BMad Method is a set of skills and agent personas that bring an agile process to AI coding tools. Instead of asking the agent to write code straight away, you can start with a brief, a product requirements document or an architecture, then build and review in small verified steps, with the decisions written down so the next session picks them up. Clear, small changes skip straight to the build skill; larger ideas get the planning first.
It includes analyst, product manager, architect, UX designer, developer and product owner personas, brainstorming and 'party mode' sessions where several personas discuss a problem, code review, retrospectives and test generation. Official add-on modules cover skill building, creative work, enterprise testing and game development. It runs in any coding tool that supports skills, with plugin marketplaces for Claude Code and Codex.
It has about 54,600 stars, 161 contributors and an MIT licence, with the BMad names held as trademarks. Two lines are live: the stable v6.12, installed with npx, and a v7 preview on the main branch that the README warns will change between updates.
- Repository: github.com/bmad-code-org/BMAD-METHOD
- Licence: custom (Other)
- Language: Python. Stars: 54.6K. Forks: 6,106. Last push: Oct 20, 2026.
- Scan: safe, Oct 26, 2026, commit 61e01f8
Who it is for
Developers and small teams using Claude Code, Codex, Cursor or similar who want their agent to plan before it codes, and anyone who finds that long agent sessions lose track of earlier decisions.
Getting started
1. Install the stable v6.12 into your project (needs Node.js 20.12+ and Python 3.10+)
npx bmad-method install2. Or install the v7 preview skills into your coding tools
npx skills add bmad-code-org/BMAD-METHOD --skill '*'3. Or, inside Claude Code, add the v7 plugin marketplace
/plugin marketplace add bmad-code-org/bmad-pluginsThen open your project in the coding tool and invoke bmad-build with what you want to change; bmad-help (v6) or the bmad skill (v7) tells you what to run next. Both routes need uv for the bundled Python scripts.
Safety scan
We cloned bmad-code-org/BMAD-METHOD at commit 61e01f8 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns and no committed binaries across 583 files and about 65,000 lines, mostly Python and Markdown. A skill-specific pass for invisible Unicode, prompt-injection phrases and agent hooks found nothing; the skills ship no hooks.
- The one install-hook hit, skills/bmad/scripts/setup.py, is not a package build file. It is the bmad skill's setup and status script: it reads the installed module manifests and, to check for updates, fetches each module's source manifest from GitHub with a timeout and a size limit. Asking it to update runs npx skills update.
- 19 known advisories (7 high), none in what you install: 15 in uv.lock, which the pyproject.toml describes as repository tooling that is not published (virtualenv, filelock), and 4 in docs-site/package-lock.json, the documentation website (undici, zod).
- 5 workflows. Two use pull_request_target (coderabbit-review and retarget-pr) and both only run github-script against the API, without checking out pull request code. The single third-party action is not pinned to a commit. Security policy, contributing guide and code of conduct present; no Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 setup.py with custom install logic |
| Committed binaries | None. |
| CI workflows | 5 workflows. 2 use pull_request_target, none check out the pull request head. 1 of 1 third-party action pinned to a tag rather than a commit. |
| Network hosts | 16 distinct hosts referenced from source; most often docs.example, en.wikipedia.org, raw.githubusercontent.com, example.github.io. No URLs to bare IP addresses. |
| Known vulnerabilities | 19 advisories across 603 pinned packages: 0 critical, 7 high, 7 moderate, 5 low. docs-site/package-lock.json: 580 packages, 4 advisories; uv.lock: 23 packages, 15 advisories. |
| Project hygiene | Has security policy, licence file, contributing guide. Missing automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Worst known vulnerabilities (19 of 19)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-xjj6-f33q-929c | high | undici@8.10.2 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
| GHSA-mrhx-c7xc-m3w5 | high | zod@4.6.5 | Zod can exhaust memory while validating oversized constrained collections |
| GHSA-v4x8-3wr5-3wq8 | high | filelock@3.32.5 | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock us… |
| GHSA-394h-qwmc-48pf | high | virtualenv@21.14.5 | virtualenv: Xonsh activation literals depend on the script decoding codec |
| GHSA-6w3r-xr62-4xcp | high | virtualenv@21.14.5 | virtualenv: Bash prompt values can change meaning under older compatibility modes |
| GHSA-c978-59m8-c77v | high | virtualenv@21.14.5 | virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax |
| GHSA-vxj4-q4g9-crj7 | high | virtualenv@21.14.5 | virtualenv bash activate runs commands from an environment name with a backslash before $ |
| GHSA-4qv8-2p9j-2685 | moderate | undici@8.10.2 | undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
| GHSA-f72v-6w45-q472 | moderate | undici@8.10.2 | undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens |
| GHSA-43mp-35q3-x3fq | moderate | virtualenv@21.14.5 | virtualenv: Deletion recovery can change a symlink target's mode |
| GHSA-558c-9hv2-4prj | moderate | virtualenv@21.14.5 | virtualenv: Generated files can follow existing destination links |
| GHSA-cw65-gx24-rc82 | moderate | virtualenv@21.14.5 | virtualenv: Builtin creation follows linked environment directories |
| GHSA-fc2g-4w5p-6whm | moderate | virtualenv@21.14.5 | virtualenv: Seeded files retain permissions from an older cache |
| GHSA-hhxq-47xx-j5xx | moderate | virtualenv@21.14.5 | virtualenv: Seed replacement does not contain metadata deletion paths |
| GHSA-567q-5qvw-pf92 | low | filelock@3.32.5 | filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stal… |
| GHSA-9vhv-jxww-xfm5 | low | filelock@3.32.5 | filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database |
| GHSA-494p-63j8-28p3 | low | virtualenv@21.14.5 | virtualenv: Downloaded wheel selection and caching precede verification |
| GHSA-cx28-75q4-x26q | low | virtualenv@21.14.5 | virtualenv: Pip seeding with download omits wheel digest verification |
| GHSA-qmx5-4p3x-wvqf | low | virtualenv@21.14.5 | virtualenv: Venv configuration readback can reinterpret path boundaries |
Workflows worth a look
- .github/workflows/coderabbit-review.yaml: pull_request_target
- .github/workflows/retarget-pr.yaml: pull_request_target
By the numbers
| Stars | 54.6K |
|---|---|
| Forks | 6,106 |
| Contributors | 161 |
| Commits | 2,345 |
| Open issues | 64 |
| Open pull requests | 15 |
| Releases | 44 |
| Latest release | v6.12.4 |
| Licence | custom |
| Main language | Python |
| Project age | 1 year |
| Last push | Oct 20, 2026 |
| Tracked files | 583 |
| Lines of code | 65.2K |
| Checkout size | 5 MB |
Lines by language: Python 33.5K, Markdown 20.3K, TOML 4,143, JavaScript 3,859, CSS 986, HTML 975.
Questions
Is BMad Method free?
Yes. It is MIT-licensed, and the README states there are no paywalled workflows. The BMad names are trademarks of BMad Code, LLC, which limits reuse of the name, not of the code. You still need an AI coding tool and its model costs.
Should I use v6 or the v7 preview?
Use v6.12 if you need something stable: it is frozen apart from bug fixes. The v7 preview is aimed at solo developers and small teams who can cope with breaking changes, and it installs as plain skills or plugins rather than through the npm installer.
Which AI coding tools does BMad work with?
Any tool that supports agent skills. Claude Code and Codex have plugin marketplaces, and the npx skills command asks which of your installed tools to add the skills to.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.