Skip to content

Rank #2 of 6 in Package & Toolchain Managers

Bun (package manager) logo

Bun (package manager)

Open Source

Oven (Oven-sh, Inc.)

96k17.7k/yrnpm 2.6M/wk +85npm/wk -873.8k

Access

Install

installercurl -fsSL https://bun.com/install | bash

Vendor-official, but review any script before piping it to a shell.

npmnpm install -g bun

Compare head-to-head

Alternatives to Bun (package manager)

Showcase

Bun (package manager) homepage screenshot
homepage · captured Sep 2026 · view live ↗
Bun (package manager) docs screenshot
docs · captured Sep 2026 · view live ↗

Try itExperimental

See what an agent can do with Bun (package manager) before you ever sign up. Pick a story: recorded sessions replay real probe-harness transcripts; sandboxed self-drive sessions are designed and gated (docs/TRY-IT.md).

$bun --versionrecorded session — replayed, not live
recorded 2026-09-04 · exit 0 · captured verbatim by our probe harness, secrets redacted

Verified integrations

Connections to other tracked products — hover a chip for the verbatim evidence quote behind it.

By theme — the product's score on each story themeBy theme

Agent experience — stories about agent experience in this arenaAgent experienceevidence →

Stories about agent experience in this arena

42.3/100

Agenticness — how well agents can access and operate the productAgenticnessevidence →

How well agents can access and operate the product

38.0/100

Automation depth — how much of the product can run unattendedAutomation depthevidence →

How much of the product can run unattended

36.0/100

Cross platform — stories about cross platform in this arenaCross platformevidence →

Stories about cross platform in this arena

36.0/100

Ecosystem extensibility — stories about ecosystem extensibility in this arenaEcosystem extensibilityevidence →

Stories about ecosystem extensibility in this arena

32.0/100

Install reproducibility — stories about install reproducibility in this arenaInstall reproducibilityevidence →

Stories about install reproducibility in this arena

85.0/100

Migration adoption — stories about migration adoption in this arenaMigration adoptionevidence →

Stories about migration adoption in this arena

75.0/100

Monorepo workspaces — stories about monorepo workspaces in this arenaMonorepo workspacesevidence →

Stories about monorepo workspaces in this arena

62.4/100

Openness — open source, data portability, and self-hosting storiesOpennessevidence →

Open source, data portability, and self-hosting stories

0.0/100

Performance caching — stories about performance caching in this arenaPerformance cachingevidence →

Stories about performance caching in this arena

61.3/100

Privacy posture — data-handling and privacy storiesPrivacy postureevidence →

Data-handling and privacy stories

0.0/100

Security supply chain — stories about security supply chain in this arenaSecurity supply chainevidence →

Stories about security supply chain in this arena

44.6/100

Toolchain management — stories about toolchain management in this arenaToolchain managementevidence →

Stories about toolchain management in this arena

0.0/100

Story verdicts — every judged story with its evidenceStory verdicts

?

Sorted by importance (agentic first) (high → low) · 54/54 stories · click a row’s chevron for the rationale and evidence

Drive the product through a documented public API G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness3partial5/10T

Connect an agent via an official MCP server G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness3n/auntestednone yet

Delegate tasks to a built-in AI assistant inside the product G

Agentic features

ai-native userAgenticness — how well agents can access and operate the productAgenticness3n/auntestednone yet

Plug MCP servers into this product so it can use their tools G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness3n/auntestednone yet

Point an agent at llms.txt or agent-oriented docs G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2full9/10T

Use an official CLI G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2full9/10T

Run the product headlessly / in CI for automation G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2partial±6/10X

Download a machine-readable API spec (OpenAPI or equivalent) G

Api quality

ai-native userAgenticness — how well agents can access and operate the productAgenticness2partial±4/10T

Explore an interactive API reference with runnable examples G

Api quality

ai-native userAgenticness — how well agents can access and operate the productAgenticness2none0/10

Rely on versioned APIs with a documented deprecation policy G

Api quality

ai-native userAgenticness — how well agents can access and operate the productAgenticness2none0/10

Build against official SDKs G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Get AI-generated insights and suggestions from my data inside the product G

Agentic features

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Issue scoped/least-privilege API credentials for an agent G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Operate the product with natural-language commands G

Agentic features

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/a±untestednone yet

Set up automations that run autonomously in the background G

Agentic features

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Subscribe to events via webhooks G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Test against a sandbox environment without touching production data G

Api quality

ai-native userAgenticness — how well agents can access and operate the productAgenticness1n/auntestednone yet

Pin exact versions of packages and tools per project and have the manager respect those pins C

Pinning

developerInstall reproducibility — stories about install reproducibility in this arenaInstall reproducibility3full9/10X

Audit installed dependencies for known vulnerabilities directly from the CLI C

Auditing

platform-engineerSecurity supply chain — stories about security supply chain in this arenaSecurity supply chain3full8/10C

Install dependencies from a lockfile and get the exact same resolved versions on every machine C

Lockfiles

developerInstall reproducibility — stories about install reproducibility in this arenaInstall reproducibility3full8/10X

Manage many packages in one monorepo with workspaces sharing a single lockfile and cross-linked local dependencies C

Workspaces

developerMonorepo workspaces — stories about monorepo workspaces in this arenaMonorepo workspaces3full8/10X

Install prebuilt binary packages from a cache instead of compiling from source C

Binary caching

developerPerformance caching — stories about performance caching in this arenaPerformance caching3full7/10X

Make CI installs fast with a documented cache-restore setup and offline-capable installs C

Ci speed

platform-engineerPerformance caching — stories about performance caching in this arenaPerformance caching3partial7/10C

Have an agent install and update project dependencies non-interactively, with clear exit codes and errors when something fails C

Headless installs

ai-native userAgent experience — stories about agent experience in this arenaAgent experience3partial6/10X

Define rules that trigger actions automatically on events G

ai-native userAutomation depth — how much of the product can run unattendedAutomation depth3n/auntestednone yet

Export all of my data in open formats and leave G

ai-native userOpenness — open source, data portability, and self-hosting storiesOpenness3n/auntestednone yet

Prevent my data from being used to train AI models G

ai-native userPrivacy posture — data-handling and privacy storiesPrivacy posture3n/auntestednone yet

Self-host the core product G

ai-native userOpenness — open source, data portability, and self-hosting storiesOpenness3n/auntestednone yet

Enforce a frozen/immutable lockfile mode that fails the install when the manifest and lockfile disagree C

Lockfiles

platform-engineerInstall reproducibility — stories about install reproducibility in this arenaInstall reproducibility2full9/10C

Rely on a shared content-addressable store so the same dependency version is stored once on disk across all projects C

Disk efficiency

developerPerformance caching — stories about performance caching in this arenaPerformance caching2full9/10C

Bootstrap a fresh clone with one command that installs everything the project declares C

Bootstrap

developerInstall reproducibility — stories about install reproducibility in this arenaInstall reproducibility2full8/10X

Install almost anything I need from a large, actively maintained package registry or repository C

Registry

developerEcosystem extensibility — stories about ecosystem extensibility in this arenaEcosystem extensibility2full8/10X

Keep using familiar commands and interface conventions from the incumbent tool while adopting this manager C

Compatibility

switcherMigration adoption — stories about migration adoption in this arenaMigration adoption2full8/10X

Add, remove, and upgrade dependencies through CLI commands that safely rewrite the manifest and lockfile, so an agent never hand-edits them C

Manifest editing

ai-native userAgent experience — stories about agent experience in this arenaAgent experience2full7/10C

Migrate an existing project from the incumbent tool with documented import or conversion tooling G

Migration

switcherMigration adoption — stories about migration adoption in this arenaMigration adoption2full7/10X

Perform bulk operations across many items at once G

ai-native userAutomation depth — how much of the product can run unattendedAutomation depth2partial6/10X

Run installs and scripts filtered to a subset of workspace packages (including only those affected by a change) C

Workspaces

developerMonorepo workspaces — stories about monorepo workspaces in this arenaMonorepo workspaces2partial6/10X

Turn on protections against malicious packages, such as blocking lifecycle scripts or enforcing a minimum release age C

Hardening

platform-engineerSecurity supply chain — stories about security supply chain in this arenaSecurity supply chain2partial6/10C

Use the same workflow and config on macOS, Linux, and Windows C

Platform parity

developerCross platform — stories about cross platform in this arenaCross platform2partial6/10X

Trust that fetched packages are verified against checksums, signatures, or attestations before they run C

Integrity

platform-engineerSecurity supply chain — stories about security supply chain in this arenaSecurity supply chain2none0/10

Choose where my data is stored (region/residency) G

ai-native userPrivacy posture — data-handling and privacy storiesPrivacy posture2n/auntestednone yet

Control data retention and deletion G

ai-native userPrivacy posture — data-handling and privacy storiesPrivacy posture2n/auntestednone yet

Do everything through the API that I can do in the UI G

ai-native userOpenness — open source, data portability, and self-hosting storiesOpenness2n/auntestednone yet

Get machine-readable (JSON) output from core commands so an agent can parse results instead of scraping text G

Structured output

ai-native userAgent experience — stories about agent experience in this arenaAgent experience2noneuntestednone yet

Install and switch language runtimes or tool versions per project from a checked-in config file C

Runtimes

developerToolchain management — stories about toolchain management in this arenaToolchain management2noneuntestednone yet

Opt out of telemetry and usage tracking G

ai-native userPrivacy posture — data-handling and privacy storiesPrivacy posture2noneuntestednone yet

Point the manager at private registries or mirrors with scoped authentication C

Private registries

platform-engineerEcosystem extensibility — stories about ecosystem extensibility in this arenaEcosystem extensibility2noneuntestednone yet

Read the product's source under an open license G

ai-native userOpenness — open source, data portability, and self-hosting storiesOpenness2noneuntestednone yet

Schedule recurring jobs or workflows G

ai-native userAutomation depth — how much of the product can run unattendedAutomation depth2n/auntestednone yet

Point an agent at a documented, text-based lockfile format it can read and diff C

Structured output

ai-native userAgent experience — stories about agent experience in this arenaAgent experience1full9/10C

See published benchmarks or measured numbers backing the manager's speed claims C

Benchmarks

developerPerformance caching — stories about performance caching in this arenaPerformance caching1partial6/10X

Extend the manager through third-party taps, overlays, plugins, or backends C

Extensibility

developerEcosystem extensibility — stories about ecosystem extensibility in this arenaEcosystem extensibility1noneuntestednone yet

Have the right tool versions and environment variables activate automatically when I enter a project directory C

Environments

developerToolchain management — stories about toolchain management in this arenaToolchain management1n/auntestednone yet

Version, review, and roll back my automations G

ai-native userAutomation depth — how much of the product can run unattendedAutomation depth1n/auntestednone yet

Opportunities — the stories that would move this product's scores, from its own judged verdictsOpportunitiestop 8 of 19 stories with headroom

What would move Bun (package manager)’s scores — derived from its own judged verdicts, biggest headroom first. Each line quotes what the judge found missing; shipping it (or evidencing it publicly) is the fix.

  1. Agenticness — how well agents can access and operate the productExplore an interactive API reference with runnable examples

    nonemoves API qualityimpact 30

    No evidence of an interactive API reference or runnable examples; docs are static markdown pages and OpenAPI/interactive endpoints all 404.

  2. Agenticness — how well agents can access and operate the productRely on versioned APIs with a documented deprecation policy

    nonemoves API qualityimpact 30

    No evidence of a versioned API surface or documented deprecation policy for Bun's package manager; docs cover install/lockfile/workspaces features but nothing about API versioning guarantees or deprecation timelines, and no OpenAPI/spec was found (bun-probe-3 shows 404s).

  3. Agenticness — how well agents can access and operate the productDrive the product through a documented public API

    partialq5/10moves agent-readyimpact 22.5

    Missing: a documented HTTP/OpenAPI or SDK-style API, first-party guidance on programmatic/agent use beyond shell invocation, independent confirmation of AI agents successfully driving it.

  4. Security supply chain — stories about security supply chain in this arenaTrust that fetched packages are verified against checksums, signatures, or attestations before they run

    nonemoves PA Scoreimpact 20

    Missing: explicit checksum/integrity hash verification, package signature verification, and supply-chain attestation (e.g. SLSA/sigstore) support.

  5. Agent experience — stories about agent experience in this arenaGet machine-readable (JSON) output from core commands so an agent can parse results instead of scraping text

    nonemoves PA Scoreimpact 20

    No evidence in the pack shows any Bun package-manager command (install, pm ls, audit, outdated, pack, etc.) offering a --json or machine-readable output flag; docs only describe human-readable text output and lockfile formats.

  6. Openness — open source, data portability, and self-hosting storiesRead the product's source under an open license

    nonemoves PA Scoreimpact 20

    Missing: any mention of a GitHub repo, license (e.g., MIT), or contribution/source-availability documentation.

  7. Privacy posture — data-handling and privacy storiesOpt out of telemetry and usage tracking

    nonemoves PA Scoreimpact 20

    No evidence in the pack discusses telemetry, usage tracking, or an opt-out mechanism for Bun's CLI/package manager; the docs cover install, cache, workspaces, audit, etc., but nothing about data collection or privacy settings.

  8. Ecosystem extensibility — stories about ecosystem extensibility in this arenaPoint the manager at private registries or mirrors with scoped authentication

    nonemoves PA Scoreimpact 20

    The evidence pack covers install speed, lockfiles, workspaces, caching, audit, and pm subcommands, but contains no mention of configuring private registries, mirrors, scoped registries, or authentication tokens (e.g., via bunfig.toml or .npmrc equivalents).

Showing the top 8 of 19 — every none/partial verdict in the story verdicts table is headroom.

Think a verdict is wrong? Every verdicts-table row has a Flag link — see the methodology.

Coverage map — which docs area, API section, or community source covers which judged storiesCoverage map5 surfaces · 25 covered stories

Where the cited evidence behind each covered verdict came from — the same citations the verdicts table shows, no extra judging.

docs25 stories

Probe proofs — replayable recordings from the probe harnessProbe proofs

Replayable recordings from our probe harness — see the Prove-It protocol to submit one.

$bun --versionreproduced
$ bun --version
1.4.1
proves: Use an official CLIrecorded 2026-09-04
$mktemp -d && printf '{"dependencies":{"is-odd":"3.0.1"}}' > package.json && bun install && head -3 bun.lock && bun pm lsreproduced
$ mktemp -d && printf '{"dependencies":{"is-odd":"3.0.1"}}' > package.json && bun install && head -3 bun.lock && bun pm ls
bun install v1.4.1 (4661e494f)
  🔒 Saving lockfile...
+ is-odd@3.0.1

2 packages installed [2.00ms]
{
  "lockfileVersion": 2,
  "configVersion": 1,
/private/var/folders/y3/9hs_txjs2ng3w8q679fywqyh0000gn/T/tmp.9NRyy78Msr node_modules (2 installed)
└── is-odd@3.0.1

Claims vs evidence — vendor claims reconciled against independent verdictsClaims vs evidence

7 of 13 testable claims verified · 0 contradictedintegrity 54/100

28 distinct capability claims found in Bun (package manager)’s own claimed-docs/GitHub materials, reconciled against our judge’s independent verdicts.

7

Verified

6

Unverified

0

Contradicted

12

Undersold

Verified (11)
Unverified (9)
Undersold (12)
Claims outside our story set (8)

Real capability claims found in Bun (package manager)’s own materials, but no story in this arena’s taxonomy covers them yet — that’s feedback on the taxonomy, not a mark against the product.

  • Supports installing packages globally via -g/--global flag for CLI tools

    source ↗
  • Can list installed dependencies and their resolved versions

    source ↗
  • Can list installed packages grouped by license

    source ↗
  • Can show a diff of files and package.json changes between two versions of a package

    source ↗
  • Can pack a package into an npm-compatible .tgz archive

    source ↗
  • Supports a production install mode that skips devDependencies

    source ↗
  • Provides bunx to execute a package's binary directly without a separate install step

    source ↗
  • Supports patching dependencies directly

    source ↗
Suggest a story for these →

Business model

open-source

Free, MIT-licensed JavaScript runtime whose bundled package manager (bun install) is fully open source; built by venture-funded Oven, which plans to monetize hosting rather than the toolchain.

pricing ↗

Score trend

How this product’s scores have moved as evidence and verdicts are re-derived — a point per change, not per day.

PA Scoretracked since Sep 4 '26 — no movement recorded yet
Agent-readytracked since Sep 4 '26 — no movement recorded yet

Try Experimental

Run it in the microterminal →

Recorded agent sessions — and a live MCP handshake where the vendor ships one.

Flag

⚑ Flag a verdict

Think a verdict is wrong? Opens a prefilled GitHub issue — or use the ⚑ next to any verdict above.

Badge

Embed this product's score badge →

Hotlinked SVG — always shows the live current score.

For agents

Data

Agent surface uptime llms.txt 100% (30d, checked every 6h since Sep 8 '26)