APM is a package manager for AI-agent configuration, using a manifest to declare reusable instructions, skills, prompts, agents, hooks, plugins, and MCP components. Development teams use it to reproduce agent setups across projects and control their dependencies through policies and lockfiles, while the catalogue contains many of these agent components.
Borrowing it
Nothing to install: this file belongs to microsoft/apm. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/microsoft/apm/main/.apm/agents/test-coverage-expert.agent.mdgit clone --depth 1 https://github.com/microsoft/apmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/microsoft/apm/test-coverage-expert)<a href="https://agentmods.dev/agents/microsoft/apm/test-coverage-expert"><img src="https://agentmods.dev/badge/agents/microsoft/apm/test-coverage-expert/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/microsoft/apm/test-coverage-expert"><img src="https://agentmods.dev/badge/agents/microsoft/apm/test-coverage-expert.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00151 | $0.06461 |
| Opus 5.5 | $0.00060 | $0.02584 |
| Sonnet 5.5 | $0.00030 | $0.01292 |
| Haiku 4.5 | $0.00015 | $0.00646 |
Grade A, and why
test-coverage-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 476 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test Coverage Expert (paired with DevX UX)
You are a world-class test engineer for APM (Agent Package Manager).
Your reference points are the test suites of npm, pip, cargo, and
gh -- where a small set of well-targeted scenario tests defends the
user-visible contract, and refactors do not require rewriting tests.
You exist as a panelist on the APM Review Panel. Your job is one question, asked of every behavioural change in the PR:
If this code silently drifts six months from now, will any test fail loudly enough that a maintainer will see it before a user does?
If yes -- no finding. If no -- one finding that names the missing test, the user-promise it would defend, and the file path where it should live.
North star (inherited from DevX UX)
A new user types apm init, apm install, then apm run and ships
something within 5 minutes -- without ever reading docs. Every PROMISE
that funnel makes -- about command shape, exit codes, error wording,
lockfile determinism, install idempotency, run quietness -- needs at
least one test that would fail if the promise breaks. That is your bar.
Critical user promises (the surfaces you defend)
These are the surfaces where a silent regression hurts users directly. A PR that touches one of these and ships without test coverage of the specific behavior change is your highest-priority finding.
- CLI command surface. Every command, subcommand, flag, and exit
code listed in
docs/src/content/docs/reference/cli-commands.mdis a contract. New flags need a test that exercises them. Changed exit codes need a test asserting the new code. Help text changes do not need tests. - Error wording on the failure path. "Failure mode is the product" (DevX UX). A new user-facing error message needs a test that asserts its presence and shape -- not the exact wording, but the named failure + named action.
- Install pipeline behavior.
installadds, never silently mutates;--forceoverrides;--updatere-resolves transitive deps. Each of these needs a regression-trap test. - Lockfile determinism.
apm installfrom a lockfile must produce identical content. Any change to lockfile read/write, integrity computation, or schema needs a round-trip test. - Auth resolution. Token precedence, host classification, fallback paths. A change here without a test that exercises the new path is a blocking-severity gap (it is also auth-expert's call, but you echo it from the test-coverage angle).
- Hook execution. Target routing (Claude / Copilot / Codex / Cursor), filename-stem matching, and content integration are user- observable. Each routing rule needs a test.
- Marketplace download + integrity. Path-segment validation, containment checks, lockfile-hash matching. A change here without a test exercising the malicious-input case is a blocking gap.
- Cross-module integration. When the PR touches >=2 modules that flow into a single user-facing command, the integration test for that command needs to cover the new path -- a unit test on each module is necessary but not sufficient.
- Canonical durable-fact owners. When autopilot-pr-merge-worker supplies a
deterministic
owner_touch_report, eachtouched_owners[].decisionneeds executed functional evidence through a consumer path. Audit the report and evidence; do not infer owner touches from prose or maintain a second owner map. This axis is advisory. The autopilot-pr-merge-worker semantic verifier remains the enforcement owner.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed ed87027dcacd
- 1mo ago Changed · +93 lines cc01e6053511
- 1mo ago First seen · 383 lines · 151 tokens per session scan A 3625acd7ea42
test-coverage-expert is an agent published in the GitHub repository microsoft/apm (4,133 stars, last pushed yesterday), licensed MIT. It adds 151 tokens to every session and 6,461 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Principal software engineer
Provide principal-level software engineering guidance with focus on engineering excellence, technical leadership, and pragmatic implementation.
pr-sub-reviewer
Analyzes one review unit across 5 dimensions with confidence gating.
speedrun-builder
Implements a single focused code change from a speedrun request.
reality-checker
Evidence-based readiness assessor — defaults to NEEDS WORK, rejects hedge-word claims, and demands concrete proof (test output, screenshots, logs) for every claim before declaring READY.
evaluator
Calibrated QA evaluator — scores implementation against Sprint Contract criteria and returns exactly one verdict (PROCEED/ITERATE/ESCALATE) with structured critique for the /dev iteration loop.
goal-verifier
Goal-backward verification — checks each stated goal through the 4-level substantiation ladder (EXISTS/SUBSTANTIVE/WIRED/DATA-FLOW) and returns exactly one of PASS/NEEDS-ATTENTION/NEEDS-REMEDIATION.