Getting Started

v0.1 ships the CLI as a scaffold. Multi-source routing (npm:, pip:, brew:, etc.) lands in Phase 1. Until then, the CLI accepts the command shape and writes a local install receipt at ~/.apai/receipts/<install_id>.json.

# Clone the repo and link the CLI locally (v0.1)
git clone https://github.com/griffin9899/apai
cd apai/packages/cli
pnpm install
pnpm run build
npm link

# Verify
apai --version
# 0.1.0

npm package publication (@apai/cli) lands when Phase 1 wires real multi-source install behavior. See honest status.

The APAI registry holds 10 reference packages at v0.1. Each has a full Capability Passport, scanner output, and rollback path documented.

apai search

# APAI registry search
#
#   prompt-preflight-starter     v0.1.0        low     prompt-preflight
#     Generic bounded-prompt protocol with score gate and operator controls.
#     by apai-official
#
#   costguard                    v0.1.0-preview medium  cost-guard
#     Token spend ceilings, spike alerts, anomaly detection, and emergency stop.
#     by apai-official
#   ...
#   10 package(s) found.

Same data also at the web UI: /registry. And as JSON at /api/packages.

Every package has a Capability Passport: a plain-English declaration of what it reads, writes, accesses, spends, exposes, what approvals it requires, and how to roll it back. Read it before you install.

apai passport coding-safe-mode

# Capability Passport: Coding Safe Mode
#
#   Package:     [email protected]
#   Publisher:   apai-official (verified)
#   Risk level:  low
#   Type:        policy-pack
#
#   Reads:       Agent tool-call metadata only
#   Writes:      Policy decision log at ~/.apai/installed/coding-safe-mode/decisions.jsonl
#   Accesses:    No network access. No filesystem access beyond the decision log.
#   Spends:      No spend.
#   Exposes:     Decision log is local; not exported.
#   Approvals:   Operator approval to deactivate any rule.
#
#   Rollback:    apai rollback coding-safe-mode
#   Scanner:     heuristic-stub-v0 (13 regex patterns + Unicode-Cf check)

Or view the rendered passport in the browser at /packages/coding-safe-mode. The same content is available as a text/plain LLM install card at /packages/coding-safe-mode/llms.txt.

v0.1 install writes a receipt to ~/.apai/receipts/ and prints the rollback command.

apai install coding-safe-mode

# Preparing install: Coding Safe Mode ([email protected])
# Target: local_cli
# Risk level: low
#
# v0.1: scaffolded install. Writing install receipt to ~/.apai/receipts/.
# Real package fetch and file writes land in Phase 1.
#
# Receipt: /home/user/.apai/receipts/rcpt_01HXY7G8K9M2P3Q4R5S6T7U8V9W.json
# Install ID: rcpt_01HXY7G8K9M2P3Q4R5S6T7U8V9W
#
# Roll back: apai rollback coding-safe-mode --install-id rcpt_01HXY7G8K9M2P3Q4R5S6T7U8V9W

The receipt is a durable record: package + version + source + permissions requested + permissions granted + risk level at install time + scanner findings + the exact rollback command. Even when v0.1 install is scaffolded, the receipt shape matches what Phase 1 will emit.

See your installed packages, install timeline, receipts, applied policies, workspace settings, and billing tier at /app. v0.1 renders realistic demo data; the shape matches what Phase 4 will pull from your real workspace.

• Integrations: wire APAI into LangChain, CrewAI, Continue.dev, Claude Code, Codex, Cursor.
• Security model: how the Capability Passport, scanner, MCP Gateway, and policy packs combine.
• Deployment patterns: local-tool vs. cloud-sandbox vs. remote-connector install modes; when to use each.
• Specs: the formal Manifest, Capability Passport, Install Receipt, Policy Pack, and Install Card protocols.