What is Meta Package Manager?
- snapshots every package on your machine to one file, and restores it on a new one
- provides the
mpmCLI, a wrapper around all package managers mpmis likeyt-dlp, but for package managers instead of videosmpmsolves XKCD #1654 - Universal Install Script
Features
- Snapshot installed packages to a TOML manifest or a Brewfile, across every manager at once, with
mpm dump packages.toml: - Restore that manifest on the next machine with
mpm restore packages.toml, and get the same set of packages back. - Inventory and list all package managers available on the system:
- Runs on macOS, Linux, Windows, FreeBSD, NetBSD, OpenBSD, illumos and Solaris, with standalone executables for the first three.
- List installed packages:
- List duplicate installed packages.
- Search for packages.
- Install a package.
- Remove a package.
- List outdated packages, with the differing part of each version picked out in color, so a patch bump reads apart from a major one at a glance:
- List orphaned packages.
- Sync local package infos.
- Diagnose the health of package managers.
- Upgrade all outdated packages from every manager at once, the primary use case of
mpmand the main reason I built it, since 70% of vulnerabilities lie in outdated libraries. A manager that fails is marked✘and named in a closing summary, while the others carry on: - Get a report of what each command changed at the end of
install,remove,upgrade,restoreandcleanup --orphans: every package upgraded, downgraded, installed, removed, held back by the cooldown or still outdated, with its versions. - Mitigate supply-chain attacks with a release-age cooldown that refuses any version published more recently than a threshold. A manager that cannot enforce the window is skipped, rather than run unguarded:
- Software Bill of Materials: export installed packages to SPDX and CycloneDX SBOM files.
- Pin-point commands to a subset of package managers (include/exclude selectors).
- Support plain, versioned and purl package specifiers.
- Export output to JSON or user-friendly tables.
- Shell auto-completion for Bash, Zsh and Fish.
- A SwiftBar/Xbar plugin in the macOS menu bar, and a GNOME Shell extension on Linux: both list the outdated packages of every manager on the system, and upgrade them from the menu.
- Because
mpmtries to wrap all other package managers, it became another pathological case of XKCD #927: Standards
Supported package managers
One CLI to rule them all.
mpm runs them concurrently unless they share the same backend.
am · antidote · antigen · antigravity-cli-plugins · apk · apm · app-manager · apt · apt-cyg · apt-mint · aptitude · asdf · aura · basalt · bin · bob · bpkg · brew · bun · cargo · cask · cave · choco · choosenim · chromebrew · claude-code-plugins · clib · composer · conda · cpan · deb-get · dkp-pacman · dnf · dnf5 · dotnet · elan · emacs · emerge · eopkg · fink · fisher · flatpak · fwupd · gcloud · gem · getnf · gext · gh-ext · ghcup · go · guix · gup · haxelib · hyprpm · ips · jpm · julia · juliaup · krew · lazy · luarocks · lure · macports · mamba · mas · mason · micro · microdnf · micromamba · miktex · mise · nala · nimble · nix · npm · oh-my-fish · ollama · opam · opkg · pacaur · pacman · pacstall · pamac · paru · pear · pearl · pi · pikaur · pip · pipx · pipxu · pixi · pkcon · pkg · pkg-tools · pkgin · pkgit · pkgm · platformio-core · pnpm · ports · protonplus · prt-get · pwsh-gallery · pyenv · raco · roswell · rustup · scoop · sdkman · sfsu · sheldon · shelly · skills · slapt-get · snap · soar · sorcery · spack · steamcmd · stew · sun-tools · swupd · tazpkg · tlmgr · topgrade · trizen · urpmi · uv · uvx · vagrant · vcpkg · vim-pack · volta · vscode · vscodium · whalebrew · winget · xbps · xcodes · yarn · yarn-berry · yay · yazi · yum · zef · zerobrew · zeroinstall · zim · zinit · zplug · zvm · zypper
mpm also reuses topgrade when present on the system to extend its mpm upgrade --all operation to extra runtimes, shell plugins and OS updaters. Other unsupported managers are catalogued in the docs.
Installation
All installation methods are available in the documentation.
uv
mpm is distributed on PyPI, so uv installs it on Linux, macOS and Windows alike:
$ uv tool install meta-package-manager
To try mpm without installing anything, run uvx meta-package-manager instead.
Homebrew
mpm is part of the official Homebrew default tap, bottled for macOS and Linux, so you can install it with:
$ brew install meta-package-manager
MacPorts
mpm is also available on MacPorts:
$ sudo port install meta-package-manager
Scoop
mpm is available in the main repository of Scoop, so on Windows you just need to:
> scoop install main/meta-package-manager
Executables
Standalone binaries of mpm latest version are available as direct downloads for several platforms and architectures:
Useful for CI/CD pipelines running on minimal images, or old platforms where dependency management is painful.
Used in
Check these projects to get real-life examples of mpm usage:
Dotfiles - macOS dotfiles for Python developers, using
mpmto manage system packages.
Feel free to send a PR to add your project in this list if you are relying on mpm in any way.
Usage
Other subcommands and options are documented in:
- the detailed help screens
- the manager augmentations where you’ll find inspiration on how to leverage
mpmpower
1 maintainer
Metadata
1 maintainer
Release files for meta-package-manager 8.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| meta_package_manager-8.2.0.tar.gz | 5.1 MB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| meta_package_manager-8.2.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 5.9 MB
Release files / meta_package_manager-8.2.0.tar.gz
| Download URL | meta_package_manager-8.2.0.tar.gz |
|---|---|
| Size | 5.1 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
8685fb34eaccc9471047e67adc1d2ddd42b92a5be9df5b9e12f166396b7f72b5
|
|
BLAKE2b-256 checksum How to use checksums |
9ed52efe713f05e8999d338f34750abf36b0c22fd669be6eedd72b0ae2b4440b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.12.17 {"installer":{"name":"uv","version":"0.12.17","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"26.04","id":"resolute","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 25, 2026.
Transparency logRelease files / meta_package_manager-8.2.0-py3-none-any.whl
| Download URL | meta_package_manager-8.2.0-py3-none-any.whl |
|---|---|
| Size | 887.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
6b5cb8036f3f9dee5659de91786572a99ab332be80a82a8484bf86783400c292
|
|
BLAKE2b-256 checksum How to use checksums |
677466f247a48fe22e95486ecf9a0e41aed03a643c2067c22e81e38d2d6ce7fd
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.12.17 {"installer":{"name":"uv","version":"0.12.17","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"26.04","id":"resolute","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 25, 2026.
Transparency logSecurity for meta-package-manager 8.2.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for meta_package_manager-8.2.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 25, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
