Project Info
Inspiration
Loadout started with a problem I kept running into myself: improving an AI coding agent still means hunting through GitHub, Reddit, X, and old bookmarks. A useful skill appears in one repository, an MCP server lives somewhere else, and a better tool launches the following week. New users do not know what is worth installing, while experienced users eventually lose track of where everything came from. Our first instinct was simple: find every popular repository and install all of it. We quickly learned why that would not work. GitHub stars are a useful discovery signal, but they do not prove that something is safe, maintained, compatible, or useful for the project in front of you. Loading thousands of skills also makes an agent harder to use, not better. That changed the idea. Instead of building a giant download script, we built a package manager for the extensions around AI coding agents.
What it does
Loadout is a local, open-source CLI that discovers, installs, updates, recommends, and safely removes skills, MCP servers, and runtime tools across Codex, Claude Code, Cursor, and other coding agents. It offers four ways to build your setup: Stable installs a focused 30-skill daily setup from four pinned public sources. Power prepares a broader cross-project toolkit. Maximum downloads thousands of screened skill copies into a disabled local library, then activates a smaller set that matches the current project. Custom lets users install one exact package without replacing everything else. Loadout can scan skills that are already installed, detect collisions, recommend tools based on a repository, check managed sources for updates, and watch newly popular GitHub projects through a discovery queue. Every change is previewed before it is applied. Loadout protects existing files, records what it manages, and creates a rollback snapshot before changing an agent's setup. MCP servers and executable tools remain separate, explicit choices because they can require credentials or start external processes. The normal skill workflow does not require an OpenAI or Anthropic API key.
How we built it
Loadout is a TypeScript and Node.js CLI built with Commander, Zod, and Vitest. Its catalog currently credits 53 pinned public repositories across 39 categories. A separate discovery snapshot observes 240 repositories, including 216 candidates that have not been promoted into the catalog. Discovery and installation are deliberately separate: a repository becoming popular is a reason to inspect it, not permission to install it automatically. The installation engine uses agent adapters, managed manifests, filesystem checks, and snapshot-backed transactions. Its adapter matrix covers 12 coding agents, while Stable, Power, Maximum, and project optimization all use the same underlying safety and rollback pipeline. We built Loadout during OpenAI Build Week as a three-person team working closely with Codex and GPT-5.6. We used Codex for product planning, repository research, architecture, implementation, debugging, code review, testing, and release preparation. GPT-5.6 was especially valuable when a change affected several connected systems, such as catalogs, agent directories, update behavior, and rollback history. The humans still made the product decisions, reviewed risky operations, tested releases on real machines, and decided what Loadout should trust. Challenges we faced The hardest part was not downloading files. It was making those downloads understandable and reversible. Different agents store skills and MCP configuration in different places. Users may already have files occupying those locations. Some repositories contain hundreds of valid components alongside a few suspicious or malformed ones. Updates can change code that was previously inspected, and large repositories can make a straightforward update check painfully slow. Real terminal testing exposed problems our initial plans missed: Graphify appeared inside Claude Code but was missing from Codex inventory because the installer and scanner recognized different Codex paths. Large update checks timed out because they fetched entire repositories even when nothing had changed. Existing unmanaged skills could collide with Stable installations. Removing adopted or externally modified files required stronger ownership and drift checks. ChatGPT and Claude subscriptions were easy to confuse with separately billed API access. Thousands of Maximum-library skills had to remain available without flooding every agent's active context. We fixed these problems by repeatedly running the real commands on Codex and Claude Code profiles, pasting the exact output into Codex, tracing the responsible code, and turning every reproducible failure into a regression test.
What we learned
The biggest lesson was that more extensions do not automatically create a better agent. The useful product is a broad library paired with a small, relevant active set. We also learned that discovery, trust, and installation are three different decisions. Stars can help find a project. Static inspection can identify risks. Neither one proves that a tool is universally useful. Finally, safety is not just a security feature. Previewing changes, explaining credentials, protecting user edits, and making rollback obvious are all part of making a developer tool pleasant to use. What we are proud of Loadout is now published on npm as a real CLI rather than a hackathon-only interface. The current release includes: 53 credited and technically inspected catalog repositories A discovery snapshot observing 240 repositories Stable, Power, Maximum, and Custom workflows Project-aware recommendations and activation Skill reconciliation and update checks Explicit MCP and Graphify installation paths Support infrastructure for 12 coding agents Snapshot-backed rollback and complete uninstall 625 automated tests, packaged CLI journeys, and a 1,000-skill performance gate Most importantly, we used Loadout on our own Codex and Claude Code profiles and safely rolled the changes back.
What's next
Next, we want to add repeatable package benchmarks, signed catalog releases, community loadouts, more credential-aware MCP recipes, and stronger ranking based on real user outcomes. The long-term goal is simple: when a better AI coding extension appears tomorrow, developers should not have to discover it by accident or rebuild their setup by hand.
Try it in 30 seconds
You need Node.js 20 or newer and Git.
npm install --global loadout-ai
loadout setup --mode stable --details
The second command detects your coding agents and previews the 30-skill Stable loadout. It does not change agent files. Review the plan, then apply it:
loadout setup --mode stable --yes --approve-risk
loadout status
Loadout saves a rollback snapshot before applying changes. Run
loadout rollback to restore the previous managed state.
--approve-risk acknowledges the instruction-like files reported by the current
Stable preview. Use it only after reading those findings; it does not replace the
preview or the pinned-source checks.
A later --yes invocation recomputes the plan from pinned sources and current agent and filesystem state; it does not persist or prove identity with the earlier preview.
What Loadout does
| Capability | What you get |
|---|---|
| Discover | Find skills, tools, and MCP servers worth reviewing |
| Curate | Inspect, screen, and pin sources before trusting them |
| Activate | Install a focused set for this repository across your agents |
| Handoff | Pass durable tasks with bundled context between Claude Code and Codex |
| Coordinate | Share file ownership, contracts, decisions, and acknowledgements |
The package manager works across supported agents. Handoff and coordination are currently designed for Claude Code and Codex working in the same repository.
Use Claude Code and Codex together
Handoff: pass a task that survives sessions
loadout handoff codex "write unit tests for auth" --bundle src/auth.ts src/types.ts --verify "tests pass" --verify-command npm --verify-args '["test"]'
Codex sees the task when it checks its inbox, works from the attached bounded context, and marks it done. Claude Code can then read the result. Handoffs live in an append-only project log, so restarting either agent does not erase them. Bundles contain secret-redacted text and are capped at 50 KiB total; still review them before committing and never attach credential files.
Coordinate: work at the same time without stepping on files
loadout coord start --agents claude-code,codex # preview ownership
loadout coord start --agents claude-code,codex --yes # apply ownership
loadout coord snapshot codex # inspect shared state
loadout coord discuss start "REST or GraphQL?" --agents claude-code,codex --rounds 2 --max-turns 5
Coordination is structured shared project state, not shared memory or a merged context window. Events reach an agent at safe turn boundaries or when it checks its snapshot; Loadout does not interrupt a turn in progress.
Let Claude and Codex debate one decision
You prompt once and Loadout calls both providers in bounded turns—propose, critique, synthesize—then records the decision. Neither agent can inject into the other's in-progress turn; events arrive at safe turn boundaries. Each round consumes paid provider turns from your configured Claude and Codex quota. The bounded design discussion reports its turn budget before it starts.
See the live coordination guide for ownership, contracts, acknowledgements, discussions, the local dashboard, and limitations.
Try these prompts
Install Loadout's two first-party skills once so your agent knows the workflow:
loadout skills install loadout-handoff --yes
loadout skills install loadout-curator --yes
Then ask naturally:
"Hand the test writing to Codex."
"What did Codex leave for me?"
"Which skills should be active for this repo?"
The curator helps choose a focused active set; the handoff skill manages inboxes and coordination without making you relay every command.
Install and choose your agent
For a reproducible install, pin the current release:
npm install --global loadout-ai@0.9.4
loadout setup --mode stable --details
loadout setup --mode stable --yes --approve-risk
loadout status
Stable is the recommended starting point: 30 selected skill directories from
four pinned public sources. Loadout auto-detects supported agents; use
--agents when you want to narrow the destination.
If anything fails, follow the user test guide. For profiles, per-agent paths, MCP configuration, and advanced commands, use the full reference.
Safety and trust
Choose -> Inspect -> Preview -> Apply -> Undo
- Preview is the default for setup, updates, and removal.
- Every managed apply creates a rollback snapshot first.
- Catalog sources are pinned and technically inspected, not declared safe or useful by fiat.
- Static inspection reports scripts, hooks, binaries, domains, credential references, and unsupported components; it is not a security audit.
- Project recommendations read bounded local metadata. The documented local flow does not upload project source.
- MCP servers and executable tools stay behind separate preview, permission, and setup steps.
- Shared manifests store environment-variable or OS-keychain references, not secret values.
- All catalog records have identified SPDX licenses. See the recorded license decisions for the source-by-source record.
Read the security policy, catalog policy, and credential and update policy before trusting third-party content.
Demo
Watch the 72-second Loadout demo on YouTube.
Why Loadout
Loadout started with a frustrating question: why does improving an AI coding agent still mean opening twenty GitHub tabs?
Useful skills, plugins, MCP servers, and settings arrive one experiment at a time. Soon it is hard to remember what is installed, where it came from, whether something better launched yesterday, or how to undo a change. The name comes from games, where your loadout is the set of tools you choose for the mission. This does the same for AI coding agents without making you rebuild the setup for every agent and every project.
Most extension tools begin with a repo you already know. Loadout begins one step earlier: what is actually worth knowing? It stays with you after installation.
Some tools distribute agent configuration. Others share memory or coordinate running agents. Loadout connects the whole lifecycle: discover and inspect what is worth using, activate it reversibly across agents, then hand work off or coordinate structured project facts when Claude Code and Codex work together.
Everything on this page is enforced. docs/evidence/readme-claims.json records
each material claim with the code or command that proves it, and CI fails the
build when the README and the implementation disagree—including the pinned
version in the install line above.
Loadout watches a much wider catalog than it activates. You can keep thousands of technically screened skill copies in the disabled Maximum library, discover new projects as they appear, and let each codebase pull a focused active set instead of dumping everything into every prompt.
| The usual workflow | The Loadout workflow |
|---|---|
| Find recommendations across feeds and bookmarks | Watch one growing discovery catalog |
| Open every repo and guess whether to trust it | Inspect pinned sources, licenses, components, and risk findings |
| Copy skills separately into Claude, Codex, Cursor, and friends | Apply one reviewed selection across detected agents |
| Let every skill compete for context forever | Keep a bounded daily set or activate skills for this project |
| Hope updates do not break anything | Preview updates and protect every managed change with a snapshot |
| Manually remember what was changed | Scan, reconcile, remove, roll back, or completely uninstall |
Loadout is local, open source, and preview-first. It does not need an LLM API key to manage skills.
Profiles
| Mode | Sources | Skills | Active by default |
|---|---|---|---|
stable | 4 | 30 | yes—recommended starting point |
power | 8 | 56 | yes |
maximum | all reviewed | all | no—downloaded but disabled |
custom | your --package list | varies | yes |
Maximum downloads the reviewed library and leaves every skill disabled. Nothing reaches an agent prompt until a project activates what it needs. See the full reference for source lists and custom configuration.
Catalog and discovery
Discovery is separate from trust and installation. A popular new repository can enter the review queue without being installed or promoted automatically.
loadout discover --source all --queue
loadout review-queue
loadout candidate inspect owner/repository
The bundled catalog currently contains 53 credited public repositories across 39 categories: 34 have skill components and 19 are MCP-only. All 53 are technically screened and pinned; 4 sources are selected by the bounded Stable policy. See every linked source, license status, component type, and pinned commit in Catalog and upstream credits.
Catalog maturity: 53 sourced, 53 technically inspected, and 4 selected for Stable. Independent human-review attestations and signed comparative benchmarks are not yet published, so Loadout does not pretend static inspection proves usefulness. The pinned catalog remains usable today, and local outcomes can be recorded to improve later rankings. Definitions and promotion rules are in the catalog policy.
Discovery snapshot (generated 2026-09-22): 238 repositories observed, including 219 uncataloged review candidates and 19 repositories already in the inspected catalog.
Agent support
Loadout's adapter capability matrix currently covers 12 agents: Claude Code, Cline, Codex, Cursor, Gemini CLI, GitHub Copilot, Hermes, Junie, Kiro CLI, OpenCode, Roo Code, Windsurf. See the complete feature matrix for configured paths, filesystem lifecycle, platform, and native-host evidence.
tests/adapter-conformance.test.ts plans, applies, inspects, disables, re-enables, and rolls back one skill for every configured target when the suite runs. A configured target path does not prove that the native application recognizes or executes it. Native application execution is not inferred from filesystem simulation.
Configured platform evidence: Linux (CI configured), macOS (CI configured), Windows (CI configured).
Platform evidence source: .github/workflows/ci.yml (cross-platform job).
Configured CI platforms describe a manually triggered workflow, not evidence that a current run passed.
Command reference
| Goal | Command |
|---|---|
| Guided first run | loadout guide |
| Preview or apply Stable | loadout setup --mode stable --details · then --yes --approve-risk after review |
| Inspect managed skills | loadout status · loadout library |
| Recommend for this repository | loadout recommend --project . |
| Activate a project-specific set | loadout optimize --project . --limit 30 |
| Scan or update | loadout scan · loadout update |
| Send a task | loadout handoff codex "write tests" |
| Use a handoff template | loadout handoff codex src/auth.ts --template write-tests |
| Preview two-agent ownership | loadout coord start --agents claude-code,codex |
| Inspect coordination state | loadout coord snapshot codex |
| Detect shared contract candidates | loadout coord detect |
| Turn a decision into tasks | loadout coord discuss implement <thread-id> |
| Start the coordination MCP server | loadout serve |
| Health check | loadout doctor |
| Restore the previous managed state | loadout rollback |
| Preview complete removal | loadout uninstall |
| Full CLI reference | loadout --help · loadout advanced |
Most mutating commands are previews first. Add --yes only after reviewing the plan.
What's next
| Feature | What it unlocks |
|---|---|
| Async discuss | coord discuss turns stored as events — agents debate across sessions, neither has to be live at the same time |
| GitHub Actions sync | loadout sync in CI applies the committed skill selection — every team member and every CI run gets an identical curated set |
| Handoff templates | reusable task blueprints (--template write-tests, --template refactor-module) with pre-configured verify commands |
| Cross-repo handoff | pass a task from one repository to another with bundled context — useful when frontend and backend live in separate repos |
| Cost ledger | track provider turns spent per discussion, project, and week so quota usage stays visible |
| Agent-generated skills | agent notices a repeated pattern and proposes a new skill directly into the catalog |
| Outcome-based skill ratings | record local install outcomes so rankings improve from real usage rather than star counts |
Development
npm ci
npm run verify
npm run verify:full
verify invokes format:check, lint, typecheck, check:audit, check:evidence, test, test:e2e:cli, test:e2e:readme, test:e2e:coordination, test:package, test:performance in that order. verify:full runs that gate and the coverage suite.
The testing guide documents each check and its boundary.
Documentation
- Full CLI and profile reference
- User test guide
- Live Claude Code ↔ Codex coordination
- Catalog and upstream credits
- Catalog evidence policy
- Feature and evidence matrix
- Testing contract
- Changelog
Contributing, security, and attribution
See CONTRIBUTING.md · Code of Conduct · Report vulnerabilities through SECURITY.md, without credentials, private source, or unredacted state. General bugs and proposals belong in the issue tracker.
The catalog contains 53 credited public repositories. Inclusion records discovery and attribution; it does not transfer ownership, imply endorsement, or relicense upstream work.
License
Loadout is licensed under the MIT License. Catalog entries retain their upstream licenses and terms.
Analysis
View
Metric
- 141
- 12
- 6
- 1
Figures cover GitHub contributors during the hackathon window. A co-authored commit counts in full for each author, so per-member totals add up to more than the whole-team figures.
Technology
- JavaScriptIn code
- TypeScriptIn code
- Node.jsClaimed
- OpenAIClaimed
2 of 4 appear in the indexed code. 2 claimed on Devpost could not be matched to code, which may simply mean the tool leaves no trace in the repository.
AI coding agents
- Claude CodeConfig
Detected from committed agent config files and commit authorship. Absence of a signal is not proof an agent was unused.
Codebase size
Source size
2.4 MB
Source files
270
Counts recognized source files only; vendored directories, binaries and lockfiles are excluded, so this is smaller than the repository on disk.
Repository
VirajMishra1/loadout
304 files · 5.3 MB · @ 6d4eda8
Structure
Application logic
103 files · 34%Domain rules, services and shared utilities.
Supporting
Layers are inferred from where files sit in the tree, not from reading the code. A project that names its directories unconventionally will read oddly here — open the file browser to check anything the diagram implies.
Languages
- TypeScript82%
- Markdown18%
- YAML0%
- JavaScript0%
- Shell0%
Share of indexed source by file size. Binary and vendored files are excluded.
Dependencies
package.json
npm · 11- commander
- zod
- +9 more
Declared in the repository’s manifests at the indexed commit. A declared package is not proof it is used, and runtime dependencies are listed first.
This project’s features have not been analysed yet.
Export this project's context (description, README, evidence, key source files) to chat with an AI agent elsewhere.