The package manager for AI workflows
Version your AI workflows. Render them for every tool.
Publish instructions, skills, prompts, hooks and MCP configs as versioned packages. Assign them to workspaces, and Workloom renders the files each AI coding tool reads, holds trust-sensitive assets for approval, and tells you when disk drifts from the desired state.
package @acme/frontend-baseline@1.4.0
- claudeCLAUDE.mdpassive_text · automatic
- claude.claude/skills/review/SKILL.mdpassive_text · automatic
- claude.claude/settings.jsonexecutable_hook · needs approval
- codexAGENTS.mdpassive_text · automatic
- copilot.github/copilot-instructions.mdpassive_text · automatic
Sample data · 1 package · 3 providers · 5 files · 1 held for approval
One source, every provider, nothing silent
- 01
Versioned packages
Immutable, semver-numbered packages of AI configuration assets.
- 02
Provider rendering
One package renders into each provider’s own files, the same way every time.
- 03
Trust gates
Hooks, MCP servers and tool permissions wait for explicit approval.
- 04
Drift detection
Know when files on disk diverge from the desired state, and fail CI on it.
- 05
Workspaces and revisions
Declare which packages render into which targets, with every change recorded.
- 06
Home workspaces
Render into ~/.claude and ~/.codex, with effects and preflight checks.
- 07
Review and content scanning
A version passes a content scan before it can be promoted to review.
- 08
Package signing
Sign package versions with Ed25519 keys and verify them.
- 09
Organizations and audit
Roles, SSO configuration and an audit log of who changed what.
- 10
Privacy-safe telemetry
Operational events with anonymized IDs, off unless a workspace key is set.
- 11
CI integration
Generate GitHub Actions workflows that validate manifests and check drift.
From a package to files on disk
- Step 1
Push
Write a package manifest with your instructions, skills, hooks and configs, then `wl push --package <path>` uploads it as a draft package version. The registry runs its content scan first.
- Step 2
Promote and review
Once the content scan passes, `wl publish` moves the draft to pending_review. A maintainer approves or rejects it in the dashboard, after seeing its blast radius.
- Step 3
Assign
A workspace declares which packages render into which targets for which providers. `wl init` or `wl bind <manifest>` writes the binding, .loom/binding.toml, in your repository.
- Step 4
Render
`wl pull --dry-run` shows the render plan; `wl pull` writes each provider’s files and records them in the state file. Trust-sensitive assets wait for approval.
Stop copying AI config between repositories
Publish your instructions, skills and hooks once, assign them to workspaces, and let CI tell you when anything drifts.