Private registry for approved agent stacks
Turn scattered agent instructionsinto one approved stack.
AgentStack is a CLI and private registry for agent teams. Review, publish, install, and share the skills your agents follow from one source of truth, then keep every target on the approved version.
Best fit: teams already feeling workflow drift across agents and repos. Not a prompt library. Not an AI strategy project.
Install the CLI now. Once your org grants access, the same approved stack can land wherever your agents work.
Stacks
The best skills travel in stacks.
A skill teaches one behavior: review a PR, write a release note, escalate a support case. A stack bundles the approved skills a team uses under one owner, one current version, and one install command.
The problem
Instruction drift starts when nobody owns the guidance.
Repo conventions, review habits, support playbooks, and brand rules get copied into agents, repos, docs, and laptops. Without one approved version, every copy starts acting like the source of truth.
The failure mode is simple: your agents follow instructions nobody reviewed.
- same workflow
- four instruction homes
- same agent
- different behavior per repo
- same team
- no reviewed current version
Review
Nothing reaches your agents unreviewed.
Skills are instructions your agents will follow. Sentinel is AgentStack's built-in security baseline. It scans every upload for malicious instructions before it reaches a team gate. Add gates for tool-use, brand, legal, privacy, or whatever your team needs.
acme/invoice-processing
v3 v4Stops an agent from sending a payment when a vendor's bank details do not match the approved record.
- Prompt injection
- Hidden instructions
- Secrets & tokens
- Exfiltration paths
- Suspicious links
- Tool-use scope
- Spend controls
- Finance
- Data handling
- Privacy
- Controller sign-off
- Payment authority
Every install stays on the approved v3 until the last gate clears.
FAQ
Questions, answered.
The basics: what it is, what it replaces, and where it sits next to your runtimes.
What is AgentStack?
AgentStack is a CLI and private registry for agent instructions. Every skill has an owner, an approved version, the gates it cleared, and an audit trail of who changed what. AgentStack does not run your agents; it controls what they are allowed to follow.
What is a skill?
A skill tells an agent how to perform one unit of work the way your organization wants it done. It packages the context, examples, and policies an agent needs, with an owner, a version, and the gates it cleared to ship.
What is a stack?
A stack is a versioned bundle of approved skills for a team or scope. Install it once and stay on the approved version as new versions ship, or pin to a version you trust.
How is AgentStack different from a prompt library?
A prompt library stores text for people to copy. AgentStack gives agents an approved install source: every skill has an owner, every stack has a reviewed current version, and every install leaves a trail. Text in a doc has none of that.
How is AgentStack different from an agent runtime?
AgentStack does not execute agents. It controls which skills and stacks your agents can use, and which gates each version clears before it becomes current.
Why not just use GitHub or repo files like CLAUDE.md and .cursor/rules?
Many instructions start there, and a repo can still be a source. But a file in one repo cannot keep every team, agent, and laptop current. AgentStack sits above those sources: one owner, one current version, one review trail, one place to install from.
What does Sentinel scan for?
Sentinel checks every upload for prompt injection, hidden or override instructions, embedded secrets and credential paths, exfiltration paths, suspicious links, and over-broad tool use. It runs before any team gate begins. It is a security baseline, not a full security review, and it is expanding.
Where can my agents install stacks?
Wherever your agents already work. The CLI installs stacks and skills into Claude Code and Codex, at the user level or per repo, plus a runtime-agnostic local library. The same approved stack lands in every target, and more targets are in development.
How do teams stay in sync after they install?
They update from the same source instead of re-copying files. When a new version is approved, agentstack stack update moves installs forward; --check previews the change, and pinned versions stay put until you move them. Run it by hand, or let CI run it on a schedule.
Is there a web interface?
Not yet. A browser portal over the same registry is in development, with reviews and audit in clickable form. The beta is CLI-first, and the CLI stays the source-of-truth surface.
What do beta teams get?
Beta teams get the agentstack CLI, a private registry org, and hands-on onboarding for their first approved stack. Best fit: technical teams already putting instructions into agents, repos, docs, or local files and wanting one reviewed source of truth instead of another prompt library.
The loop, closed
Bring agent instructions under one approved stack.
Every instruction your agents follow gets an owner, a version, and a review behind it. Join the beta to try AgentStack with a private registry, the CLI, and a first stack your team can install wherever agents already work.