Use pipx to install Python command-line tools, and use pip inside a project's virtual environment for libraries your code imports. pipx puts each tool in its own isolated environment, so tools do not conflict with each other or with your system Python, and you can remove one cleanly.
The short decision table
| You want to | Use | Why |
|---|---|---|
| Run a linter, formatter or scanner from any folder | pipx | One isolated environment per tool |
| Try a tool once without keeping it | pipx run | Uses a temporary environment |
| Import a package in your project code | pip in a venv | The library must live next to your code |
| Install into the system interpreter | neither | Your OS manages it |
What pipx does
The Python Packaging User Guide describes pipx as a way to install applications from Python packages without interfering with each other or with system packages. It creates a virtual environment for each package and keeps the application reachable from a directory on your path.
Three commands cover most use: install a package, run an application in a temporary environment, and upgrade or uninstall a package later. Because every tool has its own environment, upgrading one cannot break another.
Why this is a security habit, not only tidiness
Command-line tools are often installed once, forgotten and left to age. A shared global environment makes that worse: one stale package might be required by three tools, so you never update it.
With one environment per tool, you can list what you have installed, upgrade each independently and delete what you no longer use. Fewer forgotten packages means a smaller set of things that can become vulnerable. It does not make a tool safe to install, though. A package you run is still code you run, so check the name carefully first. See PyPI name normalization and lookalike packages.
When pipx is the wrong tool
If you are writing a project that imports a library, pipx is wrong. The library has to be importable by your code, so install it with pip into the environment that project uses. If you install into the system interpreter and see the externally managed error, read why pip says externally-managed-environment.
Steps to move over
- List the command-line tools you currently installed globally.
- Uninstall them from the global interpreter where your OS allows.
- Reinstall each one with pipx.
- Add a monthly reminder to upgrade the lot.
Quick check
Does pipx check that a package is safe?
No. It isolates the install. You still need to verify the package name and source.
Can I use pipx for libraries my code imports?
No. Install those with pip into the project's virtual environment.
Safeguard's CLI is installed with a curl or PowerShell installer and also runs dependency scans in a pipeline. A free scan needs no install.
Sources
Last reviewed: 19 October 2026.
