Each package manager keeps its own list, so you run one command per ecosystem: brew for Homebrew, npm with the global flag, pip list, cargo install with the list option, uv tool list and winget list. Together they give you a first inventory of tools that run with your privileges.
Why one list does not exist
There is no single place that knows everything installed on a laptop. A tool can arrive through a system package manager, a language ecosystem, a vendor installer, or a script that downloads a binary. Each leaves its own record, or none.
That fragmentation is why an incident is so painful. Someone announces that a package was compromised, and the first question, "do we have it", takes hours to answer.
Commands to run
| Ecosystem | What to run | Notes |
|---|---|---|
| Homebrew | brew list, or brew bundle dump for a file | See the Brewfile post |
| npm | npm ls with the global flag, and npm prefix with the global flag for the folder | npm documents the global flag for installs and updates |
| pip | python -m pip list | Run it for each interpreter you use |
| Cargo | cargo install with the list option | Cargo's docs say this command manages its set of installed binary crates |
| uv | uv tool list | Lists tools installed with uv tool install |
| winget | winget list | Windows only |
Where a command's exact flags matter, check the tool's own help on your version.
Where Cargo puts binaries
The Cargo book says executables go into the installation root's bin folder, and gives the order used to find the root: the root option, the CARGO_INSTALL_ROOT variable, the install.root config value, the CARGO_HOME variable, then $HOME/.cargo. Knowing that tells you which folder to look in.
What to record
For each tool, write:
- Name and version.
- Where it came from, including the registry or source.
- Why you have it.
- When you last updated it.
A plain text file works. A table in a private repository works better because changes can be reviewed.
What to do with the result
- Remove tools you have not used in months.
- Move rarely used tools to run-on-demand patterns, such as the one in uvx or uv tool install.
- Check update commands for the rest. See updating global npm packages and brew update, outdated and upgrade.
- Put the schedule in a calendar so it happens.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at the fields the inventory keeps for each component and copy them into your own laptop list.
Quick check
Does one command list everything on my laptop?
No. Each package manager keeps its own record, and manual installs may have none.
How often should I review the list?
Quarterly is a workable rhythm for most people, with a quick look after any security news about a tool you use.
Sources
- Cargo install documentation
- uv tools documentation
- Homebrew Bundle and Brewfile documentation
- npm folders documentation
Last reviewed: 19 October 2026.
