One setup for every coding agent.

One agent, six native files

~/project

$ palm init --target claude,codex,copilot,cursor,gemini,opencode
+ wrote palm.yaml: targets claude, codex, copilot, cursor, gemini, opencode
+ wrote .gitignore: .palm/local/, palm.local.yaml
next: see what a source offers, for example: palm install mattpocock/skills
$ palm install anthropics/claude-plugins-official agent-sdk-verifier-py
i agent agent-sdk-verifier-py preloads skill sdk-helper, mcp context7, not installed: palm install anthropics/claude-plugins-official sdk-helper mcp:context7
i ref main saved to palm.yaml; edit ref: to pin a tag
+ agent  agent-sdk-verifier-py   .claude/agents/agent-sdk-verifier-py.md, .codex/agents/agent-sdk-verifier-py.toml +4   6 files   from anthropics/claude-plugins-official main
    .codex/agents/agent-sdk-verifier-py.toml: dropped model (sonnet), tools, skills, mcpServers, color (not supported by Codex)
    .github/agents/agent-sdk-verifier-py.agent.md: dropped model (sonnet), tools: Bash(python -m pytest:*) restriction (all of execute), mcpServers, skills, color (not supported by GitHub Copilot)
    .cursor/agents/agent-sdk-verifier-py.md: dropped model (sonnet), tools, skills, mcpServers, color (not supported by Cursor)
    .gemini/agents/agent-sdk-verifier-py.md: dropped model (sonnet), tools: Bash(python -m pytest:*) restriction (all of run_shell_command), skills, color (not supported by Gemini CLI)
    .opencode/agents/agent-sdk-verifier-py.md: dropped model (sonnet), color (green), tools: Bash(python -m pytest:*) restriction (all of bash), skills (not supported by OpenCode)
1 installed. Commit palm.yaml, palm.lock.yaml, .claude/, .codex/, .cursor/, .gemini/, .github/ and .opencode/ together.
$ palm install mattpocock/skills tdd
i ref ^1.2 saved to palm.yaml (latest tag v1.2.3); edit ref: to track main
+ skill  tdd   .agents/skills/tdd/, .claude/skills/tdd/   5 files   from mattpocock/skills v1.2.3
    claude gets its own copy in .claude/skills
    cursor reads .claude/skills; no second copy
1 installed. Commit palm.yaml, palm.lock.yaml and .agents/ together.

Recorded by docs/scripts/capture.mjs against palm’s test fixtures, which mirror anthropics/claude-plugins-official and mattpocock/skills.

• Folder.agents/

  • Folderskills/

    • Foldertdd/

      • …
• Folder.claude/

  • Folderagents/

    • agent-sdk-verifier-py.md
  • Folderskills/

    • Foldertdd/

      • …
• Folder.codex/

  • Folderagents/

    • agent-sdk-verifier-py.toml
• Folder.cursor/

  • Folderagents/

    • agent-sdk-verifier-py.md
• Folder.gemini/

  • Folderagents/

    • agent-sdk-verifier-py.md
• Folder.github/

  • Folderagents/

    • agent-sdk-verifier-py.agent.md
• Folder.opencode/

  • Folderagents/

    • agent-sdk-verifier-py.md
• .gitignore
• palm.lock.yaml
• palm.yaml

The agent became a Markdown file for Claude Code, Cursor, Gemini CLI and OpenCode, a TOML file for Codex and an .agent.md file for Copilot. The skill went to .claude/skills for Claude Code, which Cursor reads too, and once to .agents/skills for the other four. palm.yaml names the two sources and what you took from them. palm.lock.yaml pins each source to a commit and lists every file palm wrote. Commit all of it, and a teammate’s clone works with no palm run at all.

Two commands from zero

~/project

$ palm install tdd
x "tdd" is not a repository. palm installs from git repositories:
    palm install <owner/repo> tdd             for example  palm install mattpocock/skills tdd
$ palm install mattpocock/skills tdd
i .gitignore: added .palm/local/ and palm.local.yaml
i ref ^1.2 saved to palm.yaml (latest tag v1.2.3); edit ref: to track main
targets: cursor   (detected from .cursor/; change targets: in palm.yaml)
+ skill  tdd   .agents/skills/tdd/   3 files   from mattpocock/skills v1.2.3   (cursor reads .agents/skills)
1 installed. Commit palm.yaml, palm.lock.yaml and .agents/ together.

A bare name is not enough, because palm installs from repositories you name and consults no registry. The error’s first line is the command that works. palm detected Cursor from .cursor/, wrote the skill where Cursor reads it, and said what to commit.

How it works

Any repository, as it is

palm reads Claude Code, Cursor and Codex plugins, marketplaces, APM packages and plain SKILL.md folders. Authors repackage nothing, and owner/repo is the whole address.

Native files per harness

An agent becomes .md, .toml or .agent.md. Hooks and MCP servers merge into each tool’s own config file, and palm remove takes out exactly those entries.

Sources live in the project

palm.yaml declares every source with its version range. A clone carries everything palm needs, with no per-user setup and no alias to register first.

Committed, then checked

You commit the generated files, so git is the review and the record. In CI, palm check recomputes every file from the lock and fails on any difference.

Programs need a yes

Before a hook or a stdio MCP server lands, palm shows each command and script. The default is no, and your yes is pinned by hash in the lock, so any change asks again.

Secrets stay out of git

Project files get each harness’s environment reference, such as ${env:TOKEN} for Cursor. A literal secret that arrives from a source is never written.

Use cases

Set up a new projectpalm init, a skill, an agent and an MCP server, then one commit.

Share a team baselineCommit the files once. Every clone works without running palm.

Check the setup in CIpalm check fails the build when a file, the lock or a source drifts.

Add MCP serversPaste the JSON snippet from a server's README, and palm writes it for every harness.

Migrate from APMEach apm.yml dependency becomes a source, and identical files are adopted with no diff.

Migrate from palm 0.1palm migrate rewrites palm.yaml and the lock, and keeps every file you have.

Where files go

Project scope, for the six targets. The targets matrix adds global paths and the combinations a harness does not support.

Harness	skill	agent	instruction	hook	mcp
Claude Code	.claude/skills/<n>/	.claude/agents/<n>.md	.claude/rules/<n>.md	.claude/settings.json	.mcp.json
Codex	.agents/skills/<n>/	.codex/agents/<n>.toml	block in AGENTS.md	.codex/hooks.json	.codex/config.toml
GitHub Copilot	.agents/skills/<n>/	.github/agents/ <n>.agent.md	.github/instructions/ <n>.instructions.md	.github/hooks/<n>.json	.vscode/mcp.json
Cursor	.claude/skills/<n>/ with claude, else .agents/skills/<n>/	.cursor/agents/<n>.md	.cursor/rules/<n>.mdc	.cursor/hooks.json	.cursor/mcp.json
Gemini CLI	.agents/skills/<n>/	.gemini/agents/<n>.md	block in GEMINI.md	.gemini/settings.json	.gemini/settings.json
OpenCode	.agents/skills/<n>/	.opencode/agents/ <n>.md	.opencode/instructions/ <n>.md	not supported	opencode.json

Scripts that hooks run go to .palm/assets/<source>/, and you commit them with everything else.

Compared with other tools

Checked on 2026-09-28 against each tool’s documentation and source. “Unverified” marks a cell we could not confirm. palm compared has the full table and when another tool fits better.

	palm 0.2	APM 0.32	Vercel skills	claude plugin	codex plugin, gemini extensions	By hand
Kinds	skills, agents, instructions, hooks, MCP servers; plugins select members	all 7, plus LSP servers and binaries	skills	6, no instructions	Codex 4, Gemini 7	any
Harnesses	6	13	79	1	1 each	each one by hand
Where sources are declared	palm.yaml, per project	apm.yml, per project	per command	per user	per user	nowhere
Reproducible setup	committed files, a pinned lock, palm check in CI	commit, per-file hashes, --frozen	experimental restore from a branch or tag	no committed lockfile	no lockfile	none
Hook consent	every command and script shown, default no, pinned by hash in the lock	opt-in with executables:	no hooks	trust warning, hook commands not shown	Codex asks you to trust hooks, Gemini lists commands	you read them
Secrets in project files	environment reference per harness	resolved values for Codex, Cursor and Gemini	no MCP servers	${VAR} references	env_vars in Codex, keychain in Gemini	by hand

MIT license. No telemetry, no update checks, no registry. palm talks to the git hosts of the sources you name and nothing else. Releases publish to npm from CI with provenance.

Changelog · Security · License