# Loadout > The package manager for AI coding agent extensions. Discover, install, update, optimize, and roll back skills and MCP tools across Codex, Claude Code, Cursor, and more. - **Type:** MCP server - **Install:** `agentstack add mcp-virajmishra1-loadout` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [VirajMishra1](https://agentstack.voostack.com/s/virajmishra1) - **Installs:** 0 - **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [VirajMishra1](https://github.com/VirajMishra1) - **Source:** https://github.com/VirajMishra1/loadout - **Website:** https://www.npmjs.com/package/loadout-ai ## Install ```sh agentstack add mcp-virajmishra1-loadout ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About Loadout Agent extensions, under control. The package manager for your AI coding setup. Discover broadly. Activate the right tools for each project. Stay current without starting over. Install · Why Loadout · Profiles · Discover · Trust · Commands ## Install You need Node.js 20 or newer and Git. ```bash npm install --global loadout-ai@0.5.9 loadout setup --mode stable ``` The second command detects your agents and previews the 30-skill Stable loadout. Nothing changes until you approve it. If anything goes wrong, start with the [user test guide](./docs/USER_TEST_GUIDE.md). ## How it works **Choose -> Inspect -> Preview -> Apply -> Undo** 1. **Choose** Stable, Power, Maximum, or your own package list. 2. **Inspect** where each extension comes from and what it can do. 3. **Preview** every planned change without changing agent files. 4. **Apply** with `--yes`; Loadout saves a rollback snapshot first. 5. **Undo** with `loadout rollback` if you change your mind. ### Abridged terminal transcript This is an explicitly abridged transcript from a disposable, single-Codex Stable run. A literal `…` marks omitted fetch output; `` is a variable placeholder because snapshot IDs vary. ```console $ loadout setup --mode stable --agents codex … Loadout: Stable Boost Detected agents: Codex Catalog selection: 4 repositories Ready to install: 4 skill repositories (30 agent skill directories) Preview complete; nothing was changed. Re-run with --yes to install this exact screened plan. $ loadout setup --mode stable --agents codex --yes … Loadout installed 4 repositories for 1 agent(s). Snapshot: $ loadout rollback Restored snapshot ``` The final preview sentence above is captured CLI wording. A later `--yes` invocation recomputes the plan from pinned sources and current agent and filesystem state; it does not persist or prove identity with the earlier preview. Preview may fill Loadout's private download cache, but it does not change your agent files. Review the summary and warnings before approving an apply command. ## Why Loadout Loadout started with a frustrating question: **why does improving an AI coding agent still mean opening twenty GitHub tabs?** Useful skills, plugins, MCP servers, and settings arrive one experiment at a time. Soon it is hard to remember what is installed, where it came from, whether something better launched yesterday, or how to undo a change. The name comes from games, where your loadout is the set of tools you choose for the mission. This does the same for AI coding agents without making you rebuild the setup for every agent and every project. Most extension tools begin with a repo you already know. Loadout begins one step earlier: **what is actually worth knowing?** It stays with you after installation. Loadout watches a much wider catalog than it activates. You can keep thousands of technically screened skill copies in the disabled Maximum library, discover new projects as they appear, and let each codebase pull a focused active set instead of dumping everything into every prompt. | The usual workflow | The Loadout workflow | | -------------------------------------------------------------- | ---------------------------------------------------------------- | | Find recommendations across feeds and bookmarks | Watch one growing discovery catalog | | Open every repo and guess whether to trust it | Inspect pinned sources, licenses, components, and risk findings | | Copy skills separately into Claude, Codex, Cursor, and friends | Apply one reviewed selection across detected agents | | Let every skill compete for context forever | Keep a bounded daily set or activate skills for this project | | Hope updates do not break anything | Preview updates and protect every managed change with a snapshot | | Manually remember what was changed | Scan, reconcile, remove, roll back, or completely uninstall | Loadout is local, open source, and preview-first. It does not need an OpenAI or Anthropic API key to manage skills. MCP servers and executable tools stay behind their own explicit setup and permission steps. ### Demo **[Watch the 72-second Loadout demo on YouTube](https://www.youtube.com/watch?v=opNqJKX7xMw).** It shows the real CLI product, including profiles, project-aware selection, discovery, explicit integrations, and snapshot-backed rollback. The exact [recording and voiceover script](./docs/DEMO_SCRIPT.md) is public. The [end-to-end acceptance guide](./docs/USER_TEST_GUIDE.md) contains the commands you can run yourself. ## Stable workflow ### Stable Boost: install the essentials and start building Stable is the recommended daily driver: **30 selected skill directories from four pinned public sources**, installed into each agent you choose. It covers planning, implementation, debugging, testing, documentation, code review, frontend work, performance, Git, shipping, and more without turning every discovered skill on. | Included source | What Stable takes from it | GitHub | | ---------------------------------------------------------------------- | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | [Superpowers](https://github.com/obra/superpowers) | Planning, execution, testing, review, verification | [](https://github.com/obra/superpowers) | | [Context7](https://github.com/upstash/context7) | Current documentation and MCP workflows | [](https://github.com/upstash/context7) | | [Addy Osmani Agent Skills](https://github.com/addyosmani/agent-skills) | Engineering, frontend, debugging, performance, docs, shipping | [](https://github.com/addyosmani/agent-skills) | | [Agent Skills Marketplace](https://github.com/wshobson/agents) | Architecture, review, error handling, JavaScript, Python | [](https://github.com/wshobson/agents) | Every row links directly to the upstream project. Loadout does not claim ownership or endorsement; it pins, credits, screens, and selects from their public work. ```bash # Preview for detected agents loadout setup --mode stable # Recompute from current state and apply after reviewing the preview loadout setup --mode stable --yes # Inspect managed state, then undo the install if needed loadout status loadout scan loadout rollback ``` Stable is Loadout's strongest general starting point, not a claim that one setup is best for every person or project. Run `loadout profiles stable --json` when you want the machine-readable selection. ## Manage skills you already have Already have skills? Loadout can compare them with exact catalog copies and manage the ones it can identify confidently: ```bash # Read-only inventory and source/update comparison loadout scan loadout reconcile --refresh # Record ownership only for exact byte-for-byte matches; files are not rewritten loadout reconcile --yes # Preview old copies that have one unambiguous reviewed source loadout reconcile --replace-outdated ``` Unknown or ambiguous copies stay untouched. Replacing an old copy is a separate, previewed transaction with its own rollback snapshot. Managed copies can then be checked by `loadout update` without moving them to a different agent path. ## Profiles Loadout is opinionated when you want it to be and precise when you do not. ### Power Boost: a larger cross-project toolkit Power draws a skill-level allowlist from eight major collections. The prepared set is deduplicated and invalid units are quarantined, so the final count can be lower than the raw allowlist. In current acceptance testing it prepared about 50 active skills per agent. | Included source | Focus | GitHub | | ------------------------------------------------------------------------ | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Anthropic Skills](https://github.com/anthropics/skills) | Documents, frontend, MCP building, web testing | [](https://github.com/anthropics/skills) | | [OpenAI Skills](https://github.com/openai/skills) | CLI, docs, browser work, images, security | [](https://github.com/openai/skills) | | [Vercel Agent Skills](https://github.com/vercel-labs/agent-skills) | React, web design, composition, deployment | [](https://github.com/vercel-labs/agent-skills) | | [Superpowers](https://github.com/obra/superpowers) | Planning, debugging, testing, collaboration | [](https://github.com/obra/superpowers) | | [UI UX Pro Max](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill) | UI systems, slides, styling, product design | [](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill) | | [Context7](https://github.com/upstash/context7) | Current documentation and MCP workflows | [](https://github.com/upstash/context7) | | [Agent Skills Marketplace](https://github.com/wshobson/agents) | Architecture, testing, APIs, TypeScript, Python | [](https://github.com/wshobson/agents) | | [Awesome Copilot](https://github.com/github/awesome-copilot) | Codebase knowledge, plans, browser and security workflows | [](https://github.com/github/awesome-copilot) | ```bash loadout setup --mode power ``` ### Maximum Library: download broadly, activate intelligently Maximum is for explorers. It downloads every non-archived, technically screened skill component in the catalog into Loadout's **disabled local library**. Disabled means cached and available, not injected into agent context. Then let the current project choose a focused active set: ```bash loadout setup --mode maximum loadout recommend --project . --agent codex loadout optimize --project . --agents codex,claude-code --limit 30 loadout optimize --project . --agents codex,claude-code --limit 30 --yes ``` This is the difference between “install everything” and “have everything ready.” The first overloads agents; the second gives you a large library with a small, relevant active loadout. ### Custom: take exact control Use `setup` when the listed packages should become the complete managed profile for the selected agents. Packages from the previous managed profile that are not listed will be retired, and the preview names every retirement: ```bash loadout setup --mode custom --package superpowers --package context7 ``` Use `install` when you only want to add a package without replacing the current managed profile: ```bash # Install the reviewed Humanizer writing skill into Codex loadout install --mode custom --package humanizer --agents codex # Install the reviewed Obsidian skills explicitly loadout install --mode custom --package obsidian-skills --agents codex,claude-code ``` Run `loadout profiles` to compare every mode. MCP servers always use a separate approval step. Obsidian skills are also proposed automatically when `recommend` or `optimize` detects an Obsidian vault; they are not added to the universal Stable set. ## MCP integrations Profiles never start MCP servers silently. First list the available recipes and see which ones need credentials: ```bash loadout mcp-recipe loadout mcp-recipe --credential-free ``` Preview and configure one for the host you use: ```bash loadout mcp-recipe playwright --agent codex loadout mcp-recipe playwright --agent codex --yes loadout mcp-recipe playwright --agent codex --verify loadout mcp-recipe playwright --agent claude-code loadout mcp-recipe playwright --agent claude-code --yes ``` Configuration alone does not start the server. Test a real connection separately with `--connect --approve-risk`. Loadout can reference credentials from environment variables or the OS keychain without printing their values. ## Optional runtime tools [Graphify](https://github.com/Graphify-Labs/graphify) is an optional codebase graph tool. It installs both a command and an agent skill, so Loadout keeps it separate from the normal profiles. It does not require an OpenAI or Anthropic API key: ```bash loadout tool graphify --agents codex,claude-code loadout tool graphify --agents codex,claude-code --yes --approve-risk loadout tool graphify --remove --agents codex,claude-code --yes --approve-risk ``` Executable tools remain an explicit choice instead of hiding inside a profile. ## Catalog and discovery ### GitHub moves every day. Your loadout should not stand still. The catalog is not a frozen “top 50” list. Loadout separates **discovery** from **installation** so a viral repo can be noticed quickly without being trusted blindly. Candidates enter a review queue; catalog entries are pinned and inspected; only the bounded Stable policy gets the strongest automatic recommendation. ```bash # Find candidates across configured discovery sources loadout discover --source all --queue # Inspect the queue and one candidate before promotion loadout review-queue loadout candidate inspect owner/repository # Check whether managed active or disabled-library sources changed loadout update loadout health --updates ``` Daily checks are opt-in and read-only. They tell you what changed; they do not silently rewrite your agents: ```bash loadout autopilot --yes loadout autopilot --status ``` The bundled catalog currently contains **53 credited public repositories** across **39 categories**: **34 have skill components** and **19 are MCP-only**. All 53 are technically screened and pinned; 4 sources are selected by the bounded Stable policy. See every linked source, license status, component type, and pinned commit in **[Catalog and upstream credits](./docs/CATALOG.md)**. Catalog maturity: **53 sourced**, **53 technically inspected**, and **4 selected for Stable**. Independent human-review attestations and signed comparative benchmarks are not yet published, so Loadout does not pretend static inspection proves usefulness. The pinned catalog remains usable today, and local outcomes can be recorded to improve later rankings. Definitions and promotion rules are in the [catalog policy](./docs/CATALOG_POLICY.md). Loadout does not claim there is one universally “best” configuration. Recommendations are bounded, rule-based proposals; stars and discovery results are signals for review, not quality proof. **Discovery snapshot (generated 2026-07-22):** [240 repositories observed](./docs/DISCOVERED.md), including 216 uncataloged review candidates and 24 repositories already in the inspected catalog. The checked-in discovery report proves only its dated snapshot, not the success of every scheduled run. Use `loado … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [VirajMishra1](https://github.com/VirajMishra1) - **Source:** [VirajMishra1/loadout](https://github.com/VirajMishra1/loadout) - **License:** MIT - **Homepage:** https://www.npmjs.com/package/loadout-ai Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-virajmishra1-loadout - Seller: https://agentstack.voostack.com/s/virajmishra1 - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.