NoPM
A lite, API-first project-management tool your AI agent operates — like the aws / supabase / hubspot CLIs, but for project governance. NoPM bundles no LLM; your agent (Claude Code, Cursor, Copilot, any MCP client) drives it over a documented REST API + scoped token.
Positioning: NoPM does not replace Jira, Slack, or Teams; it is the governed record beside them. Lite and fast, not ClickUp.
The differentiator is institutional governance built into the data layer: an immutable audit log, scoped Bearer tokens, and maker-checker (four-eyes) approval on destructive actions — enforced by the database, not bolted onto the UI.
Live at stillnotbald.com · Case study · OpenAPI · llms.txt
Try it without signing up: open stillnotbald.com/login and press Try the live demo. You land in a shared, seeded workspace as a manager, who can approve other people's requests but never their own.
Three agent surfaces, one governed API
| Surface | Where | What it gives an agent |
|---|
| REST API | 121 documented endpoints, OpenAPI 3.1 + llms.txt (both spec-coverage drift-tested) | Everything — every mutation audited, scopes enforced per request |
nopm CLI | cli/ — zero dependencies, contract-tested | 27 command groups, --json machine output, --curl dry-run |
| MCP server | web/mcp/ + root .mcp.json | 56 tools over both stdio and Streamable HTTP: the 47 the in-app assistant also uses, plus 9 governance tools only agents get (change requests and their evidence, rebaseline propose / sign-off / apply, decisions, documents, sprint close). Schemas are lock-tested against the API's Zod validators |
The in-app BYOK assistant uses the same registry as the MCP server: your own OpenAI/Anthropic/Google/OpenRouter key (AES-256-GCM at rest) drives NoPM through an ephemeral scoped token — audited as a token actor, structurally unable to hold an approve/admin scope.
Start here
Layout
NoPM/
├─ web/ Next.js 16 app — API routes, console UI, MCP server, migrations
├─ cli/ nopm CLI (zero deps; talks only to the public REST API)
├─ requirements/ REQUIREMENTS.md (canonical) + TRACEABILITY.md (RTM)
├─ sprint-log/ dated build receipts
├─ docs/adr/ architectural decision records
├─ scripts/ governance gates: rtm-verify, commit-gate, health, setup-hooks
└─ .githooks/ pre-commit (leak gate) + pre-push (full verify) — installed by npm install
Develop
npm install --prefix web # deps (also installs the git hooks)
npm run dev # web app on :3000
npm run migrate # apply SQL migrations (set DB_URL first)
npm run test # vitest — unit + governance-invariant suites
npm run health # one-command RAG read on requirements/RTM/tests/gates
Secrets live in web/.env.local (gitignored). See web/.env.example.
Deploy in one command
Run your own copy of NoPM against your own Supabase project:
then, once, against that Supabase project:
npm run setup # applies migrations, bootstraps admin + tokens (--dry-run to preview, --seed for demo data)
Or run it in Docker instead of on Vercel: docker build -t nopm-web ./web && docker run -p 3000:3000 --env-file web/.env.local nopm-web, or docker compose up --build from the repo root. Full walkthrough, required env vars, and the Docker/manual paths: docs/SELF_HOSTING.md.
Quality gates and operations
The pre-commit leak gate, pre-push verify and CI checks travel with every clone; the cutover, rollback, architecture and test-evidence docs sit beside them. Both are listed in docs/ENGINEERING.md.
Stack
Next.js 16 · TypeScript · Tailwind v4 · Supabase (Postgres + Auth + RLS) · Vercel + Cloudflare DNS.
License
Apache License, Version 2.0 — see LICENSE and NOTICE. Everything in this repository is open source; paid offerings are services only (implementation guide, change requests, setup help) — see docs/guide/05-getting-help-and-paid-services.md.
Trademarks
"NoPM" and "stillnotbald" are the names of this project and its live deployment. The Apache-2.0 license grants rights to the source code; it does not grant any right to use the NoPM or stillnotbald names or logos to describe a fork, derivative, or unrelated product in a way that implies endorsement or affiliation. Accurate reference ("based on NoPM") is fine. Jira, Slack, Microsoft Teams, OpenAI, Anthropic, and Google are trademarks of their respective owners, mentioned only descriptively.
