MCP server—which makes source verification and version locking essential. A tampered MCP server could exfiltrate data or perform unauthorized operations without the agent's knowledge.

APM and Dependabot: Porting the Package Management Approach

Microsoft's Agent Package Manager attempts to bring npm's mature paradigm into the agent world. Through an apm.yml file, developers can declare the skills, instructions, and MCP servers a project requires, and specify version ranges. APM generates a lockfile to ensure consistent dependency versions across installations, avoiding "works on my machine" issues.

According to the original author Amit Merchant's practice, apm.yml is written similarly to conventional package management files, clearly listing dependencies and their sources. This means agent configuration shifts from "handwritten documentation" to "reproducible build artifacts."

More noteworthy is the Dependabot integration. GitHub's Dependabot now supports automatically detecting updates to APM dependencies and creating pull requests. This effectively brings agent dependencies into existing automated update pipelines, so teams don't need to build extra monitoring mechanisms.

Lockfile is one of the core mechanisms of package managers, with npm's package-lock.json and Composer's composer.lock being typical examples. Its role is to record each package's exact version, source URL, and content hash on first install, then strictly restore from the lockfile on subsequent installs rather than re-resolving version ranges. This ensures that even if upstream publishes new versions, installations on different machines at different times produce identical results, enabling reproducible builds. For agent dependencies, the significance of lockfiles is especially pronounced: even minor changes to skills and prompts can alter AI output behavior, and lockfiles ensure all team members and CI environments run the same agent configuration, avoiding debugging difficulties caused by behavior drift.

Dependabot is GitHub's built-in automated dependency update tool, originally serving traditional package managers like npm, pip, and Maven. It works by periodically scanning dependency declaration files in repositories, automatically creating pull requests when new versions are found, with change descriptions and compatibility information attached for developers to review and merge. Dependabot's support for APM means agent dependency updates can reuse teams' existing PR review processes and security alerting mechanisms without introducing new monitoring tools. This also indirectly shows that GitHub views APM as a format worth including in the mainstream dependency ecosystem, not a fringe experiment.

Community Practice: Decentralized Management or Centralized Governance?

The original author's question on Reddit sparked discussion: how does everyone manage shared skills and instructions? Currently, most teams remain in a "go it alone" phase—each project maintains its own agent config files, with sharing done via copy-paste or internal docs. A few teams are beginning to try structured approaches, such as building internal skill repositories or using tools like APM for unified management.

This divergence is much like the early days of frontend engineering: some managed scripts manually, while others had already started using npm. But what's special about agent dependencies is that they directly affect the quality of AI behavior, not just functional availability. An outdated prompt can cause an agent to produce non-compliant output, and a version-incompatible skill can make an agent call the wrong tool. As a result, the need for governance of agent dependencies may be more urgent than for traditional application dependencies.

Why This Will Be a New Battleground for the Software Supply Chain

The core of software supply chain security is "knowing what code you're running and where it comes from." When AI agents become part of the development process, agent behavior configuration is equivalent to code. If these configurations have no version records, no source auditing, and no update tracking, a black hole appears in the entire supply chain.

The combination of APM and Dependabot provides a practical starting point: declarative configuration, lockfiles, and automated updates. But the ecosystem is still early, standards are not yet unified, and compatibility between different tools remains to be seen. For technical teams, paying attention to agent dependency management now may allow them to establish order before the chaos fully arrives.

The original author's final question remains open: are you managing things scattered across project files, or have you already adopted a more structured approach? This choice may soon become a marker of engineering maturity—just like "do you use a lockfile?"

Software supply chain security generally refers to trusted management across the entire chain from source code, build tools, and dependency packages to the deployment environment. In recent years, incidents like SolarWinds and Log4j have made the industry realize that attackers can indirectly affect countless downstream systems by poisoning upstream dependencies. Frameworks like SBOM (Software Bill of Materials) and SLSA were created precisely for this. Bringing AI agents' skills, prompts, and MCP servers into supply chain management essentially means treating "agent behavior configuration" as build artifacts that need auditing: like code, they can execute operations and access data, yet have long remained outside version control and source verification. This shift in perspective is key to understanding the significance of the APM and Dependabot integration.