magpie

agent
Security Audit
Pass
Health Pass
  • License — License: Apache-2.0
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Community trust — 23 GitHub stars
Code Pass
  • Code scan — Scanned 12 files during light audit, no dangerous patterns found
Permissions Pass
  • Permissions — No dangerous permissions requested
Purpose
This is a project-agnostic agent framework designed to assist maintainers of Apache projects. It automates issue triage and generates code fixes that require human review.

Security Assessment
The tool operates within a read/write development context (triaging issues and authoring code). However, the automated code scan found no hardcoded secrets, no dangerous execution patterns, and no request for dangerous system permissions. Because it is designed to author code and handle repository workflows, it naturally makes network requests to interact with GitHub and project infrastructure. Overall risk is rated as Low. All automated actions are gated by human review, preventing silent, unchecked execution.

Quality Assessment
The project is very actively maintained, with its most recent updates pushed today. It is properly licensed under the standard Apache-2.0 license. The codebase passes basic health checks, indicating a professional setup. The main concern is its extremely low community visibility; it currently has only 5 stars. This is likely because the tool is in a pre-release state and operates via an invitation-only adoption model rather than being a public marketplace tool. It was initially built under the Apache Airflow umbrella but is currently undergoing a organizational rename to reflect its broader, project-agnostic scope.

Verdict
Safe to use, especially for targeted Apache contributors, though general users should keep in mind that the project is still in a pre-release state pending an official name change.
SUMMARY

Agent-assisted maintainership and development framework for Apache projects — Triage and Drafting (agent-authored fixes with human review); Mentoring, Pairing (developer-side dev-cycle), and Auto-merge on the roadmap.

README.md

Table of Contents generated with DocToc

Apache Magpie

Heads-up — the project is named Apache Magpie; the GitHub
slug rename is still pending.

The framework's name is Apache Magpie. The current
apache/airflow-steward slug carries airflow for legacy
reasons, but the framework is project-agnostic (it stewards
multiple ASF project workflows, not just Airflow's), so the
working group steering it chose a name that reflects that.

Magpie was selected by the founding PMC and confirmed
available via PODLINGSEARCH. Three alternates were carried
as historical backups during the bikeshed — Beacon, Guild,
and Lichen — but Magpie cleared the name search and is the
final name; the alternates are no longer in play.

Until the rename lands on the GitHub side, every clone URL and
CI integration still uses the legacy apache/airflow-steward
slug — all path examples in this README and the linked docs use
that slug verbatim. The rename will only change the GitHub
repository slug; existing checkouts will keep working with a
single git remote set-url.

A reusable, project-agnostic framework for ASF-project automation.
Currently in development for ASF projects + Python Core team
friendlies. Not a public marketplace skill — adoption is by
invitation while the framework is pre-release; once we ship via
the ASF release policy,
the marketplace path opens up. See
release-distribution
for the canonical distribution mechanism we will adopt.

[!IMPORTANT]
The motivation, scope, and design commitments behind this work
live in MISSION.md — the draft project-
establishment proposal for an Apache Top-Level Project built on
this framework. Read that for the why; this README is the
how once you've decided to adopt.

How adoption works

The framework uses a snapshot + agentic-override adoption
model. An adopter project commits a single skill —
setup
into their repo. That skill manages everything else:

  1. Snapshot. setup downloads the framework into
    a gitignored <adopter>/.apache-magpie/ directory.
    The snapshot is a build artefact, not source — refreshed
    by /magpie-setup upgrade, never committed.
  2. Symlinks. setup symlinks the framework's
    skills (security, pr-management, the rest of setup) under
    one canonical home — .agents/skills/ (the path shared by
    Codex, Cursor, Gemini CLI, Copilot, …) — and gives every
    other agent dir (.claude/skills/, .github/skills/, …) a
    thin per-skill relay symlink pointing back at the
    canonical entry. This is the same regardless of how the
    adopter previously organised those dirs. The symlinks are
    also gitignored — they ultimately target the gitignored
    snapshot, so they would dangle on a fresh clone before
    /magpie-setup runs.
  3. Overrides. Adopter-specific modifications to framework
    workflows live as agent-readable markdown under
    <adopter>/.apache-magpie-overrides/<skill>.md,
    committed in the adopter repo. The framework's skills
    consult those files at run-time and apply the overrides
    before executing default behaviour. See
    docs/setup/agentic-overrides.md
    for the contract.

No git submodules. No marketplace. No vendored copies of
framework skills.
Just one committed skill (the bootstrap),
a gitignored snapshot, and agent-readable override files.

Adopting the framework

Two phases — a shell bootstrap that gets setup
into your repo, then the skill takeover that wires up the
rest interactively.

1. Bootstrap (copy-pasteable shell)

Pick an install method and follow the verbatim recipe in
docs/setup/install-recipes.md:

Method When to use Reproducibility
svn-zip Production once ASF official releases ship to dist.apache.org (signed + checksummed) Frozen by version
git-tag Pin a specific framework version Frozen by tag
git-branch (default main) WIP path — track the framework's main directly. The default during the framework's pre-release phase. Tracks tip

Each recipe is a single shell block that:

  1. Adds .apache-magpie/, .apache-magpie.local.lock, and
    the framework-skill symlinks to .gitignore.
  2. Downloads + verifies + extracts the framework into
    .apache-magpie/ (gitignored — build artefact, not
    source).
  3. Copies the
    setup
    skill into the canonical .agents/skills/magpie-setup/ and
    adds a relay symlink to it from each agent dir you use
    (.claude/skills/magpie-setup, .github/skills/magpie-setup).

After the recipe completes, the framework snapshot is on
disk and the bootstrap skill is in your repo.

2. Skill takeover

Tell your agent: "adopt apache/airflow-steward in my repo"
(or invoke /magpie-setup directly). The skill walks
through the rest:

  • writes .apache-magpie.lock (committed) — the project's
    pin: install method + URL + ref + verification anchor;
  • writes .apache-magpie.local.lock (gitignored) — what
    this machine actually fetched + when;
  • asks which skill families (security, pr-management) to
    symlink in;
  • creates the gitignored framework-skill symlinks;
  • scaffolds .apache-magpie-overrides/ (committed) for any
    local workflow modifications;
  • installs a post-checkout git hook so worktrees re-create
    runtime state automatically;
  • updates your project documentation with a brief mention.

After the skill finishes, you commit the small, focused
diff — the bootstrap skill, the .gitignore entries, the
two lock files (committed + gitignore exclusion for the
local one), the overrides scaffold, the doc note — and you're
done. Open a PR.

Subsequent contributors

Future contributors who clone your repo just say "adopt
Magpie in this repo" (or invoke /magpie-setup).
The skill reads .apache-magpie.lock (already committed)
and re-installs to the same version your project pinned. No
need to redo the manual recipe — the committed lock is the
project's source-of-truth.

Drift detection

Every framework skill compares the gitignored
.apache-magpie.local.lock against the committed
.apache-magpie.lock at the top of its run. If they have
drifted (project lead bumped the pin, or the local install
is stale on a main-tracking adopter), the skill surfaces
the gap and proposes /magpie-setup upgrade. upgrade
deletes the gitignored snapshot, re-installs per the
committed pin, refreshes the gitignored symlinks, and
reconciles any agentic overrides — see
docs/setup/install-recipes.md
and
skills/setup/upgrade.md
for the full flow.

Skill families

Four skill families ship in the framework (plus one experimental
family, mentoring; one proposed family, release-management; and
two meta utilities). Pick whichever families the adopter wants to
use; symlinks for the picked families land in the adopter's skill
directory.

The Modes column maps each family to the MISSION agent-assistance
taxonomy — see docs/modes.md for what each mode
means and which modes are still proposed vs. shipping today.

Family Modes Purpose Detail
setup (infra) Isolated agent setup, framework adoption + maintenance, shared-config sync. The prerequisite — at minimum the setup skill itself runs out of this family. 6 skills, docs/setup/
security A, C 16-step security-issue handling lifecycle — from security@ import through CVE publication, including state sync. Maintainer-only. 9 skills, docs/security/
pr-management A Maintainer-facing PR-queue management — triage, stats, and deep code review. 3 skills, docs/pr-management/
release-management A, C 14-step ASF release lifecycle, planning issue, RC cut + sign, [VOTE] thread, tally, promote, [ANNOUNCE], archive, audit log. Agent never holds the RM's signing key and never publishes the release. Proposed, spec-first, like Mentoring; skill code lands in follow-up PRs. 10 skills proposed, docs/release-management/
mentoring Mentoring Contributor mentoring — spec and tone guide in place; first skill (pr-management-mentor) shipping. Experimental — shape may change as adopter pilots and contributor-sentiment evaluation land. 1 skill, docs/mentoring/
issue A, Triage Issue lifecycle management — triage, bug reproduction, fix drafting, and backlog re-assessment against the current branch. 5 skills
utilities (meta) Framework meta-skills: author or update skills (write-skill); print a live index of all available skills (list-skills). 2 skills

Maintenance

After the initial adoption, the same skill handles ongoing
maintenance:

  • /magpie-setup upgrade — refresh the snapshot to a newer
    framework version + reconcile any overrides against the new
    framework structure.
  • /magpie-setup verify — read-only health check (snapshot
    intact, symlinks live, .gitignore correct, etc.).
  • /magpie-setup override <framework-skill> — open or
    scaffold an override file for a framework skill.

Cross-references

  • MISSION.mddraft project-establishment proposal: motivation, scope, design commitments, initial PMC composition target.
  • docs/setup/agentic-overrides.md — the contract between adopters who write overrides and framework skills that read them.
  • docs/prerequisites.md — what a maintainer needs installed before invoking any framework skill (Claude Code, Gmail MCP, GitHub auth, browser, uv, etc.).
  • AGENTS.md — agent instructions, placeholder convention, framework conventions.
  • CONTRIBUTING.md — for framework contributors.

Reviews (0)

No results found