Apache Magpie: skills for maintaining open source projects
Apache Magpie
Apache skills for triaging issues and pull requests, review, mentoring and security reports: the agent drafts, a person publishes
- 145 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The skills read the project's issues, mail and repository, and the guard plugin blocks shell commands
- The security and release families handle unpublished vulnerabilities and release signing and need maintainer rights
Install
- Works in
Manual install
/plugin marketplace add apache/magpieThen /plugin install magpie-setup@apache-magpie and the other baseline plugins.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The skills read the project's issues, mail and repository, and the guard plugin blocks shell commands
- The security and release families handle unpublished vulnerabilities and release signing and need maintainer rights
This is third-party code. Review the repository files before installing.
What it does
Apache Magpie is a set of skills for the agent you already use: Claude Code, Codex, Antigravity, Copilot and others. The skills take over the routine of maintaining an open source project: triaging issues and pull requests, code review, mentoring newcomers, drafting fixes and handling security reports. Nothing is sent in your name: the agent prepares every comment, email, label and pull request as a draft, a person publishes it, and there is no autonomous mode. The agent is confined before it reads real data: a file and network sandbox, a credential-free environment and a deterministic guard that checks every shell command before it runs and denies those breaking hard rules. Skill families install as separate plugins: setup, utility skills, security (16 steps from importing a mail to publishing a CVE), pull requests, issues, ASF releases, repository maintenance, local review, mentoring and contributor growth. There is deliberately no all-in-one package, since every skill takes context on every turn. Telemetry is off by default.
Who it is for. Maintainers of open source projects, especially Apache ones, who handle a stream of issues, pull requests and security reports and want to hand the draft work to an agent.
Good fit when
- The pull request queue has grown and needs triage, stats and deep review
- Reports reach security@ and must be taken from import to a CVE step by step
- The issue list needs deduplication, reproduction and reassessment
- An ASF release needs a plan, a release candidate build and a vote thread
- You want to prepare explanations and good first issues for newcomers
Not a fit when
- You want an autonomous bot that replies and merges by itself: Magpie deliberately has no such mode
- The repository is small and has no queues: the sandbox and plugin overhead will not pay off
- You want to install everything with one command: there is no bundle because of context cost
- You want a commercial service with an account: the project is open with no account or middleman
Example request
Install the Magpie pull request family and prepare a draft review of an open pull request. Publish nothing: leave the comment as a draft.Limitations
The project is in development for ASF projects and Python core team members, and the README itself asks for testers. Some families (releases, mentoring) are experimental. The security and release skills are meant for maintainers with the matching rights.
Each installed skill spends context on every turn, roughly 0.2 to 2.0 thousand tokens per family, so install only what you need. A pinned copy through `/magpie-setup` is for places where the marketplace is unavailable. Extra MCP servers such as `ponymail`, `apache-projects` and `gmail-plaintext` connect separately.
How to disable. Remove plugins with `/plugin uninstall`, for example the pull request family, and then drop the apache-magpie marketplace if you wish. Installation writes nothing to the project repository.
FAQ
How do I install Magpie in Claude Code?
Run `/plugin marketplace add apache/magpie`, then `/plugin install magpie-setup@apache-magpie`. After that you can ask for the main plugins in plain words: the setup skill runs the installs.
Which plugins are baseline?
Four: `magpie-setup`, `magpie-vetted-ops`, `magpie-agent-guard` and `magpie-utilities`. It is the same floor a project commits to when it adopts Magpie.
Can the agent send an email or merge a pull request on its own?
No. It prepares every comment, email, label and pull request as a draft, and a person sends it. The project has no autonomous mode.
What does the command guard do?
A deterministic check reads every shell command before it runs and denies those that break hard rules. The guard is a separate mechanism outside the model, and prompts do not steer it.
Does Magpie work in Codex and other agents?
Yes, there are short instructions for Codex, VS Code with Copilot, Antigravity, Pi and Goose in `docs/quick-start.md`. For a setup without a marketplace there is a pinned snapshot with the `/magpie-setup` command.
Discussion
No questions or reviews yet.
Related
PluginsA plugin marketplace and installer for the full dev loop: task selection, review, cleanup, PRs and releases
A Claude Code and Codex plugin with skills for code research, tests, refactoring and independent review of finished changes
agent-toolkit offers generic skills for engineering tasks: from a ticket to a plan, tasks and a handover for review.
AI Code Toolkit
aicode-toolkit
Plugins and MCP servers for coding agents: template-based projects, patterns before a file edit and review against YAML rules.
A coding agent for the terminal, browser and CI across 38 model providers, with cross-session memory, MCP, skills and hooks.
Over twenty skills for coding agents: MCP and hooks, plan mode, a bug-fix protocol, prompting and a bash safety hook
README in short
The README states the idea: skills for an agent, nothing in your name, the agent in a sandbox, an Apache project with no accounts and telemetry off by default. Then come installation, usage, updating, a table of skill families with type, modes and skill counts, plus external skill sources and acknowledgements.