Python uvx

ID

uvx

Home page

https://docs.astral.sh/uv/guides/tools/

Version requirement

>= 0.10.10

Cooldown

✓

Platforms

🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows

Operations

installed · outdated · install · upgrade · upgrade_all · remove

purl types

pkg:uvx

Brewfile entry

uv, in Brewfile backups

CLI name

uv

Every call

uv --color never --no-progress <command>

Issues and PRs

📦 manager: pypi-based

Source

meta_package_manager/managers/uv.py

uv’s tool manager for isolated Python applications, like pipx.

mpm drives the uv tool subcommands; each application lives in its own venv. Installed and outdated tools are parsed from the plain-text tool list and tool list --outdated output: unlike the uv pip interface, uv tool emits no JSON. The --outdated listing sets the >=0.10.10 version floor, the first uv release to ship it. The release-age cooldown rides on uv’s --exclude-newer resolver option, covering install, upgrade and outdated through one cutoff.

Hint

Package specs are passed unquoted, working around uv parse failures on quoted specs.

What mpm adds to uvx

mpm reaches across every manager at once, not uvx alone: mpm installed and mpm outdated cover uvx alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your uvx commands, in mpm

You already know uvx: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With uvx	With mpm
List what’s installed	uv tool list	mpm --uvx installed
List outdated packages	uv tool list --outdated	mpm --uvx outdated
Install a package	uv tool install pycowsay	mpm install pkg:uvx/pycowsay
Upgrade one package	uv tool upgrade pycowsay	mpm --uvx upgrade pycowsay
Upgrade everything	uv tool upgrade --all	mpm --uvx upgrade --all
Remove a package	uv tool uninstall pycowsay	mpm remove pkg:uvx/pycowsay

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported
installed	✓
outdated	✓
orphans
search
install	✓
upgrade	✓
upgrade_all	✓
remove	✓
sync
cleanup
doctor

Selecting and configuring uvx

Deselect uvx for a single run with --no-uvx, or persist the choice in your configuration:

[mpm]
uvx = false

The arguments and environment variables listed in the box atop this page are forced on every uvx call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.uvx]
timeout = 900

mpm config-template uvx prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around uvx, one mpm command each:

• Snapshot and clone a machine: mpm --uvx dump uvx.toml, then mpm restore uvx.toml on the next one.

• Export a Brewfile entry instead: mpm --uvx dump --brewfile Brewfile.

• Export a compliance SBOM: mpm --uvx sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

mpm natively enforces its release-age cooldown on Python uvx, injecting the UV_EXCLUDE_NEWER environment variable on every call. Point it at a window (mpm --cooldown 7 --uvx upgrade --all) to skip anything published in the last 7 days: a guard against a compromised or yanked fresh release landing before anyone notices.

• Status: ✅ Enforced

• Mechanism: exclude-newer env UV_EXCLUDE_NEWER

• Reference: uv docs

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: PyPI (pkg:pypi)

• Retraction: Yank (PEP 592): the file stays downloadable, but an installer “MUST ignore yanked releases, if the selection constraints can be satisfied with a non-yanked version”

• Publish date: ✅ upload_time_iso_8601, plus a per-file yanked flag (JSON API)

Version probe

The version is extracted from the output of uv --version with:

r"uv\s+(?P<version>\S+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Python uvx well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ uv --color never --no-progress tool list
pycowsay v0.0.0.1
- pycowsay

$ uv --color never --no-progress tool list --outdated
pycowsay v0.0.0.1 [latest: 0.0.0.2]
- pycowsay

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --uvx installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

• 6.3.0 (2026-04-09)

  • Implement outdated operation. Bump minimal requirement to 0.10.10. Closes #1704.

• 6.1.0 (2026-01-18)

  • Add uvx support for managing isolated Python tools via uv tool. Closes #1656, #1657.