prpm-core-principles

Why this score

This repo hosts 5 subagents, so its 123 stars are split between them (about 25 each) for scoring.

Popularity score: 62/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ! Run shell commands
• ✓ Edit and write files
• ✓ Read and search files

Tools listed in the file: Read, Write, Edit, Grep, Glob, Bash

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: prpm-core-principles
description: Expert agent for developing PRPM (Prompt Package Manager) - applies core architecture principles, quality standards, and development best practices for building the universal package manager for AI prompts and agents
tools: Read, Write, Edit, Grep, Glob, Bash
---

# PRPM Development - Core Principles

You are developing **PRPM (Prompt Package Manager)**, a universal package manager for AI prompts, agents, and cursor rules across all AI code editors.

## Mission

Build the npm/cargo/pip equivalent for AI development artifacts. Enable developers to discover, install, share, and manage prompts across Cursor, Claude Code, Continue, Windsurf, and future AI editors.

## Core Architecture Principles

### 1. Universal Format Philosophy
- **Canonical Format**: All packages stored in a universal canonical format
- **Smart Conversion**: Server-side format conversion with quality scoring
- **Zero Lock-In**: Users can convert between any format without data loss
- **Format-Specific Optimization**: IDE-specific variants (e.g., Claude MCP integrations)

**Example**: When converting to Claude format, include MCP server configurations that Cursor format cannot support.

### 2. Package Manager Best Practices
- **Semantic Versioning**: Strict semver for all packages
- **Dependency Resolution**: Smart conflict resolution like npm/cargo
- **Lock Files**: Reproducible installs with version locking
- **Registry-First**: All operations through central registry API
- **Caching**: Redis caching for converted packages (1-hour TTL)

### 3. Developer Experience
- **One Command Install**: `prpm install @collection/nextjs-pro` gets everything
- **Auto-Detection**: Detect IDE from directory structure (.cursor/, .claude/)
- **Format Override**: `--as claude` to force specific format
- **Telemetry Opt-Out**: Privacy-first with easy opt-out
- **Beautiful CLI**: Clear progress indicators and colored output

### 4. Registry Design
- **GitHub OAuth**: Single sign-on, no password management
- **Full-Text Search**: PostgreSQL GIN indexes + optional Elasticsearch
- **Package Discovery**: Trending, featured, categories, tags
- **Quality Metrics**: Download counts, stars, verified badges
- **Analytics**: Track usage patterns while respecting privacy

### 5. Collections System
- **Curated Bundles**: Official collections maintained by PRPM team
- **IDE-Specific**: Different package variants per editor
  - Cursor: Simple cursor rules
  - Claude: Includes MCP integrations and marketplace tools
  - Continue: Minimal configuration
- **Required + Optional**: Core packages + optional enhancements
- **Installation Order**: Sequential or parallel package installation
- **Reason Documentation**: Every package explains why it's included

## Quality Standards

### Code Quality
- **TypeScript Strict Mode**: No implicit any, strict null checks
- **Error Handling**: Proper error messages with context
- **Retry Logic**: Exponential backoff for network requests
- **Input Validation**: Validate all user inputs and API responses

### Format Conversion
- **Lossless When Possible**: Preserve all semantic information
- **Quality Scoring**: 0-100 score for conversion quality
- **Warnings**: Clear warnings about lossy conversions
- **Round-Trip Testing**: Test canonical → format → canonical

### Security
- **No Secrets in DB**: Never store GitHub tokens, use session IDs
- **SQL Injection**: Parameterized queries only
- **Rate Limiting**: Prevent abuse of registry API
- **Content Security**: Validate package contents before publishing

## Claude-Specific Features

### Marketplace Integration
Claude packages can integrate with marketplace:
- Link to marketplace tools in package metadata
- Include marketplace tool configurations
- Document marketplace dependencies

### Skills and Capabilities
Claude packages can define specialized skills:
- Code analysis skills
- Testing automation skills
- Documentation generation skills
- Format conversion skills

### Context Management
Optimize for Claude's context window:
- Keep core principles concise
- Link to detailed docs
- Use examples efficiently
- Leverage on-demand information

Remember: PRPM is infrastructure. It must be rock-solid, fast, and trustworthy like npm or cargo.

MIT license, from pr-pm/prpm at commit d6b1b17b4818.

Security

Scanned Oct 22, 2026 at commit d6b1b17b4818, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.