# BMAD+ documentation — Get started, examples and release notes
> Install BMAD+, start your first agent workflow, try practical prompts and keep your project current. Step-by-step guides and verified published release notes.
Canonical: https://bmad-plus.rochetta.fr/docs/
Language: en
BMAD+ version: 0.23.1
Documentation reviewed: 2026-10-19
Author: Laurent Rochetta
License: MIT
From installation to your first workflow.
Start with a small task in your own project. This guide shows what to run in the terminal, what to ask your AI assistant and how to keep BMAD+ up to date.
- [Get started, step by step](#start)
- [Examples to build on](#examples)
- [Check and apply updates](#updates)
- [What’s new](#news)
- [Release history](#changelog)
- [When something is unclear](#help)
## Browse by topic
- [Concepts](https://bmad-plus.rochetta.fr/docs/concepts/): What BMAD+ is and the ideas behind it: agents, skills, packs and memory, and how they fit together.
- [How BMAD+ works](https://bmad-plus.rochetta.fr/docs/concepts/how-bmad-plus-works/): What BMAD+ puts in your project, who executes what, and how a request such as "Atlas, ..." becomes files: host-managed execution, the AGENTS.md spine, packs, agents, skills, workflows.
- [Intake: ask first, then act](https://bmad-plus.rochetta.fr/docs/concepts/intake/): Why a pack asks before it acts, how an intake.yaml defines its questions field by field, how answers get a status, and a complete design read with real output. Includes how to write your own.
- [Swarms of sub-agents](https://bmad-plus.rochetta.fr/docs/concepts/swarm/): When to run a panel, a jury or a fanout of sub-agents, the four files that define one, seeded dealing, the 26-unit budget, honest tallies, and a worked buyer panel with real output.
- [Nexus: autopilot, parallel work and durable runs](https://bmad-plus.rochetta.fr/docs/concepts/nexus-orchestration/): Autopilot with checkpoints, supervised parallel work, plan export from a swarm, and the durable runtime (create, start, launch, collect, verify, accept) with its Codex adapter and limits.
- [Memory: decisions, lessons and the brain](https://bmad-plus.rochetta.fr/docs/concepts/how-memory-works/): How BMAD+ keeps decisions, lessons and handoffs between sessions: project memory, the global or portfolio brain and its detection, Zecher, the mem and memory commands, what is never overwritten.
- [Code review and human acceptance](https://bmad-plus.rochetta.fr/docs/concepts/code-review-and-acceptance/): How review scope, anchor and gate make a code review checkable, the built-in rules, and how a person plays an acceptance recipe that is read, triaged and gated. Why a release tag needs one.
- [The registry and skills](https://bmad-plus.rochetta.fr/docs/concepts/registry-and-skills/): registry.yaml as the single source of truth: pack fields, uses_skills, external_module, pipelines, intake, the guarding checks, what is generated, and how a team adds an agent or a pack with Maker.
- [Packs](https://bmad-plus.rochetta.fr/docs/packs/): What each pack adds, who needs it and how to install it.
- [The ten packs: what each one adds and how to choose](https://bmad-plus.rochetta.fr/docs/packs/packs-overview/): A pack is an installable group of agents and skills. Compare the ten BMAD+ packs in one table, learn how to choose, install, add and remove them, and how overlapping packs coexist.
- [Core pack: Atlas, Forge, Sentinel and Nexus](https://bmad-plus.rochetta.fr/docs/packs/core/): The required base pack of BMAD+: four agents from idea to reviewed delivery, six shared skills, install command, eight copyable prompts, outputs, limits.
- [OSINT pack: Shadow, governed public-source research](https://bmad-plus.rochetta.fr/docs/packs/osint/): Shadow runs a phased open-source investigation with a mandatory lawful-basis gate for named people. Install, API keys, budget rule, seven prompts, outputs and legal limits.
- [Maker pack: build and package your own agents](https://bmad-plus.rochetta.fr/docs/packs/maker/): Maker is a meta-agent that designs, validates and packages new BMAD+ agents. Install command, the four creation phases, six prompts, the output folder and what the package is meant for.
- [Shield pack: 27 compliance specialists and 11 workflows](https://bmad-plus.rochetta.fr/docs/packs/shield/): Shield routes compliance questions to 27 framework specialists and 11 GDPR and AI Act workflows, and adds assurance cases, an AI register and review rules. Not legal advice.
- [SEO / GEO pack: audit search visibility and readiness for AI answers](https://bmad-plus.rochetta.fr/docs/packs/seo/): SEO / GEO: three agents audit search visibility and visibility in AI-generated answers (content quality, structured data, AI-readiness) with 15 commands. Install, keys, examples, limits.
- [Memory pack: Zecher and the persistent brain](https://bmad-plus.rochetta.fr/docs/packs/memory-pack/): Zecher keeps decisions, lessons and session handoffs in plain files across sessions and projects. Install, brain detection, eight prompts, outputs, CLI companions and limits.
- [Dev Studio pack: six personas and 38 workflows](https://bmad-plus.rochetta.fr/docs/packs/dev-studio/): Dev Studio covers the software lifecycle with six personas and 38 named workflows, from product brief to code review. Install, the full catalogue by phase, eight prompts, studio CLI, limits.
- [Backup pack: timestamped ZIP backups, restore and rotation](https://bmad-plus.rochetta.fr/docs/packs/backup/): Backup Manager zips your project with a timestamp, lists, restores and rotates the archives with four slash commands. Install, five prompts, where files go, what is excluded and what is not covered.
- [Animated pack: turn an MP4 into a scroll-driven website](https://bmad-plus.rochetta.fr/docs/packs/animated/): The Animated Website Creator turns a video into a scroll-driven page in five steps: analyse, extract frames, write six sections, build, preview. Requirements, six prompts and limits.
- [Design pack: Atelier asks first, then builds, audits and redesigns](https://bmad-plus.rochetta.fr/docs/packs/design/): Atelier is the BMAD+ design engine: a 13-question intake, then build, review or redesign through three skills, labelled evidence and a quoted pre-flight verdict. Install, real session, examples.
- [Agents](https://bmad-plus.rochetta.fr/docs/agents/): Each agent in detail: its role, when to call it and the skills it brings.
- [Roster of all 48 agents](https://bmad-plus.rochetta.fr/docs/agents/agents-roster/): Every BMAD+ agent in one place: 15 entry points, 6 Dev Studio personas and 27 Shield specialists, with their pack, role and how to call them, each linked to its pack page.
- [How agents are activated: names, roles, triggers and chat commands](https://bmad-plus.rochetta.fr/docs/agents/agents-activation/): Call an agent by name, use menu codes, let roles switch through three trigger levels, and use the chat words bmad-help, autopilot and parallel. Includes what to check when an agent stays silent.
- [Reference](https://bmad-plus.rochetta.fr/docs/reference/): Every command, option, file and setting, with exact syntax.
- [CLI overview](https://bmad-plus.rochetta.fr/docs/reference/cli-overview/): How to run bmad-plus, the options every command shares, the installer languages, non-interactive use with --yes, and the exit codes you can rely on in scripts and CI.
- [install](https://bmad-plus.rochetta.fr/docs/reference/cli-install/): Install BMAD+ agents, skills, instruction files and configuration into a project: every flag, what is written, how a re-run behaves, real output and the errors you can meet.
- [update](https://bmad-plus.rochetta.fr/docs/reference/cli-update/): Move an installed project to a newer BMAD+ version with a plan, backups and a receipt you can restore from: flags, what is preserved, refusals, recovery and every message.
- [uninstall](https://bmad-plus.rochetta.fr/docs/reference/cli-uninstall/): Remove what BMAD+ owns from a project and keep your memory, settings, edited and unknown files: flags, exactly what is deleted, what stays, real output and the messages you can meet.
- [doctor](https://bmad-plus.rochetta.fr/docs/reference/cli-doctor/): A read-only health report on an installation: manifest, ownership inventory, modified files, instruction files, runtimes. Flags, every check code, the JSON report, real output and exit codes.
- [update-check](https://bmad-plus.rochetta.fr/docs/reference/cli-update-check/): Ask npm whether a newer BMAD+ release exists and whether your policy would let it apply, without changing anything: flags, statuses, reasons, the JSON fields, cache and offline behaviour.
- [update-policy](https://bmad-plus.rochetta.fr/docs/reference/cli-update-policy/): Show or set the project policy that decides whether BMAD+ looks for updates and whether any may apply without you: modes off, notify and auto, channel, range, prereleases, the file and the errors.
- [autoconfig](https://bmad-plus.rochetta.fr/docs/reference/cli-autoconfig/): Bootstrap BMAD+ in an existing repository or an empty folder: it detects the stack, scores project health, recommends packs, installs them and seeds the project memory.
- [scan](https://bmad-plus.rochetta.fr/docs/reference/cli-scan/): Walk a directory tree, find your projects, detect their stack and activity, and index them in the global brain so BMAD+ knows your whole portfolio.
- [bmad-plus memory](https://bmad-plus.rochetta.fr/docs/reference/cli-memory/): Read the health of the project memory and of the global brain, and export the global brain to one Markdown file. Flags, what it reads and writes, output, exit codes and errors.
- [bmad-plus mem](https://bmad-plus.rochetta.fr/docs/reference/cli-mem/): Recall past decisions and events, journal what an agent did, reinforce a pattern with reward signals and tie lessons to accepted Nexus work. Flags, files, exit codes, output and errors.
- [studio](https://bmad-plus.rochetta.fr/docs/reference/cli-studio/): List the Dev Studio workflows and prepare a read-only context bundle for one of them, so your assistant can run it with the exact instructions that shipped in your project.
- [bmad-plus intake](https://bmad-plus.rochetta.fr/docs/reference/cli-intake/): Validate a pack questionnaire, plan the next questions, record answers with their status and render the brief a pack works from. Flags, exit codes, real output and errors.
- [bmad-plus swarm](https://bmad-plus.rochetta.fr/docs/reference/cli-swarm/): Deal, brief, check, file and tally a swarm of sub-agents within a budget: panel, jury or fanout. Flags, run tree, approval at exit 2, honesty rules, real output and errors.
- [nexus](https://bmad-plus.rochetta.fr/docs/reference/cli-nexus/): Durable task runs: a plan of tasks with disjoint write scopes, attempts you can recover after an interruption, independent verification, and a separate acceptance step.
- [bmad-plus uat](https://bmad-plus.rochetta.fr/docs/reference/cli-uat/): Reference for bmad-plus uat (alias recette): lint, build, serve, import, read, gate and order human acceptance recipes, with flags, exit codes and sample output.
- [bmad-plus review](https://bmad-plus.rochetta.fr/docs/reference/cli-review/): Reference for bmad-plus review: seal a review scope, anchor findings on the code, derive a verdict from coverage, resume, compare and list rules, with flags and exit codes.
- [assurance](https://bmad-plus.rochetta.fr/docs/reference/cli-assurance/): Build a security assurance case: claims backed only by checks that really ran, recorded in a hash-chained ledger, then verified at a commit. Shield tooling, exit codes and failure modes.
- [ai-register](https://bmad-plus.rochetta.fr/docs/reference/cli-ai-register/): Keep a register of the AI tools your project uses, their data, legal basis and transfers, and let a soft check warn about any AI integration found in the repository that the register misses.
- [Configuration file](https://bmad-plus.rochetta.fr/docs/reference/config-yaml/): Every key of _bmad/config.yaml: execution mode, the four checkpoints, the uat block and the swarm budget. Defaults, who reads each key, and what changing it does.
- [Adapters](https://bmad-plus.rochetta.fr/docs/reference/adapters/): The seven AI tools BMAD+ prepares: the file written for each, how a tool is detected, the shared AGENTS.md spine, and how installs and updates protect instructions you wrote yourself.
- [Project layout](https://bmad-plus.rochetta.fr/docs/reference/project-layout/): Every folder and file BMAD+ creates in a project and on your machine, which command creates it, and whether it is yours to edit, BMAD+’s to manage, or state to leave alone.
- [Guides](https://bmad-plus.rochetta.fr/docs/guides/): Step-by-step walkthroughs for common jobs, from installation to updates.
- [Your first hour with BMAD+](https://bmad-plus.rochetta.fr/docs/guides/first-hour/): A newcomer path from an empty terminal to a reviewed first result: install, check, talk to your first agent, review, keep context, stay up to date. Each step with the real command and what to expect.
- [Install, update, uninstall](https://bmad-plus.rochetta.fr/docs/guides/install-lifecycle/): The whole life of BMAD+ in a project: install, check, update with a policy and receipts, restore, uninstall while keeping your memory. What each step writes and removes, and how it behaves offline.
- [Tutorial: from an idea to a swarm](https://bmad-plus.rochetta.fr/docs/guides/idea-to-swarm/): A complete walk-through with real output: install, let Atelier ask first, record a brief, run a simulated buyer panel under a budget, read the honest tally, then uninstall and keep memory.
- [Case study: checking what agents say is done](https://bmad-plus.rochetta.fr/docs/guides/case-study-rebuild-the-site/): One review rated 11 statements false in what 39 agents wrote in under twelve hours, and the reviewers were wrong twice. See how, and replay the five commands.
- [Using BMAD+ in a team](https://bmad-plus.rochetta.fr/docs/guides/for-teams/): What to commit and what to keep local, which settings to agree on, one adapter per teammate on a shared spine, a safe update policy, CI gates and onboarding.
- [Recipes cookbook](https://bmad-plus.rochetta.fr/docs/guides/recipes-cookbook/): Copy-ready prompts and commands for the Core agents and every pack, each with what it really does: Atlas, Forge, Sentinel, Nexus, Shadow, Zecher, SEO, Shield, Dev Studio, Atelier and the CLI.
- [Security and data](https://bmad-plus.rochetta.fr/docs/security/): What stays on your machine, what can leave it and how to check it.
- [Data handling and privacy](https://bmad-plus.rochetta.fr/docs/security/data-handling/): No telemetry and no silent self-update. The eleven flows of the npm package that can send data off your machine, each with what, to whom, when and under which consent, plus what stays local.
- [Trust, ownership and licences](https://bmad-plus.rochetta.fr/docs/security/trust-and-ownership/): Who wrote what, which licences apply, which files BMAD+ owns in your project and how it proves it, what update and uninstall keep, how OSINT is governed, and where the notices live.
- [Questions and fixes](https://bmad-plus.rochetta.fr/docs/faq/): Short answers to what newcomers ask, and what to do when something fails.
- [Frequently asked questions](https://bmad-plus.rochetta.fr/docs/faq/faq/): Thirty-four answers to what newcomers ask: what BMAD+ is, installing and updating, agents and autopilot, swarms, reviews and recipes, data and legal questions, memory and teams. Each answer is exact.
- [Troubleshooting](https://bmad-plus.rochetta.fr/docs/faq/troubleshooting/): Symptom, cause, fix for the failures BMAD+ can actually produce: refused installs and updates, stale locks, doctor errors, stale instructions, needs-approval swarms, not-ready intakes, red gates.
- [Glossary](https://bmad-plus.rochetta.fr/docs/faq/glossary/): Every term used in the BMAD+ documentation, in plain words: host, spine, pack, skill, intake, swarm, seed, checkpoint, gate, receipt, recipe and the status words the tools print, grouped by theme.
## Get started, step by step
You need Node.js 20 or newer and an AI coding tool you already use. BMAD+ supplies project instructions, roles and workflows; your tool supplies the model and execution permissions.
### 1. Open your project folder
Use a terminal in the repository you want to work on, then check your Node.js version. Keep your usual version control workflow.
**In your project terminal**
```sh
node --version
```
The command should report v20 or newer. Install or update Node.js separately if needed.
### 2. Install BMAD+ and choose your tools
Run the installer. Select the adapters for the AI tools you use and the packs your project needs. Core contains Atlas, Forge, Sentinel and Nexus.
**In your project terminal**
```sh
npx bmad-plus@0.23.1 install
```
The installer creates the agent instructions, shared project spine and selected tool adapters. Optional packs may need additional runtimes or API access.
### 3. Start a session in that same folder
Open or restart your AI coding assistant in this project so it can load its adapter and AGENTS.md. Ask it to show the installed agents and workflows.
**In your AI assistant**
```text
bmad-help
```
There is no extra BMAD+ initialization command after installation. bmad-help is a message to the assistant, not a terminal command.
### 4. Give one role a concrete task
Describe your goal, constraints and expected result. For a new idea, start with Atlas. For an existing code change, start with Forge.
**In your AI assistant**
```text
Atlas, help me define a small invoicing app for freelancers. Ask about the users, identify the first useful workflow and write a brief with acceptance criteria.
```
Review the brief before asking Forge to implement one story. A clear deliverable makes progress easier to verify.
### 5. Review the result and preserve context
Ask Sentinel to check the change against its acceptance criteria. Ask for test evidence and a short handoff so the next session can continue.
**In your AI assistant**
```text
Sentinel, review this change against the acceptance criteria. Check the main success and failure paths, report remaining issues and summarize what the next session needs to know. If the BMAD+ CLI is available, seal the scope with bmad-plus review scope, apply the rules in its checklist, quote the code of every finding, account for every selected file, then report what bmad-plus review gate answers.
```
Read the changes and test results. The assistant follows the permissions and capabilities of its host tool.
## Examples to build on
Replace the project details with your own. These are conversation starters, with a clear output to review.
### Turn an idea into a first release
Use after you have described the users and the problem.
**In your AI assistant**
```text
Nexus, plan the first usable release of my appointment-booking app. Have Atlas define scope, Forge propose the smallest implementation and Sentinel define acceptance checks. List dependencies and stop at the plan review before implementation.
```
Expected result: a prioritized plan with a small first story and explicit review points.
### Fix a bug in an existing project
Include the failing behavior, steps to reproduce and any relevant error output.
**In your AI assistant**
```text
Forge, investigate why saving an edited invoice creates a duplicate. Reproduce the issue, trace the cause and propose the smallest fix. Add a regression check for the real failure, then ask Sentinel to review the affected flow.
```
Expected result: a reproduced failure, a focused fix and evidence that the regression is covered.
### Coordinate independent work
Use when your host supports parallel agents and the tasks do not write to the same files.
**In your AI assistant**
```text
Nexus, split the approved work into independent tasks. Give each role a scope, owned files and a definition of done. Use parallel agents only if this host supports them; otherwise run the tasks sequentially. Integrate the results and have Sentinel check the whole user flow.
```
Expected result: bounded assignments, explicit dependencies and one integrated review. Parallel execution comes from the host tool.
### Have a person confirm a delivery
Use when a version reaches your test environment and someone must check it on screen.
**In your AI assistant**
```text
Sentinel, write the acceptance recipe for this delivery on our test environment. One step per gesture, one verifiable fact per line, on-screen labels quoted from the code, and mark the steps that write for real. Build the page, then tell me the link, how long it takes and what I must not skip. Use disposable test data when possible, name the exact folder and files each command changes, and keep automated evidence separate from the person’s answers. Before handing the page over, build it with uat build, check the guarantees it lists, play the essential pass yourself in a real browser — start, tick, type a remark, reload, everything back — and tell me which checks ran.
```
Expected result: a page a non-technical person can play, and a run the agent reads back to classify every failure before anything is fixed.
### Save a session with Zecher
Use before ending a session, with the optional Memory pack installed.
**In your AI assistant**
```text
Zecher, update this project’s memory from the changes and checks we actually completed. Separate implemented, tested, published and still pending work. Record decisions and useful evidence, archive superseded notes without deleting them, and write a short prompt for the next session. Keep project memory local and exclude secrets.
```
Expected result: a concise current context, a dated session handoff and a restart prompt that identifies the next unfinished task.
### Design a screen with Atelier
Use with the optional Design pack installed. Atelier asks its questions first, then follows checkable rules.
**In your AI assistant**
```text
Atelier, run the design read for the invoice list of my app, build the screen, and end with the pre-flight verdict.
```
Expected result: the recorded design read, the screen with every state covered, and the pre-flight verdict quoted as the last line.
### Read a test run without guessing
Use when a person has completed or stopped an acceptance run.
**In your AI assistant**
```text
Sentinel, read the latest acceptance run and compare its fingerprint with the current recipe. Ask what actually happened when answers and evidence disagree. Classify failures before proposing fixes, verify writing steps read-only, and distinguish human observations, automated checks and any explicit risk decision by its named owner. Never mark an unperformed step as passed.
```
Expected result: a clear verdict, evidence for confirmed writes and a short list of checks still requiring action.
### Resume without losing decisions
Use at the start of a later session in the same project; no optional pack is required.
**In your AI assistant**
```text
Read AGENTS.md and the available project memory. Summarize the last verified state, open decisions and the next unfinished task. Distinguish released features from local candidates, and automated checks from human acceptance. Check that the notes still match the code before continuing.
```
Expected result: a short, evidence-based restart. Project notes are useful context and still need to be checked against the current work.
## Check and apply updates
Run these commands from the installed project. The checks below use an already available CLI. If npx --no-install cannot find it, use the explicit versioned command shown below.
### Check the published version
Compare the installed release with npm. The result includes installedVersion, latestVersion, status, updateAvailable and canAutoApply.
**In your project terminal**
```sh
npx --no-install bmad-plus update-check --refresh --json
```
### If the CLI is unavailable or the installation is older
This explicit command downloads the documented CLI and checks your project. On 0.12.2 or earlier, use the migration command in the next paragraph to add update awareness.
**In your project terminal**
```sh
npx bmad-plus@0.23.1 update-check --refresh --json
```
### Review and apply an available update
This command checks npm again and asks for confirmation of the exact target version. Review the report, including any preserved custom files.
**In your project terminal**
```sh
npx --no-install bmad-plus update --latest
```
### Migrating from 0.12.2 or earlier
Use the versioned CLI once. This confirmed migration backs up existing replacements because older installations do not have complete ownership hashes.
**In your project terminal**
```sh
npx --yes bmad-plus@0.23.1 update --yes
```
- Notification is the default. A version check does not enable automatic updates. Offline, stale or unavailable registry results mean the latest version is unknown.
- Updates preserve identified customizations. The report may describe a partial application when local files are retained; the installed version alone does not prove every file matches the release.
- After a successful update, ask the assistant to reread AGENTS.md and the relevant skills, or start a fresh session.
- BMAD+ package updates and BMAD-METHOD source synchronization are separate. These commands update BMAD+; they do not merge upstream source into your project.
### Optional: authorize a bounded automatic-update policy
Enable this only when you want the project to apply eligible releases in the stated semantic-version range. The CLI still checks runtime compatibility, file ownership and the policy. Use notify to return to notifications.
**In your project terminal**
```sh
npx --no-install bmad-plus update-policy --mode auto --range "^0.23.1"
```
**In your project terminal**
```sh
npx --no-install bmad-plus update-policy --mode notify
```
### Recovery after an update
Update receipts and backups live in .bmad/updates/. To restore an update, replace RECEIPT_ID with its actual receipt identifier. Restoration checks the backups and refuses to overwrite subsequent local edits.
**In your project terminal**
```sh
npx --no-install bmad-plus update --restore RECEIPT_ID --yes
```
## What’s new
These notes describe the release verified on npm. The guide, install command and release feed refer to that same publication.
**v0.23.1** · 2026-10-20
The documentation site is rebuilt in four languages with seven videos. Several commands now behave exactly as their pages say: refusals read the same everywhere, a workspace review starts from HEAD, and the config file is plain YAML. Installing and updating work as before.
[Release history](#release-0-23-1)
## Release history
Selected recent releases, dated by their actual npm publication. Summaries describe changes delivered in each release. The package page provides the wider version history.
### v0.23.1 — A truer site, steadier commands
2026-10-20
The documentation site is rebuilt in four languages with seven videos. Several commands now behave exactly as their pages say: refusals read the same everywhere, a workspace review starts from HEAD, and the config file is plain YAML. Installing and updating work as before.
- The website now carries 52 documentation pages, each in English, French, Spanish and German, a rebuilt landing page and seven presentation videos with captions and described transcripts, including a case study of how the site itself was rebuilt with a swarm of agents.
- An --auto update that the policy does not allow is refused with the same message everywhere: Update refused: automatic-updates-not-authorized. The refusals for a legacy ownership inventory and for local conflicts use the same Update refused: form.
- bmad-plus review scope --workspace starts from HEAD when you give no --base, so reviewing uncommitted work no longer fails or drags in the last commit.
- _bmad/config.yaml is written as plain YAML (auto_role_activation: true, not a tagged !!bool 'true') whichever supported js-yaml version wrote it.
- The generated instruction files tell the assistant to skip the version check, without mentioning it, when npx finds no local copy of bmad-plus; Nexus errors carry the Nexus: prefix once instead of twice.
- Shield names PCI DSS v4.0.1 everywhere, the swarm skills say there are three kinds, the Backup pack’s Bash variant prints the archive size like its PowerShell variant, and the npm description, keywords and README credits are refreshed.
[Published package · v0.23.1](https://www.npmjs.com/package/bmad-plus/v/0.23.1)
### v0.23.0 — Ask first, then swarm
2026-10-18
A pack now declares the questions it needs answered before it acts, and Nexus can run a swarm of sub-agents, a simulated panel or a jury, within a budget you set. Atelier, the design engine, joins as the tenth pack. Installing and updating work as before.
- bmad-plus intake asks a pack’s questions a few at a time, marks the must-haves, proposes defaults, records what you do not know with its risk, and renders the brief that becomes the contract for what the pack does next. Nothing in it is invented.
- bmad-plus swarm deals simulated units from a profile under a seed, writes one brief per sub-agent, validates every answer file, counts only valid answers, and states that simulated buyers are not customers. The swarm block in _bmad/config.yaml sets how many sub-agents run before the assistant asks you; paid media generation always asks.
- The registry now records which skills an agent drives, which npm package a pack’s skills come from, which pipeline steps and gates a pack declares and which intake it runs. The generated instructions carry all of it, so nothing is typed twice.
- Design pack: Atelier, built from the design-skill package, interviews you with a design read, then builds, audits or redesigns an interface under checkable rules. The installer copies its three skills with their reference modules, and doctor checks them.
- A trigger gate refuses auto-activation rules that name an agent or a pipeline the registry does not know, and the installer writes nothing when a pack’s files cannot all be listed first.
[Published package · v0.23.0](https://www.npmjs.com/package/bmad-plus/v/0.23.0)
### v0.22.0 — What leaves your machine, declared and checked
2026-09-29
BMAD+ now declares every way it sends data or starts a process, and its CI refuses anything undeclared. The recipe page and the SEO report load nothing from other sites, OSINT calls are HTTPS-only, and Shield gains an evidence-bound assurance case and an AI processing register. Nothing changes in how you install or update.
- The registry states what BMAD+ sends, to whom, when and with which consent; SECURITY.md shows it and the installed agent instructions summarise it. A build check fails when a network call or a started process is not declared. BMAD+ has no telemetry, and the update check can be turned off.
- The acceptance page no longer loads Google Fonts or anything from another site, so opening it tells no one you did. The build refuses a page that would, and a real browser checks every request of a run. The SEO HTML report opens offline too.
- The Google API key of the SEO pack travels in a request header, never in a URL, and is hidden from error messages. OSINT provider calls refuse anything but HTTPS and never follow a redirect to another host.
- SEO screenshots reach only the address that was checked: Chromium resolves nothing else, and redirects or resources pointing elsewhere are blocked and listed.
- Shield: bmad-plus assurance builds a security case whose evidence can only be a check that actually ran, recorded in a tamper-evident ledger; bmad-plus ai-register keeps a register of the AI tools a project uses and warns about any it has not recorded; six review rules name the compliance controls a change touches.
- The MCP server closes SSE streams cleanly when a client leaves or the server stops, and accepts token dates with a time-zone offset.
[Published package · v0.22.0](https://www.npmjs.com/package/bmad-plus/v/0.22.0)
[All published versions on npm](https://www.npmjs.com/package/bmad-plus?activeTab=versions)
## When something is unclear
### The assistant cannot see my agents. What should I check?
Confirm that the assistant is open in the installed project, that you selected its adapter and that AGENTS.md and .agents/skills/ exist. Start a fresh session and ask it to read those instructions. Each host has its own rules for loading project instructions.
### Should I type autopilot or parallel in the terminal?
No. bmad-help, autopilot and parallel are conversation instructions for your AI assistant. Terminal commands start with the BMAD+ CLI, as shown in the terminal examples above.
### The version check says unknown or offline. Am I up to date?
That result does not establish the latest published version. Continue your project work and repeat the check when registry access is available. An unavailable check does not authorize changing the update policy.
[Source on GitHub](https://github.com/lrochetta/BMAD-PLUS)
[Published package](https://www.npmjs.com/package/bmad-plus)