NoPM

A lite, API-first project-management tool your AI agent operates — like the aws / supabase / hubspot CLIs, but for project governance. NoPM bundles no LLM; your agent (Claude Code, Cursor, Copilot, any MCP client) drives it over a documented REST API + scoped token.

Positioning: NoPM does not replace Jira, Slack, or Teams; it is the governed record beside them. Lite and fast, not ClickUp.

The differentiator is institutional governance built into the data layer: an immutable audit log, scoped Bearer tokens, and maker-checker (four-eyes) approval on destructive actions — enforced by the database, not bolted onto the UI.

Live at stillnotbald.com · Case study · OpenAPI · llms.txt

Try it without signing up: open stillnotbald.com/login and press Try the live demo. You land in a shared, seeded workspace as a manager, who can approve other people's requests but never their own.

Three agent surfaces, one governed API

Surface	Where	What it gives an agent
REST API	121 documented endpoints, OpenAPI 3.1 + llms.txt (both spec-coverage drift-tested)	Everything — every mutation audited, scopes enforced per request
nopm CLI	cli/ — zero dependencies, contract-tested	27 command groups, --json machine output, --curl dry-run
MCP server	web/mcp/ + root .mcp.json	56 tools over both stdio and Streamable HTTP: the 47 the in-app assistant also uses, plus 9 governance tools only agents get (change requests and their evidence, rebaseline propose / sign-off / apply, decisions, documents, sprint close). Schemas are lock-tested against the API's Zod validators

The in-app BYOK assistant uses the same registry as the MCP server: your own OpenAI/Anthropic/Google/OpenRouter key (AES-256-GCM at rest) drives NoPM through an ephemeral scoped token — audited as a token actor, structurally unable to hold an approve/admin scope.

Start here

You want to…	Go to
New here? Plain-language guides (demo, self-host, governance, help)	docs/guide/README.md
Understand what this is and why	Case study — or web/src/app/case-study/page.tsx
See the requirements + status	requirements/REQUIREMENTS.md (canonical R-IDs)
Trace a requirement to code + tests	requirements/TRACEABILITY.md (RTM, CI-verified)
Read an architectural decision	docs/adr/
See how each wave was built	sprint-log/ — dated receipts, per wave
Learn the console UI (operator / admin / agent surfaces)	user-manual/README.md
Drive it from a terminal	cli/README.md
Connect an MCP client	web/mcp/README.md
Connect Lark or Feishu, or subscribe a calendar to milestones	for Lark/Feishu setup; the calendar feed is a revocable secret URL

Layout

NoPM/
├─ web/            Next.js 16 app — API routes, console UI, MCP server, migrations
├─ cli/            nopm CLI (zero deps; talks only to the public REST API)
├─ requirements/   REQUIREMENTS.md (canonical) + TRACEABILITY.md (RTM)
├─ sprint-log/     dated build receipts
├─ docs/adr/       architectural decision records
├─ scripts/        governance gates: rtm-verify, commit-gate, health, setup-hooks
└─ .githooks/      pre-commit (leak gate) + pre-push (full verify) — installed by npm install

Develop

npm install --prefix web      # deps (also installs the git hooks)
npm run dev                   # web app on :3000
npm run migrate               # apply SQL migrations (set DB_URL first)
npm run test                  # vitest — unit + governance-invariant suites
npm run health                # one-command RAG read on requirements/RTM/tests/gates

Secrets live in web/.env.local (gitignored). See web/.env.example.

Deploy in one command

Run your own copy of NoPM against your own Supabase project:

then, once, against that Supabase project:

npm run setup                 # applies migrations, bootstraps admin + tokens (--dry-run to preview, --seed for demo data)

Or run it in Docker instead of on Vercel: docker build -t nopm-web ./web && docker run -p 3000:3000 --env-file web/.env.local nopm-web, or docker compose up --build from the repo root. Full walkthrough, required env vars, and the Docker/manual paths: docs/SELF_HOSTING.md.

Quality gates and operations

The pre-commit leak gate, pre-push verify and CI checks travel with every clone; the cutover, rollback, architecture and test-evidence docs sit beside them. Both are listed in docs/ENGINEERING.md.

Stack

Next.js 16 · TypeScript · Tailwind v4 · Supabase (Postgres + Auth + RLS) · Vercel + Cloudflare DNS.

License

Apache License, Version 2.0 — see LICENSE and NOTICE. Everything in this repository is open source; paid offerings are services only (implementation guide, change requests, setup help) — see docs/guide/05-getting-help-and-paid-services.md.

Trademarks

"NoPM" and "stillnotbald" are the names of this project and its live deployment. The Apache-2.0 license grants rights to the source code; it does not grant any right to use the NoPM or stillnotbald names or logos to describe a fork, derivative, or unrelated product in a way that implies endorsement or affiliation. Accurate reference ("based on NoPM") is fine. Jira, Slack, Microsoft Teams, OpenAI, Anthropic, and Google are trademarks of their respective owners, mentioned only descriptively.