Welcome to Workloom

The package manager for AI agent configuration.

If you're managing Claude, Codex, Gemini, Copilot, and Cursor across multiple repositories, you're solving the same problem five times over. Workloom fixes that — one canonical source of truth, rendered deterministically to every provider, with enterprise trust and privacy built in.

The Problem

Your engineering organization uses multiple AI tools. Each has its own configuration format, its own file locations, its own rules:

Tool	Files You Manage
Claude	.claude/settings.json, CLAUDE.md, .claude/skills/, .claude/hooks/
Codex	AGENTS.md, .codex/config.toml, .codex/skills/
Copilot	.github/copilot-instructions.md, .github/instructions/
Cursor	.cursor/rules/, .cursorrules
Gemini	Extension manifests

Now multiply that across every repository in your org. Your instructions get copy-pasted. Your skills drift between teams. Your hooks are unversioned. When someone updates a shared MCP server config, there's no review process, no drift detection, and no audit trail.

It's the pre-npm era of AI configuration. And it's getting worse every week.

The Solution

Workloom manages AI workflow assets the way npm manages code dependencies — but built from the ground up for the trust and privacy requirements of AI agent configuration.

The Mental Model

Think of it as three layers working together:

1. npm-like package management — Version your AI instructions, skills, hooks, and MCP server configs as org-scoped packages. Pin specific versions per repository.
2. Terraform-like desired state — Declare which packages apply to which repos. Detect drift when reality diverges from desired state. Restore automatically.
3. Provider-aware renderers — Generate the right files for each provider from the same canonical source. Claude gets CLAUDE.md. Codex gets AGENTS.md. Cursor gets .cursor/rules/. All from one package.
4. Enterprise governance — Trust gates block risky assets (hooks, MCP servers, tool permissions) before they touch disk. Audit trails track every change. Privacy-first telemetry captures only what you opt in to.

What You Get

• Define once — Write your AI instructions and skills once as versioned packages
• Assign per workspace — Declare which packages apply to each repo (including monorepo targets)
• Render automatically — Workloom generates provider-specific files deterministically
• Detect drift — Know instantly when a developer's local files diverge from the org's desired state
• Enforce trust — Hooks and MCP servers require explicit approval before they appear on disk
• Stay private — Telemetry captures metadata only. Never code, prompts, secrets, or PII.

Quick Taste

Let's validate a workspace manifest to see Workloom in action:

pnpm wl validate fixtures/workspaces/simple-workspace.json

Output:

Valid workspace manifest: fixtures/workspaces/simple-workspace.json
  Workspace: Simple Workspace (wksp_simple_01)
  Targets: root
  Revision: 1

That's a workspace — a declaration of which packages apply to a repository. In Phase 1, wl pull will render all the provider-specific files from those packages. For now, wl validate checks that the manifest is correct and that trust policies are satisfied.

What You'll Learn

In this documentation, you'll understand:

• Getting Started — Installation, quick start, and your first workspace
• Core Concepts — Packages & assets, workspaces & targets, providers, trust & privacy, and drift detection
• How It Works — The flow from canonical packages through workspace declarations to deterministic rendering

Current Status

Phase 0 is complete. The schemas are defined. Validation works. The trust model is implemented. All fixtures pass validation.

Phase 1 is next. The CLI will gain wl init, wl pull, wl status, wl diff, wl restore, and wl sync. The Claude and Codex renderers will be fully implemented. That's when Workloom becomes truly useful — you'll go from validation to actually managing your AI configuration across your org.

Ready? Start with Installation.