Start with a small task in your own project. This guide shows what to run in the terminal, what to ask your AI assistant and how to keep BMAD+ up to date.
Get started, step by step
You need Node.js 20 or newer and an AI coding tool you already use. BMAD+ supplies project instructions, roles and workflows; your tool supplies the model and execution permissions.
01
Open your project folder
Use a terminal in the repository you want to work on, then check your Node.js version. Keep your usual version control workflow.
In your project terminal
node --version
The command should report v20 or newer. Install or update Node.js separately if needed.
02
Install BMAD+ and choose your tools
Run the installer. Select the adapters for the AI tools you use and the packs your project needs. Core contains Atlas, Forge, Sentinel and Nexus.
In your project terminal
npx bmad-plus@0.23.1 install
The installer creates the agent instructions, shared project spine and selected tool adapters. Optional packs may need additional runtimes or API access.
03
Start a session in that same folder
Open or restart your AI coding assistant in this project so it can load its adapter and AGENTS.md. Ask it to show the installed agents and workflows.
In your AI assistant
bmad-help
There is no extra BMAD+ initialization command after installation. bmad-help is a message to the assistant, not a terminal command.
04
Give one role a concrete task
Describe your goal, constraints and expected result. For a new idea, start with Atlas. For an existing code change, start with Forge.
In your AI assistant
Atlas, help me define a small invoicing app for freelancers. Ask about the users, identify the first useful workflow and write a brief with acceptance criteria.
Review the brief before asking Forge to implement one story. A clear deliverable makes progress easier to verify.
05
Review the result and preserve context
Ask Sentinel to check the change against its acceptance criteria. Ask for test evidence and a short handoff so the next session can continue.
In your AI assistant
Sentinel, review this change against the acceptance criteria. Check the main success and failure paths, report remaining issues and summarize what the next session needs to know. If the BMAD+ CLI is available, seal the scope with bmad-plus review scope, apply the rules in its checklist, quote the code of every finding, account for every selected file, then report what bmad-plus review gate answers.
Read the changes and test results. The assistant follows the permissions and capabilities of its host tool.
Examples to build on
Replace the project details with your own. These are conversation starters, with a clear output to review.
Turn an idea into a first release
Use after you have described the users and the problem.
In your AI assistant
Nexus, plan the first usable release of my appointment-booking app. Have Atlas define scope, Forge propose the smallest implementation and Sentinel define acceptance checks. List dependencies and stop at the plan review before implementation.
Expected result: a prioritized plan with a small first story and explicit review points.
Fix a bug in an existing project
Include the failing behavior, steps to reproduce and any relevant error output.
In your AI assistant
Forge, investigate why saving an edited invoice creates a duplicate. Reproduce the issue, trace the cause and propose the smallest fix. Add a regression check for the real failure, then ask Sentinel to review the affected flow.
Expected result: a reproduced failure, a focused fix and evidence that the regression is covered.
Design a screen with Atelier
Use with the optional Design pack installed. Atelier asks its questions first, then follows checkable rules.
In your AI assistant
Atelier, run the design read for the invoice list of my app, build the screen, and end with the pre-flight verdict.
Expected result: the recorded design read, the screen with every state covered, and the pre-flight verdict quoted as the last line.
Resume without losing decisions
Use at the start of a later session in the same project; no optional pack is required.
In your AI assistant
Read AGENTS.md and the available project memory. Summarize the last verified state, open decisions and the next unfinished task. Distinguish released features from local candidates, and automated checks from human acceptance. Check that the notes still match the code before continuing.
Expected result: a short, evidence-based restart. Project notes are useful context and still need to be checked against the current work.
Advanced examples: coordination, acceptance and memory
Coordinate independent work
Use when your host supports parallel agents and the tasks do not write to the same files.
In your AI assistant
Nexus, split the approved work into independent tasks. Give each role a scope, owned files and a definition of done. Use parallel agents only if this host supports them; otherwise run the tasks sequentially. Integrate the results and have Sentinel check the whole user flow.
Expected result: bounded assignments, explicit dependencies and one integrated review. Parallel execution comes from the host tool.
Have a person confirm a delivery
Use when a version reaches your test environment and someone must check it on screen.
In your AI assistant
Sentinel, write the acceptance recipe for this delivery on our test environment. One step per gesture, one verifiable fact per line, on-screen labels quoted from the code, and mark the steps that write for real. Build the page, then tell me the link, how long it takes and what I must not skip. Use disposable test data when possible, name the exact folder and files each command changes, and keep automated evidence separate from the person’s answers. Before handing the page over, build it with uat build, check the guarantees it lists, play the essential pass yourself in a real browser — start, tick, type a remark, reload, everything back — and tell me which checks ran.
Expected result: a page a non-technical person can play, and a run the agent reads back to classify every failure before anything is fixed.
Save a session with Zecher
Use before ending a session, with the optional Memory pack installed.
In your AI assistant
Zecher, update this project’s memory from the changes and checks we actually completed. Separate implemented, tested, published and still pending work. Record decisions and useful evidence, archive superseded notes without deleting them, and write a short prompt for the next session. Keep project memory local and exclude secrets.
Expected result: a concise current context, a dated session handoff and a restart prompt that identifies the next unfinished task.
Read a test run without guessing
Use when a person has completed or stopped an acceptance run.
In your AI assistant
Sentinel, read the latest acceptance run and compare its fingerprint with the current recipe. Ask what actually happened when answers and evidence disagree. Classify failures before proposing fixes, verify writing steps read-only, and distinguish human observations, automated checks and any explicit risk decision by its named owner. Never mark an unperformed step as passed.
Expected result: a clear verdict, evidence for confirmed writes and a short list of checks still requiring action.
Check and apply updates
Run these commands from the installed project. The checks below use an already available CLI. If npx --no-install cannot find it, use the explicit versioned command shown below.
Check the published version
Compare the installed release with npm. The result includes installedVersion, latestVersion, status, updateAvailable and canAutoApply.
If the CLI is unavailable or the installation is older
This explicit command downloads the documented CLI and checks your project. On 0.12.2 or earlier, use the migration command in the next paragraph to add update awareness.
This command checks npm again and asks for confirmation of the exact target version. Review the report, including any preserved custom files.
In your project terminal
npx --no-install bmad-plus update --latest
Notification is the default. A version check does not enable automatic updates. Offline, stale or unavailable registry results mean the latest version is unknown.
Updates preserve identified customizations. The report may describe a partial application when local files are retained; the installed version alone does not prove every file matches the release.
After a successful update, ask the assistant to reread AGENTS.md and the relevant skills, or start a fresh session.
BMAD+ package updates and BMAD-METHOD source synchronization are separate. These commands update BMAD+; they do not merge upstream source into your project.
Advanced: migration, update behavior and automatic policy
Migrating from 0.12.2 or earlier
Use the versioned CLI once. This confirmed migration backs up existing replacements because older installations do not have complete ownership hashes.
In your project terminal
npx --yes bmad-plus@0.23.1 update --yes
Optional: authorize a bounded automatic-update policy
Enable this only when you want the project to apply eligible releases in the stated semantic-version range. The CLI still checks runtime compatibility, file ownership and the policy. Use notify to return to notifications.
In your project terminal
npx --no-install bmad-plus update-policy --mode auto --range "^0.23.1"
Update receipts and backups live in .bmad/updates/. To restore an update, replace RECEIPT_ID with its actual receipt identifier. Restoration checks the backups and refuses to overwrite subsequent local edits.
These notes describe the release verified on npm. The guide, install command and release feed refer to that same publication.
v0.23.1 ·
The documentation site is rebuilt in four languages with seven videos. Several commands now behave exactly as their pages say: refusals read the same everywhere, a workspace review starts from HEAD, and the config file is plain YAML. Installing and updating work as before.
Selected recent releases, dated by their actual npm publication. Summaries describe changes delivered in each release. The package page provides the wider version history.
v0.23.1 ·
A truer site, steadier commands
The documentation site is rebuilt in four languages with seven videos. Several commands now behave exactly as their pages say: refusals read the same everywhere, a workspace review starts from HEAD, and the config file is plain YAML. Installing and updating work as before.
The website now carries 52 documentation pages, each in English, French, Spanish and German, a rebuilt landing page and seven presentation videos with captions and described transcripts, including a case study of how the site itself was rebuilt with a swarm of agents.
An --auto update that the policy does not allow is refused with the same message everywhere: Update refused: automatic-updates-not-authorized. The refusals for a legacy ownership inventory and for local conflicts use the same Update refused: form.
bmad-plus review scope --workspace starts from HEAD when you give no --base, so reviewing uncommitted work no longer fails or drags in the last commit.
_bmad/config.yaml is written as plain YAML (auto_role_activation: true, not a tagged !!bool 'true') whichever supported js-yaml version wrote it.
The generated instruction files tell the assistant to skip the version check, without mentioning it, when npx finds no local copy of bmad-plus; Nexus errors carry the Nexus: prefix once instead of twice.
Shield names PCI DSS v4.0.1 everywhere, the swarm skills say there are three kinds, the Backup pack’s Bash variant prints the archive size like its PowerShell variant, and the npm description, keywords and README credits are refreshed.
A pack now declares the questions it needs answered before it acts, and Nexus can run a swarm of sub-agents, a simulated panel or a jury, within a budget you set. Atelier, the design engine, joins as the tenth pack. Installing and updating work as before.
bmad-plus intake asks a pack’s questions a few at a time, marks the must-haves, proposes defaults, records what you do not know with its risk, and renders the brief that becomes the contract for what the pack does next. Nothing in it is invented.
bmad-plus swarm deals simulated units from a profile under a seed, writes one brief per sub-agent, validates every answer file, counts only valid answers, and states that simulated buyers are not customers. The swarm block in _bmad/config.yaml sets how many sub-agents run before the assistant asks you; paid media generation always asks.
The registry now records which skills an agent drives, which npm package a pack’s skills come from, which pipeline steps and gates a pack declares and which intake it runs. The generated instructions carry all of it, so nothing is typed twice.
Design pack: Atelier, built from the design-skill package, interviews you with a design read, then builds, audits or redesigns an interface under checkable rules. The installer copies its three skills with their reference modules, and doctor checks them.
A trigger gate refuses auto-activation rules that name an agent or a pipeline the registry does not know, and the installer writes nothing when a pack’s files cannot all be listed first.
BMAD+ now declares every way it sends data or starts a process, and its CI refuses anything undeclared. The recipe page and the SEO report load nothing from other sites, OSINT calls are HTTPS-only, and Shield gains an evidence-bound assurance case and an AI processing register. Nothing changes in how you install or update.
The registry states what BMAD+ sends, to whom, when and with which consent; SECURITY.md shows it and the installed agent instructions summarise it. A build check fails when a network call or a started process is not declared. BMAD+ has no telemetry, and the update check can be turned off.
The acceptance page no longer loads Google Fonts or anything from another site, so opening it tells no one you did. The build refuses a page that would, and a real browser checks every request of a run. The SEO HTML report opens offline too.
The Google API key of the SEO pack travels in a request header, never in a URL, and is hidden from error messages. OSINT provider calls refuse anything but HTTPS and never follow a redirect to another host.
SEO screenshots reach only the address that was checked: Chromium resolves nothing else, and redirects or resources pointing elsewhere are blocked and listed.
Shield: bmad-plus assurance builds a security case whose evidence can only be a check that actually ran, recorded in a tamper-evident ledger; bmad-plus ai-register keeps a register of the AI tools a project uses and warns about any it has not recorded; six review rules name the compliance controls a change touches.
The MCP server closes SSE streams cleanly when a client leaves or the server stops, and accepts token dates with a time-zone offset.
The assistant cannot see my agents. What should I check?
Confirm that the assistant is open in the installed project, that you selected its adapter and that AGENTS.md and .agents/skills/ exist. Start a fresh session and ask it to read those instructions. Each host has its own rules for loading project instructions.
Should I type autopilot or parallel in the terminal?
No. bmad-help, autopilot and parallel are conversation instructions for your AI assistant. Terminal commands start with the BMAD+ CLI, as shown in the terminal examples above.
The version check says unknown or offline. Am I up to date?
That result does not establish the latest published version. Continue your project work and repeat the check when registry access is available. An unavailable check does not authorize changing the update policy.