Loadout

Inspiration

Loadout started with a problem I kept running into myself: improving an AI coding agent still means hunting through GitHub, Reddit, X, and old bookmarks.

A useful skill appears in one repository, an MCP server lives somewhere else, and a better tool launches the following week. New users do not know what is worth installing, while experienced users eventually lose track of where everything came from.

Our first instinct was simple: find every popular repository and install all of it. We quickly learned why that would not work. GitHub stars are a useful discovery signal, but they do not prove that something is safe, maintained, compatible, or useful for the project in front of you. Loading thousands of skills also makes an agent harder to use, not better.

That changed the idea. Instead of building a giant download script, we built a package manager for the extensions around AI coding agents.

What it does

Loadout is a local, open-source CLI that discovers, installs, updates, recommends, and safely removes skills, MCP servers, and runtime tools across Codex, Claude Code, Cursor, and other coding agents.

It offers four ways to build your setup:

Stable installs a focused 30-skill daily setup from four pinned public sources.
Power prepares a broader cross-project toolkit.
Maximum downloads thousands of screened skill copies into a disabled local library, then activates a smaller set that matches the current project.
Custom lets users install one exact package without replacing everything else.

Loadout can scan skills that are already installed, detect collisions, recommend tools based on a repository, check managed sources for updates, and watch newly popular GitHub projects through a discovery queue.

Every change is previewed before it is applied. Loadout protects existing files, records what it manages, and creates a rollback snapshot before changing an agent's setup. MCP servers and executable tools remain separate, explicit choices because they can require credentials or start external processes.

The normal skill workflow does not require an OpenAI or Anthropic API key.

How we built it

Loadout is a TypeScript and Node.js CLI built with Commander, Zod, and Vitest.

Its catalog currently credits 53 pinned public repositories across 39 categories. A separate discovery snapshot observes 240 repositories, including 216 candidates that have not been promoted into the catalog. Discovery and installation are deliberately separate: a repository becoming popular is a reason to inspect it, not permission to install it automatically.

The installation engine uses agent adapters, managed manifests, filesystem checks, and snapshot-backed transactions. Its adapter matrix covers 12 coding agents, while Stable, Power, Maximum, and project optimization all use the same underlying safety and rollback pipeline.

We built Loadout during OpenAI Build Week as a three-person team working closely with Codex and GPT-5.6. We used Codex for product planning, repository research, architecture, implementation, debugging, code review, testing, and release preparation. GPT-5.6 was especially valuable when a change affected several connected systems, such as catalogs, agent directories, update behavior, and rollback history.

The humans still made the product decisions, reviewed risky operations, tested releases on real machines, and decided what Loadout should trust.

Challenges we faced

The hardest part was not downloading files. It was making those downloads understandable and reversible.

Different agents store skills and MCP configuration in different places. Users may already have files occupying those locations. Some repositories contain hundreds of valid components alongside a few suspicious or malformed ones. Updates can change code that was previously inspected, and large repositories can make a straightforward update check painfully slow.

Real terminal testing exposed problems our initial plans missed:

Graphify appeared inside Claude Code but was missing from Codex inventory because the installer and scanner recognized different Codex paths.
Large update checks timed out because they fetched entire repositories even when nothing had changed.
Existing unmanaged skills could collide with Stable installations.
Removing adopted or externally modified files required stronger ownership and drift checks.
ChatGPT and Claude subscriptions were easy to confuse with separately billed API access.
Thousands of Maximum-library skills had to remain available without flooding every agent's active context.

We fixed these problems by repeatedly running the real commands on Codex and Claude Code profiles, pasting the exact output into Codex, tracing the responsible code, and turning every reproducible failure into a regression test.

What we learned

The biggest lesson was that more extensions do not automatically create a better agent. The useful product is a broad library paired with a small, relevant active set.

We also learned that discovery, trust, and installation are three different decisions. Stars can help find a project. Static inspection can identify risks. Neither one proves that a tool is universally useful.

Finally, safety is not just a security feature. Previewing changes, explaining credentials, protecting user edits, and making rollback obvious are all part of making a developer tool pleasant to use.

What we are proud of

Loadout is now published on npm as a real CLI rather than a hackathon-only interface.

The current release includes:

53 credited and technically inspected catalog repositories
A discovery snapshot observing 240 repositories
Stable, Power, Maximum, and Custom workflows
Project-aware recommendations and activation
Skill reconciliation and update checks
Explicit MCP and Graphify installation paths
Support infrastructure for 12 coding agents
Snapshot-backed rollback and complete uninstall
625 automated tests, packaged CLI journeys, and a 1,000-skill performance gate

Most importantly, we used Loadout on our own Codex and Claude Code profiles and safely rolled the changes back.

What's next

Next, we want to add repeatable package benchmarks, signed catalog releases, community loadouts, more credential-aware MCP recipes, and stronger ranking based on real user outcomes.

The long-term goal is simple: when a better AI coding extension appears tomorrow, developers should not have to discover it by accident or rebuild their setup by hand.