meta-package-manager 7.6.1

What is Meta Package Manager?

• provides the mpm CLI, a wrapper around all package managers
• mpm is like yt-dlp, but for package managers instead of videos
• mpm solves XKCD #1654 - Universal Install Script

Quick start

Thanks to uv, you can run mpm on any platform in one command, without installation or venv:

$ uvx meta-package-manager

Features

• Inventory and list all package managers available on the system.
• Supports macOS, Linux and Windows.
• Standalone executables for Linux, macOS and Windows.
• List installed packages.
• List duplicate installed packages.
• Search for packages.
• Install a package.
• Remove a package.
• List outdated packages.
• List orphaned packages.
• Sync local package infos.
• Diagnose the health of package managers.
• Upgrade all outdated packages.
• Mitigate supply-chain attacks with a release-age cooldown that refuses too-recent versions: mpm --cooldown "7 days" upgrade --all.
• Snapshot installed packages to a TOML manifest or a Brewfile.
• Restore/install list of packages from TOML files.
• Software Bill of Materials: export installed packages to SPDX and CycloneDX SBOM files.
• Pin-point commands to a subset of package managers (include/exclude selectors).
• Support plain, versioned and purl package specifiers.
• Export output to JSON or user-friendly tables.
• Shell auto-completion for Bash, Zsh and Fish.
• Provides a Xbar/SwiftBar plugin for friendly macOS integration.
• Provides a GNOME Shell extension for friendly Linux desktop integration.
• Because mpm tries to wrap all other package managers, it became another pathological case of XKCD #927: Standards

Supported package managers

One CLI to rule them all:

---
config: {"sankey": {"showValues": false, "width": 800, "height": 400}}
---
sankey-beta

Meta Package Manager,apk,1
Meta Package Manager,apm,1
Meta Package Manager,apt,1
Meta Package Manager,apt-cyg,1
Meta Package Manager,apt-mint,1
Meta Package Manager,asdf,1
Meta Package Manager,brew,1
Meta Package Manager,cargo,1
Meta Package Manager,cask,1
Meta Package Manager,cave,1
Meta Package Manager,choco,1
Meta Package Manager,chromebrew,1
Meta Package Manager,composer,1
Meta Package Manager,conda,1
Meta Package Manager,cpan,1
Meta Package Manager,deb-get,1
Meta Package Manager,dnf,1
Meta Package Manager,dnf5,1
Meta Package Manager,emerge,1
Meta Package Manager,eopkg,1
Meta Package Manager,fink,1
Meta Package Manager,flatpak,1
Meta Package Manager,fwupd,1
Meta Package Manager,gem,1
Meta Package Manager,gh-ext,1
Meta Package Manager,guix,1
Meta Package Manager,macports,1
Meta Package Manager,mas,1
Meta Package Manager,mise,1
Meta Package Manager,nix,1
Meta Package Manager,npm,1
Meta Package Manager,opkg,1
Meta Package Manager,pacaur,1
Meta Package Manager,pacman,1
Meta Package Manager,pacstall,1
Meta Package Manager,paru,1
Meta Package Manager,pip,1
Meta Package Manager,pipx,1
Meta Package Manager,pkcon,1
Meta Package Manager,pkg,1
Meta Package Manager,pkg-tools,1
Meta Package Manager,pkgin,1
Meta Package Manager,pnpm,1
Meta Package Manager,ports,1
Meta Package Manager,pwsh-gallery,1
Meta Package Manager,scoop,1
Meta Package Manager,sdkman,1
Meta Package Manager,sfsu,1
Meta Package Manager,slapt-get,1
Meta Package Manager,snap,1
Meta Package Manager,soar,1
Meta Package Manager,sorcery,1
Meta Package Manager,steamcmd,1
Meta Package Manager,stew,1
Meta Package Manager,sun-tools,1
Meta Package Manager,swupd,1
Meta Package Manager,tazpkg,1
Meta Package Manager,tlmgr,1
Meta Package Manager,topgrade,1
Meta Package Manager,urpmi,1
Meta Package Manager,uv,1
Meta Package Manager,uvx,1
Meta Package Manager,vim-pack,1
Meta Package Manager,volta,1
Meta Package Manager,vscode,1
Meta Package Manager,vscodium,1
Meta Package Manager,winget,1
Meta Package Manager,xbps,1
Meta Package Manager,yarn,1
Meta Package Manager,yarn-berry,1
Meta Package Manager,yay,1
Meta Package Manager,yum,1
Meta Package Manager,zerobrew,1
Meta Package Manager,zinit,1
Meta Package Manager,zypper,1

Metadata and operations

Platforms: 🅱️ BSD¹ · 🐧 Linux² · 🍎 macOS · ⨂ Unix³ · 🪟 Windows

[!NOTE] If your favorite manager is missing or does not support an operation, you can influence its implementation: open a ticket to document its output or read the contribution guide and submit a pull request.

You can help if you purchase business support 🤝 or sponsor the project 🫶.

Installation

All installation methods are available in the documentation. Below are the most popular ones:

macOS

mpm is part of the official Homebrew default tap, so you can install it with:

$ brew install meta-package-manager

It is also available on MacPorts:

$ sudo port install meta-package-manager

Windows

mpm is available in the main repository of Scoop, so you just need to:

> scoop install main/meta-package-manager

Executables

Standalone binaries of mpm latest version are available as direct downloads for several platforms and architectures:

No need to install Python or uv. Useful for CI/CD pipelines running on minimal images, or old platforms where dependency management is painful.

Quickstart

List installed packages

List all packages installed on current system:

$ mpm installed
╭──────────────────────────────────────────────┬─────────┬──────────┬──────────────────────────────────────────╮
│ Package ID                                   │ Name    │ Manager  │ Installed version                        │
├──────────────────────────────────────────────┼─────────┼──────────┼──────────────────────────────────────────┤
│ curl                                         │         │ brew     │ 8.21.0                                   │
│ git                                          │         │ brew     │ 2.55.0                                   │
│ aerial                                       │         │ cask     │ 3.6.3                                    │
│ amethyst                                     │         │ cask     │ 0.24.3                                   │
│ bigdecimal                                   │         │ gem      │ 3.1.4                                    │
│ bundler                                      │         │ gem      │ 2.4.22                                   │
│ 361285480                                    │ Keynote │ mas      │ 15.3.1                                   │
│ 408981434                                    │ iMovie  │ mas      │ 10.4.4                                   │
│ @mermaid-js/mermaid-cli                      │         │ npm      │ 11.12.0                                  │
│ npm                                          │         │ npm      │ 11.19.0                                  │
│ cyclonedx-python-lib                         │         │ uv       │ 11.11.0                                  │
│ packageurl-python                            │         │ uv       │ 0.17.6                                   │
│ https://github.com/nvim-lualine/lualine.nvim │         │ vim-pack │ 221ce6b2d999187044529f49da6554a92f740a96 │
│ charliermarsh.ruff                           │         │ vscode   │ 2026.70.0                                │
│ ms-python.python                             │         │ vscode   │ 2026.4.0                                 │
│ zsh-users/zsh-autosuggestions                │         │ zinit    │ ?                                        │
│ zsh-users/zsh-completions                    │         │ zinit    │ ?                                        │
│ (...)                                        │         │          │                                          │
╰──────────────────────────────────────────────┴─────────┴──────────┴──────────────────────────────────────────╯
483 packages total (brew: 246, uv: 75, gem: 62, cask: 52, vscode: 16, vim-pack: 9, zinit: 9, mas: 7, npm: 6, cargo: 1, gh-ext: 0, pnpm: 0, uvx: 0, yarn: 0).

Narrow the listing to packages whose ID or name matches a query by passing it as an argument. The match is fuzzy by default (case-insensitive and tokenized); add --exact to require a verbatim match on the package ID or name:

$ mpm installed sphinx
$ mpm installed --exact Sphinx

List outdated packages

List all packages installed for which an upgrade is available:

$ mpm outdated
╭──────────────┬─────────────┬─────────┬───────────────────┬────────────────╮
│ Package name │ ID          │ Manager │ Installed version │ Latest version │
├──────────────┼─────────────┼─────────┼───────────────────┼────────────────┤
│ curl         │ curl        │ brew    │ 7.79.1            │ 7.79.1_1       │
│ git          │ git         │ brew    │ 2.33.0            │ 2.33.0_1       │
│ openssl@1.1  │ openssl@1.1 │ brew    │ 1.1.1l            │ 1.1.1l_1       │
│ rake         │ rake        │ gem     │ 13.0.3            │ 13.0.6         │
│ Telegram     │ 747648890   │ mas     │ 8.1               │ 8.1.3          │
│ npm          │ npm@8.0.0   │ npm     │ 7.24.0            │ 8.0.0          │
│ pip          │ pip         │ pip     │ 21.2.4            │ 21.3           │
│ regex        │ regex       │ pip     │ 2021.9.30         │ 2021.10.8      │
╰──────────────┴─────────────┴─────────┴───────────────────┴────────────────╯
8 packages total (brew: 3, pip: 2, gem: 1, mas: 1, npm: 1, apm: 0, cask: 0, composer: 0).

The same query argument restricts the listing to outdated packages whose ID or name matches, again fuzzy by default and exact with --exact:

$ mpm outdated git

Upgrade outdated packages

A recent study shows that 70% of vulnerabilities lie in outdated libraries, so keeping every piece of software up to date is one of the key habits of security professionals. mpm upgrades all packages from all managers with a one-liner:

$ mpm upgrade --all
Updating all outdated packages from brew...
==> Upgrading 4 outdated packages:
gnu-getopt 2.35.1 -> 2.35.2
rclone 1.51.0 -> 1.52.0
fd 8.1.0 -> 8.1.1
youtube-dl 2020.05.08 -> 2020.05.29
(...)
Updating all outdated packages from cask...
==> Upgrading 4 outdated packages:
balenaetcher 1.5.89 -> 1.5.94, libreoffice 6.4.3 -> 6.4.4
(...)
Updating all outdated packages from gem...
Updating openssl
(...)
Updating all outdated packages from npm...
+ npm@6.14.5
(...)
Updating all outdated packages from pip...
Successfully installed dephell-argparse-0.1.3
Successfully installed dephell-pythons-0.1.15

This is the primary use case of mpm, and the main reason I built it.

Upgrade with a supply-chain cooldown

There is a counter-argument to the advice above. Chasing the newest release the moment it ships is exactly how supply-chain attacks reach you: a compromised version is usually detected and pulled within days of publication, but an immediate upgrade installs it before that happens. Blindly staying on the bleeding edge trades one risk (outdated, vulnerable libraries) for another (freshly poisoned releases).

mpm reconciles the two with a release-age cooldown, refusing any version published more recently than a threshold:

$ mpm --cooldown "7 days" upgrade --all

You still pick up older security fixes promptly, while sitting out the risky first days of a brand-new release. See the cooldown guide for the full mechanism and which managers enforce it natively.

List managers

If you wonder why your package manager doesn't seem to be identified, you can list all those recognized by mpm on the current platform:

$ mpm managers
╭──────────────┬───────────────────────┬───────────┬────────────────────────────────────────────────────────────────────────┬────────────┬─────────────────────╮
│ Manager ID   │ Name                  │ Supported │ CLI                                                                    │ Executable │ Version             │
├──────────────┼───────────────────────┼───────────┼────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────────┤
│ asdf         │ asdf                  │ ✓         │ ✘ asdf not found                                                       │            │                     │
│ brew         │ Homebrew Formulae     │ ✓         │ ✓ /opt/homebrew/bin/brew                                               │ ✓          │ ✓ 6.0.16-2-g007333f │
│ cargo        │ Rust cargo            │ ✓         │ ✓ /opt/homebrew/bin/cargo                                              │ ✓          │ ✓ 1.97.1            │
│ cask         │ Homebrew Cask         │ ✓         │ ✓ /opt/homebrew/bin/brew                                               │ ✓          │ ✓ 6.0.16-2-g007333f │
│ composer     │ PHP Composer          │ ✓         │ ✘ composer not found                                                   │            │                     │
│ conda        │ Conda                 │ ✓         │ ✘ conda not found                                                      │            │                     │
│ cpan         │ Perl CPAN             │ ✓         │ ✓ /usr/bin/cpan                                                        │ ✓          │ ✓ 2.28              │
│ fink         │ Fink                  │ ✓         │ ✘ fink not found                                                       │            │                     │
│ gem          │ RubyGems              │ ✓         │ ✓ /usr/bin/gem                                                         │ ✓          │ ✓ 3.4.5             │
│ gh-ext       │ GitHub CLI extensions │ ✓         │ ✓ /opt/homebrew/bin/gh                                                 │ ✓          │ ✓ 2.97.0            │
│ macports     │ MacPorts              │ ✓         │ ✘ port not found                                                       │            │                     │
│ mas          │ Mac App Store         │ ✓         │ ✓ /opt/homebrew/bin/mas                                                │ ✓          │ ✓ 7.0.0             │
│ mise         │ mise                  │ ✓         │ ✘ mise not found                                                       │            │                     │
│ nix          │ Nix                   │ ✓         │ ✘ nix-env not found                                                    │            │                     │
│ npm          │ Node npm              │ ✓         │ ✓ /opt/homebrew/bin/npm                                                │ ✓          │ ✓ 11.19.0           │
│ pip          │ Python pip            │ ✓         │ ✓ /Users/kde/code/meta-package-manager/.venv/bin/python3               │ ✓          │ ✘                   │
│ pipx         │ Python pipx           │ ✓         │ ✘ pipx not found                                                       │            │                     │
│ pnpm         │ Node pnpm             │ ✓         │ ✓ /opt/homebrew/bin/pnpm                                               │ ✓          │ ✓ 11.20.0           │
│ pwsh-gallery │ PowerShell Gallery    │ ✓         │ ✘ pwsh not found                                                       │            │                     │
│ sdkman       │ SDKMAN                │ ✓         │ ✘ sdkman-init.sh not found                                             │            │                     │
│ steamcmd     │ Valve SteamCMD        │ ✓         │ ✘ steamcmd not found                                                   │            │                     │
│ stew         │ stew                  │ ✓         │ ✘ stew not found                                                       │            │                     │
│ tlmgr        │ TeX Live Manager      │ ✓         │ ✘ tlmgr not found                                                      │            │                     │
│ topgrade     │ Topgrade              │ ✓         │ ✓ /opt/homebrew/bin/topgrade                                           │ ✓          │ ✓ 17.9.0            │
│ uv           │ Python uv             │ ✓         │ ✓ /opt/homebrew/bin/uv                                                 │ ✓          │ ✓ 0.12.3            │
│ uvx          │ Python uvx            │ ✓         │ ✓ /opt/homebrew/bin/uv                                                 │ ✓          │ ✓ 0.12.3            │
│ vim-pack     │ Neovim vim-pack       │ ✓         │ ✓ /opt/homebrew/bin/nvim                                               │ ✓          │ ✓ 0.12.4            │
│ vscode       │ Visual Studio Code    │ ✓         │ ✓ /Applications/Visual Studio Code.app/Contents/Resources/app/bin/code │ ✓          │ ✓ 1.132.0           │
│ vscodium     │ VSCodium              │ ✓         │ ✘ codium not found                                                     │            │                     │
│ yarn         │ Yarn Classic          │ ✓         │ ✓ /opt/homebrew/bin/yarn                                               │ ✓          │ ✓ 1.22.22           │
│ yarn-berry   │ Yarn Berry            │ ✓         │ ✓ /opt/homebrew/bin/yarn                                               │ ✓          │ ✘ 1.22.22 >=2.0.0   │
│ zerobrew     │ zerobrew              │ ✓         │ ✘ zb not found                                                         │            │                     │
│ zinit        │ Zinit                 │ ✓         │ ✓ /opt/homebrew/bin/zsh                                                │ ✓          │ ✓ 3.15.0            │
╰──────────────┴───────────────────────┴───────────┴────────────────────────────────────────────────────────────────────────┴────────────┴─────────────────────╯

Unmaintained managers sit out of this default selection, and managers tied to other platforms are hidden: pass --all-managers to widen the table to every manager mpm knows.

If your favorite manager is not supported yet, you can help! See the contribution guide. A handful of tools are deliberately left out, each with its rationale: they are catalogued in unsupported managers.

Used in

Check these projects to get real-life examples of mpm usage:

• Dotfiles - macOS dotfiles for Python developers, using mpm to manage system packages.

Feel free to send a PR to add your project in this list if you are relying on mpm in any way.

Usage

Other subcommands and options are documented in:

• the detailed help screens
• the manager augmentations where you’ll find inspiration on how to leverage mpm power