InstallationΒΆ

Meta Package Manager is distributed on PyPI.

So you can install the latest stable release with uv:

$ uv tool install meta-package-manager

Danger

Misleading package name

Angry package

There is a mpm Python module on PyPI that has nothing to do with this project. Avoid it!

The real package is named meta-package-manager. Only the latter provides the mpm CLI you’re looking for.

Try it nowΒΆ

You can try Meta Package Manager right now in your terminal, without installing any dependency or virtual env thanks to uvx:

$ uvx meta-package-manager
Installed 21 packages in 42ms
Usage: mpm [OPTIONS] COMMAND [ARGS]...
$ uvx meta-package-manager@7.3.0
Installed 21 packages in 42ms
Usage: mpm [OPTIONS] COMMAND [ARGS]...
$ uvx --from git+https://github.com/kdeldycke/meta-package-manager -- mpm
$ uvx --from file:///Users/me/code/meta-package-manager -- mpm

This will download meta-package-manager (the package), and run mpm, the CLI included in the package.

Try the libraryΒΆ

You can also try the library itself in an interactive Python shell without installing anything on your system:

$ uvx --with meta-package-manager python
Installed 21 packages in 42ms
Python 3.13.2 (main, Feb  4 2025, 14:51:09) [Clang 16.0.0 (clang-1600.0.26.6)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from meta_package_manager.pool import pool
>>> list(pool['brew'].installed)
[...]
>>>

Installation methodsΒΆ

mpm is available on several popular package managers:

Yo dawg, I herd you like package managers...

Easiest way is to install uv, then install meta-package-manager system-wide with the uv tool command:

$ uv tool install meta-package-manager

Then you can run mpm directly:

$ mpm --version

To use mpm as a library in your project instead:

$ uv add meta-package-manager

You can install the latest stable release and its dependencies with a simple pip call:

$ python -m pip install meta-package-manager

Other variations includes:

$ pip install meta-package-manager
$ pip3 install meta-package-manager

If you have difficulties to use pip, see pip’s own installation instructions.

pipx is a great way to install Python applications globally:

$ pipx install meta-package-manager

Meta Package Manager is available as a Homebrew formula, so you just need to:

$ brew install meta-package-manager

Tip

ZeroBrew is a fast, Homebrew-compatible package manager written in Rust. It consumes the same formula and installs mpm with:

$ zb install meta-package-manager

Meta Package Manager is available on MacPorts, so you just need to:

$ sudo port install meta-package-manager

Tip

The port landed in MacPorts on 2026-07-22. If port install cannot find it yet, refresh your ports tree first with sudo port sync.

You can also install it from the Portfile overlay maintained in the repository.

Meta Package Manager is available in the main repository of Scoop, so you just need to:

> scoop install main/meta-package-manager

The package is not distributed on the Chocolatey community repository: submission 6.4.2 was rejected over antivirus false positives on the bundled Windows binary (see Antivirus false positives below, and please report the detection to your vendor if it affects you). Build and install it from the nuspec maintained in the repository instead.

The nixpkgs package is pending review at NixOS/nixpkgs#506145, which you can help move forward by showing your support. Once merged, installation will be a one-liner:

$ nix-env --install --attr nixpkgs.meta-package-manager

Until then, build it from the definition maintained in the repository.

Meta Package Manager is available in GNU Guix, so you just need to:

$ guix install meta-package-manager

Tip

The package landed in Guix on 2026-06-28. If guix install cannot find it yet, refresh your channels first with guix pull.

To build the bleeding-edge version instead, install from the definition maintained in the repository.

The package is being submitted to Alpine’s aports tree. Until it lands there, build it from the APKBUILD overlay maintained in the repository.

The package is pending review at void-linux/void-packages#60532, which you can help move forward by showing your support. Once merged, installation will be a one-liner:

$ xbps-install --sync mpm

Until then, build it from my void-packages fork.

An mpm package is available on AUR and can be installed with any AUR helper:

$ yay -S meta-package-manager
$ paru -S meta-package-manager
$ pacaur -S meta-package-manager

Stew installs pre-compiled binaries from GitHub Releases:

$ stew install kdeldycke/meta-package-manager

BinariesΒΆ

Binaries are compiled at each release, so you can skip the installation process above and download the standalone executables directly.

This is the preferred way of testing mpm without polluting your machine. They also offer the possibility of running the CLI on older systems not supporting the minimal Python version required by mpm.

All links above points to the latest released version of mpm.

See also

  • To test previous versions for regression, compatibility or general troubleshooting, the old binaries are attached as assets to past releases on GitHub.

  • To test the bleeding-edge version, fresh binaries are compiled from every push to the main branch: grab them from the development builds.

  • The exact executable format each binary targets is listed in the ABI targets section of the catalog.

Important

Antivirus false positives The Windows binaries (and to a lesser extent the macOS ARM64 ones, plus anything downstream that bundles them like the Chocolatey package) are flagged by heuristic and ML-based antivirus engines. These are false positives caused by the Nuitka --onefile packaging pattern, not by anything mpm does. Engineering background, per-release detection data, and long-term mitigations are documented on the binaries catalog.

If your antivirus quarantines an mpm binary:

  1. Verify the binary you downloaded with the attestation procedure below. It cryptographically proves the artifact came from this repository’s release pipeline.

  2. Submit a false-positive report to your antivirus vendor with the verified binary. The priority vendor list on the binaries catalog covers the engines responsible for most detections, and VirusTotal’s vendor directory covers the rest.

The more independent reports a vendor receives, the more likely a detection gets reclassified, and that is the only practical path back to a working Chocolatey community-repository submission.

Release verificationΒΆ

All release artifacts (Python packages and compiled binaries) are signed with GitHub Artifact Attestations providing SLSA v1 provenance. You can verify any downloaded artifact with the GitHub CLI:

$ gh attestation verify ./meta-package-manager-7.3.0-macos-arm64.bin --repo kdeldycke/meta-package-manager --signer-repo kdeldycke/repomatic
Loaded digest sha256:... for file://meta-package-manager-7.3.0-macos-arm64.bin
Loaded 1 attestation from GitHub API
βœ“ Verification succeeded!

Important

The --signer-repo kdeldycke/repomatic flag is required because the release workflow runs as a reusable workflow from kdeldycke/repomatic. The signing certificate references that repository, not kdeldycke/meta-package-manager. Without this flag, verification fails.

For Python packages from PyPI:

$ gh attestation verify ./meta_package_manager-7.3.0-py3-none-any.whl --repo kdeldycke/meta-package-manager --signer-repo kdeldycke/repomatic

Attestation bundles are also attached to each GitHub release for offline verification.

Self-bootstrappingΒΆ

In a funny twist, mpm can be installed with itself.

Which means there is a way to bootstrap its deployment on an unknown system. Just download the binary corresponding to your platform and architecture:

$ curl --fail --remote-name https://github.com/kdeldycke/meta-package-manager/releases/latest/download/mpm-macos-x64.bin
################################################### 100.0%
$ file ./mpm-macos-x64.bin
./mpm-macos-x64.bin: Mach-O 64-bit executable x86_64
$ chmod +x ./mpm-macos-x64.bin
$ ./mpm-macos-x64.bin --version
mpm, version 7.3.0

Then let mpm discovers which package managers are available on your machine and choose the one providing a path to mpm installation:

$ ./mpm-macos-x64.bin install meta-package-manager
warning: Skip unavailable cargo manager.
warning: Skip unavailable steamcmd manager.
Installation priority: brew > cask > composer > gem > mas > npm > pip > pipx > vscode > yarn
warning: No meta-package-manager package found on brew.
warning: No meta-package-manager package found on cask.
warning: No meta-package-manager package found on composer.
warning: No meta-package-manager package found on gem.
warning: No meta-package-manager package found on mas.
warning: No meta-package-manager package found on npm.
warning: pip does not implement search operation.
meta-package-manager existence unconfirmed, try to directly install it...
Install meta-package-manager package with pip...
Collecting meta-package-manager
  Downloading meta_package_manager-7.3.0-py3-none-any.whl (161 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 161.5/161.5 kB 494.7 kB/s eta 0:00:00
(...)
Installing collected packages: (...) meta-package-manager
Successfully installed (...) meta-package-manager-7.3.0

And now you can remove the local binary and enjoy the system-wide mpm that was installed by itself:

$ rm -f ./mpm-macos-x64.bin
$ which mpm
/opt/homebrew/bin/mpm
$ mpm --version
mpm, version 7.3.0

Tip

At this moment, mpm can be installed with itself via these managers:

$ mpm --brew install meta-package-manager
$ mpm --guix install meta-package-manager
$ sudo mpm --macports install meta-package-manager
$ mpm --pacaur install meta-package-manager
$ mpm --pacman install meta-package-manager
$ mpm --paru install meta-package-manager
> mpm --choco install meta-package-manager
$ mpm --pip  install meta-package-manager
$ mpm --pipx install meta-package-manager
> mpm --scoop install meta-package-manager
$ mpm --stew install kdeldycke/meta-package-manager
$ mpm --uvx install meta-package-manager
$ mpm --yay  install meta-package-manager
$ mpm --zerobrew install meta-package-manager

Python module usageΒΆ

Meta Package Manager should now be available system-wide:

$ mpm --version
mpm, version 4.13.0
(...)

If not, you can directly execute the module from Python:

$ python -m meta_package_manager --version
mpm, version 4.13.0
(...)

Python compatibilityΒΆ

The table below shows which Python versions each mpm release range supports. For 5.17.0 and later, support comes from the Programming Language :: Python :: 3.X classifiers in pyproject.toml. For earlier releases, the floor comes from the requires-python (or Poetry python = "..." for older tags) or python_requires (setup.py) declaration, capped at the latest Python released within the range. Releases before 1.8.0 did not declare Python version support and are not represented. The table is regenerated from the release tags by repomatic’s update-docs job, through click-extra’s matrix mechanism:

mpm

Released

3.14

3.13

3.12

3.11

3.10

3.9

3.8

3.7

3.6

3.5

3.4

3.3

2.7

6.0.x β†’ 7.x

2025-12-08

βœ…

βœ…

βœ…

βœ…

βœ…

❌

❌

❌

❌

❌

❌

❌

❌

5.21.0

2025-05-28

❌

βœ…

βœ…

βœ…

❌

❌

❌

❌

❌

❌

❌

❌

❌

5.19.x β†’ 5.20.x

2024-11-13

❌

βœ…

βœ…

βœ…

βœ…

❌

❌

❌

❌

❌

❌

❌

❌

5.17.x β†’ 5.18.x

2024-07-07

❌

❌

βœ…

βœ…

βœ…

βœ…

❌

❌

❌

❌

❌

❌

❌

5.14.x β†’ 5.16.x

2024-01-12

❌

❌

βœ…

βœ…

βœ…

βœ…

βœ…

❌

❌

❌

❌

❌

❌

3.2.x β†’ 5.13.x

2020-05-31

❌

❌

βœ…

βœ…

βœ…

βœ…

βœ…

βœ…

❌

❌

❌

❌

❌

2.9.x β†’ 3.1.x

2020-03-18

❌

❌

❌

❌

❌

❌

βœ…

βœ…

βœ…

❌

❌

❌

❌

2.5.x β†’ 2.8.x

2017-03-01

❌

❌

❌

❌

❌

❌

βœ…

βœ…

βœ…

βœ…

βœ…

❌

βœ…

2.1.x β†’ 2.4.x

2016-12-17

❌

❌

❌

❌

❌

❌

❌

❌

βœ…

βœ…

βœ…

βœ…

βœ…

1.8.x β†’ 2.1.x

2016-08-22

❌

❌

❌

❌

❌

❌

❌

❌

❌

βœ…

βœ…

βœ…

βœ…

Shell completionΒΆ

Completion for popular shell rely on Click feature.

Add this to ~/.bashrc:

eval "$(_MPM_COMPLETE=bash_source mpm)"

Add this to ~/.zshrc:

eval "$(_MPM_COMPLETE=zsh_source mpm)"

Add this to ~/.config/fish/completions/mpm.fish:

eval (env _MPM_COMPLETE=fish_source mpm)

Alternatively, export the generated completion code as a static script to be executed:

$ _MPM_COMPLETE=bash_source mpm > ~/.mpm-complete.bash

Then source it from ~/.bashrc:

. ~/.mpm-complete.bash
$ _MPM_COMPLETE=zsh_source mpm > ~/.mpm-complete.zsh

Then source it from ~/.zshrc:

. ~/.mpm.zsh
_MPM_COMPLETE=fish_source mpm > ~/.config/fish/completions/mpm.fish

For broader shell coverage than Click’s Bash, Zsh and Fish support, mpm’s command tree can be exported to Carapace, a multi-shell completion engine that drives identical completions across Bash, Zsh, Fish, Nushell, PowerShell, Elvish and more from a single spec. Generate and install the spec with click-extra’s wrap command:

$ uvx --from "click-extra[carapace]" --with meta-package-manager click-extra wrap --carapace --install meta_package_manager.cli:mpm

This writes the spec to ~/.config/carapace/specs/mpm.yaml, which Carapace loads once it is installed and hooked into your shell. Re-run the command after upgrading mpm to refresh the spec.

Man pagesΒΆ

mpm exposes a --man option on every (sub)command that prints the corresponding roff page to stdout. Pipe it through man --local-file - to render it:

$ mpm --man | man --local-file -
$ mpm install --man | man --local-file -

The full command tree is also pre-rendered as static .1 files:

Downstream packagers can regenerate them from source as part of their build phase:

$ click-extra wrap --man --output-dir /usr/share/man/man1/ meta_package_manager.cli:mpm

The module:function notation skips the mpm console-script entry point (which dispatches through __main__:main and hides the Click command behind a lazy import). The generator honors SOURCE_DATE_EPOCH for reproducible builds. See the click-extra man-page reference for other invocation forms (uvx for build sandboxes, .py file paths, and the programmatic API).

Extra dependenciesΒΆ

By default, mpm supports TOML configuration files and all standard table formats. Optional extras unlock additional configuration file formats, table output formats, and SBOM generation:

Extra

Install command

Unlocks

hjson

$ uv pip install meta-package-manager[hjson]

json5

$ uv pip install meta-package-manager[json5]
  • JSON5 config files: --config mpm.json5

jsonc

$ uv pip install meta-package-manager[jsonc]
  • JSONC config files: --config mpm.jsonc

sbom-offline

$ uv pip install meta-package-manager[sbom-offline]
  • CycloneDX and SPDX SBOM generation from local data: mpm sbom

sbom-online

$ uv pip install meta-package-manager[sbom-online]
  • Network enrichment for mpm --network sbom: OSV.dev vulnerability lookups

toml

$ uv pip install meta-package-manager[toml]

xml

$ uv pip install meta-package-manager[xml]

yaml

$ uv pip install meta-package-manager[yaml]

Tip

Install all extras at once with:

$ uv pip install meta-package-manager[hjson,json5,jsonc,sbom-offline,sbom-online,toml,xml,yaml]

Or with pip:

$ pip install meta-package-manager[hjson,json5,jsonc,sbom-offline,sbom-online,toml,xml,yaml]

When working from a cloned repository, uv sync installs all runtime extras plus dev groups (test, docs, typing) in one shot:

$ uv sync --all-extras --all-groups