Safeguard
Developer Tools•

uvx or uv tool install: which should you use for Python tools?

uvx runs a tool in a temporary isolated environment, while uv tool install keeps it on PATH. Choose by how often you run it and how you update it.

Safeguard Security Team
3 min read

Use uvx to run a Python tool occasionally, and uv tool install for a tool you run often. The uv documentation says uvx runs a tool in a temporary virtual environment isolated from the current project, while an installed tool keeps its isolated environment and its executables go on your PATH.

What the docs say

uv's tools documentation explains that uvx is an alias for uv tool run, and the two are exactly equivalent. Tools run this way have their dependencies installed in a temporary virtual environment, isolated from the current project. Tools can also be installed with uv tool install. Then their executables are available on the PATH, an isolated virtual environment is still used, and it is not removed when the command completes.

The same page says that in most cases executing a tool with uvx is more appropriate than installing it. Installing is useful if some other program or script you do not control needs the tool on your PATH, or in similar situations such as a Docker image.

Comparing the two

Questionuvxuv tool install
EnvironmentTemporary, isolatedPersistent, isolated
On PATHNoYes
Leaves software behindLittleA tool that ages
UpgradesNothing persists between runsNeeds an upgrade command
FitsOne-off or rare useDaily use

The upgrade row deserves a note. The docs describe upgrading tool environments with uv tool upgrade, or re-creating them with another install. If you never run it, an installed tool stays at its old version.

The security angle

Both routes download a package from an index and run code. The difference is exposure over time. A temporary run is a short window. An installed tool is on your PATH every day, with your privileges, and nobody reminds you to update it. That is the same posture as a global npm package, covered in where npm install -g puts packages.

Neither route removes the need to check what you are about to run. Before using a tool for the first time, look at the package name carefully. Typosquats rely on a hurried keystroke.

A worked example

Say you want a code formatter once, to tidy a script you were handed. Run it with uvx and move on. Nothing stays on your PATH afterwards, and if the package had been a bad one, the window of exposure was one command.

Now say the formatter is part of your daily routine and an editor integration expects it on PATH. Install it, note the version, and add a monthly upgrade to your review. If you skip that step, you have a tool that ages the way any global tool does.

Rules that work

  1. Default to uvx for tools you use less than weekly.
  2. For installed tools, keep a list and upgrade monthly.
  3. Pin a version when a team shares a tool, so everyone runs the same one.
  4. Remove tools after the project ends.
  5. Compare with pipx versus pip if your team uses that route instead.

Quick check

Is uvx a different program from uv tool run?

No. The documentation says uvx is an alias and the two are exactly equivalent.

Does an installed tool update itself?

Not on its own. You run uv tool upgrade or reinstall it, per the uv documentation.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.