Skip to content
ProductArena

Rank #5 of 6 in Package & Toolchain Managers

pnpm logo

pnpm

Open Source

pnpm maintainers (Zoltan Kochan et al.)

pnpm.io ↗Try it →
PA Score26/100AGENT-READY38/100BUILT-IN AI untestedAPI0/100
MCP—CLI✓API—
★ 36.5k▲ 3.4k/yrnpm 132.7M/wk★ +107npm/wk -44.9M
ArenasPackage & Toolchain Managers#5/6

Access

CLI docs ↗

Install

installercurl -fsSL https://get.pnpm.io/install.sh | sh -

Vendor-official, but review any script before piping it to a shell.

Compare head-to-head

Homebrew logovs HomebrewNix logovs Nixuv logovs uvBun (package manager) logovs Bun (package manager)mise logovs mise

Alternatives to pnpm →

Showcase

pnpm homepage screenshot
homepage · captured Sep 2026 · view live ↗
pnpm docs screenshot
docs · captured Sep 2026 · view live ↗

Try itExperimental

See what an agent can do with pnpm before you ever sign up. Pick a story: recorded sessions replay real probe-harness transcripts; sandboxed self-drive sessions are designed and gated (docs/TRY-IT.md).

$pnpm --versionrecorded session — replayed, not live
recorded 2026-09-04 · exit 0 · captured verbatim by our probe harness, secrets redacted

Verified integrations

Connections to other tracked products — hover a chip for the verbatim evidence quote behind it.

Bun (package manager) logoBun (package manager)Package & Toolchain Managers

By theme — the product's score on each story themeBy theme

Agent experience — stories about agent experience in this arenaAgent experienceevidence →

Stories about agent experience in this arena

33.2/100

Agenticness — how well agents can access and operate the productAgenticnessevidence →

How well agents can access and operate the product

26.2/100

Automation depth — how much of the product can run unattendedAutomation depthevidence →

How much of the product can run unattended

70.0/100

Cross platform — stories about cross platform in this arenaCross platformevidence →

Stories about cross platform in this arena

36.0/100

Ecosystem extensibility — stories about ecosystem extensibility in this arenaEcosystem extensibilityevidence →

Stories about ecosystem extensibility in this arena

41.6/100

Install reproducibility — stories about install reproducibility in this arenaInstall reproducibilityevidence →

Stories about install reproducibility in this arena

82.0/100

Migration adoption — stories about migration adoption in this arenaMigration adoptionevidence →

Stories about migration adoption in this arena

39.0/100

Monorepo workspaces — stories about monorepo workspaces in this arenaMonorepo workspacesevidence →

Stories about monorepo workspaces in this arena

86.0/100

Openness — open source, data portability, and self-hosting storiesOpennessevidence →

Open source, data portability, and self-hosting stories

0.0/100

Performance caching — stories about performance caching in this arenaPerformance cachingevidence →

Stories about performance caching in this arena

59.3/100

Privacy posture — data-handling and privacy storiesPrivacy postureevidence →

Data-handling and privacy stories

n/a

Security supply chain — stories about security supply chain in this arenaSecurity supply chainevidence →

Stories about security supply chain in this arena

54.9/100

Toolchain management — stories about toolchain management in this arenaToolchain managementevidence →

Stories about toolchain management in this arena

61.3/100

Story verdicts — every judged story with its evidenceStory verdicts

?

Sorted by importance (agentic first) (high → low) · 54/54 stories · click a row’s chevron for the rationale and evidence

Drive the product through a documented public API G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness3none0/10

Connect an agent via an official MCP server G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness3n/auntestednone yet

Delegate tasks to a built-in AI assistant inside the product G

Agentic features

ai-native userAgenticness — how well agents can access and operate the productAgenticness3n/auntestednone yet

Plug MCP servers into this product so it can use their tools G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness3n/auntestednone yet

Use an official CLI G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2full9/10T

Run the product headlessly / in CI for automation G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2full8/10X

Explore an interactive API reference with runnable examples G

Api quality

ai-native userAgenticness — how well agents can access and operate the productAgenticness2none0/10

Point an agent at llms.txt or agent-oriented docs G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2none0/10

Rely on versioned APIs with a documented deprecation policy G

Api quality

ai-native userAgenticness — how well agents can access and operate the productAgenticness2none0/10

Build against official SDKs G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Download a machine-readable API spec (OpenAPI or equivalent) G

Api quality

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Get AI-generated insights and suggestions from my data inside the product G

Agentic features

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Issue scoped/least-privilege API credentials for an agent G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Operate the product with natural-language commands G

Agentic features

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Set up automations that run autonomously in the background G

Agentic features

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Subscribe to events via webhooks G

Agent access

ai-native userAgenticness — how well agents can access and operate the productAgenticness2n/auntestednone yet

Test against a sandbox environment without touching production data G

Api quality

ai-native userAgenticness — how well agents can access and operate the productAgenticness1n/auntestednone yet

Manage many packages in one monorepo with workspaces sharing a single lockfile and cross-linked local dependencies C

Workspaces

developerMonorepo workspaces — stories about monorepo workspaces in this arenaMonorepo workspaces3full9/10X

Audit installed dependencies for known vulnerabilities directly from the CLI C

Auditing

platform-engineerSecurity supply chain — stories about security supply chain in this arenaSecurity supply chain3full8/10C

Install dependencies from a lockfile and get the exact same resolved versions on every machine C

Lockfiles

developerInstall reproducibility — stories about install reproducibility in this arenaInstall reproducibility3full8/10X

Pin exact versions of packages and tools per project and have the manager respect those pins C

Pinning

developerInstall reproducibility — stories about install reproducibility in this arenaInstall reproducibility3full8/10C

Make CI installs fast with a documented cache-restore setup and offline-capable installs C

Ci speed

platform-engineerPerformance caching — stories about performance caching in this arenaPerformance caching3full7/10X

Have an agent install and update project dependencies non-interactively, with clear exit codes and errors when something fails C

Headless installs

ai-native userAgent experience — stories about agent experience in this arenaAgent experience3partial6/10C

Install prebuilt binary packages from a cache instead of compiling from source C

Binary caching

developerPerformance caching — stories about performance caching in this arenaPerformance caching3partial6/10X

Define rules that trigger actions automatically on events G

ai-native userAutomation depth — how much of the product can run unattendedAutomation depth3n/auntestednone yet

Export all of my data in open formats and leave G

ai-native userOpenness — open source, data portability, and self-hosting storiesOpenness3n/auntestednone yet

Prevent my data from being used to train AI models G

ai-native userPrivacy posture — data-handling and privacy storiesPrivacy posture3n/auntestednone yet

Self-host the core product G

ai-native userOpenness — open source, data portability, and self-hosting storiesOpenness3n/auntestednone yet

Enforce a frozen/immutable lockfile mode that fails the install when the manifest and lockfile disagree C

Lockfiles

platform-engineerInstall reproducibility — stories about install reproducibility in this arenaInstall reproducibility2full9/10C

Rely on a shared content-addressable store so the same dependency version is stored once on disk across all projects C

Disk efficiency

developerPerformance caching — stories about performance caching in this arenaPerformance caching2full9/10X

Bootstrap a fresh clone with one command that installs everything the project declares C

Bootstrap

developerInstall reproducibility — stories about install reproducibility in this arenaInstall reproducibility2full8/10X

Install almost anything I need from a large, actively maintained package registry or repository C

Registry

developerEcosystem extensibility — stories about ecosystem extensibility in this arenaEcosystem extensibility2full8/10X

Install and switch language runtimes or tool versions per project from a checked-in config file C

Runtimes

developerToolchain management — stories about toolchain management in this arenaToolchain management2full8/10C

Run installs and scripts filtered to a subset of workspace packages (including only those affected by a change) C

Workspaces

developerMonorepo workspaces — stories about monorepo workspaces in this arenaMonorepo workspaces2full8/10X

Add, remove, and upgrade dependencies through CLI commands that safely rewrite the manifest and lockfile, so an agent never hand-edits them C

Manifest editing

ai-native userAgent experience — stories about agent experience in this arenaAgent experience2full7/10X

Keep using familiar commands and interface conventions from the incumbent tool while adopting this manager C

Compatibility

switcherMigration adoption — stories about migration adoption in this arenaMigration adoption2partial7/10X

Perform bulk operations across many items at once G

ai-native userAutomation depth — how much of the product can run unattendedAutomation depth2full7/10X

Migrate an existing project from the incumbent tool with documented import or conversion tooling G

Migration

switcherMigration adoption — stories about migration adoption in this arenaMigration adoption2partial6/10X

Trust that fetched packages are verified against checksums, signatures, or attestations before they run C

Integrity

platform-engineerSecurity supply chain — stories about security supply chain in this arenaSecurity supply chain2partial6/10C

Turn on protections against malicious packages, such as blocking lifecycle scripts or enforcing a minimum release age C

Hardening

platform-engineerSecurity supply chain — stories about security supply chain in this arenaSecurity supply chain2partial6/10X

Use the same workflow and config on macOS, Linux, and Windows C

Platform parity

developerCross platform — stories about cross platform in this arenaCross platform2partial6/10X

Point the manager at private registries or mirrors with scoped authentication C

Private registries

platform-engineerEcosystem extensibility — stories about ecosystem extensibility in this arenaEcosystem extensibility2partial4/10C

Choose where my data is stored (region/residency) G

ai-native userPrivacy posture — data-handling and privacy storiesPrivacy posture2n/auntestednone yet

Control data retention and deletion G

ai-native userPrivacy posture — data-handling and privacy storiesPrivacy posture2n/auntestednone yet

Do everything through the API that I can do in the UI G

ai-native userOpenness — open source, data portability, and self-hosting storiesOpenness2n/auntestednone yet

Get machine-readable (JSON) output from core commands so an agent can parse results instead of scraping text G

Structured output

ai-native userAgent experience — stories about agent experience in this arenaAgent experience2noneuntestednone yet

Opt out of telemetry and usage tracking G

ai-native userPrivacy posture — data-handling and privacy storiesPrivacy posture2n/auntestednone yet

Read the product's source under an open license G

ai-native userOpenness — open source, data portability, and self-hosting storiesOpenness2noneuntestednone yet

Schedule recurring jobs or workflows G

ai-native userAutomation depth — how much of the product can run unattendedAutomation depth2n/auntestednone yet

See published benchmarks or measured numbers backing the manager's speed claims C

Benchmarks

developerPerformance caching — stories about performance caching in this arenaPerformance caching1partial6/10X

Have the right tool versions and environment variables activate automatically when I enter a project directory C

Environments

developerToolchain management — stories about toolchain management in this arenaToolchain management1partial4/10C

Point an agent at a documented, text-based lockfile format it can read and diff C

Structured output

ai-native userAgent experience — stories about agent experience in this arenaAgent experience1partial3/10C

Extend the manager through third-party taps, overlays, plugins, or backends C

Extensibility

developerEcosystem extensibility — stories about ecosystem extensibility in this arenaEcosystem extensibility1noneuntestednone yet

Version, review, and roll back my automations G

ai-native userAutomation depth — how much of the product can run unattendedAutomation depth1n/auntestednone yet

Opportunities — the stories that would move this product's scores, from its own judged verdictsOpportunitiestop 8 of 18 stories with headroom

What would move pnpm’s scores — derived from its own judged verdicts, biggest headroom first. Each line quotes what the judge found missing; shipping it (or evidencing it publicly) is the fix.

  1. Agenticness — how well agents can access and operate the productDrive the product through a documented public API

    nonemoves agent-readyimpact 45

    Missing: any documented public API (REST/SDK/programmatic), machine-readable API spec, or agent-facing interface beyond shell CLI invocation.

  2. Agenticness — how well agents can access and operate the productPoint an agent at llms.txt or agent-oriented docs

    nonemoves agent-readyimpact 30

    Direct probes show pnpm.io does not serve an llms.txt or markdown-formatted docs (404s), and no evidence pack item mentions agent-oriented documentation formats; the CLI docs page exists but is standard human-facing documentation, not an agent-discoverable format.

  3. Agenticness — how well agents can access and operate the productExplore an interactive API reference with runnable examples

    nonemoves API qualityimpact 30

    pnpm is a CLI package manager with static docs pages; there's no evidence of an interactive API reference with runnable examples, and probes for llms.txt, docs-md, and openapi specs all returned 404s, indicating no such interactive/machine-readable reference exists.

  4. Agenticness — how well agents can access and operate the productRely on versioned APIs with a documented deprecation policy

    nonemoves API qualityimpact 30

    No evidence pack item documents a formal API/CLI versioning scheme or deprecation policy for pnpm; the closest signals are community complaints about breaking changes (e.g., dropped corepack support) with no linked deprecation notice, and no changelog or semver policy is cited.

  5. Agent experience — stories about agent experience in this arenaGet machine-readable (JSON) output from core commands so an agent can parse results instead of scraping text

    nonemoves PA Scoreimpact 20

    No evidence in the pack mentions JSON output flags (e.g.

  6. Openness — open source, data portability, and self-hosting storiesRead the product's source under an open license

    nonemoves PA Scoreimpact 20

    pnpm is known to be open source (MIT licensed, hosted on GitHub), but the evidence pack contains no citation confirming a license or repository access — only a GitHub repo link with unrelated performance claims, no license mention.

  7. Agent experience — stories about agent experience in this arenaHave an agent install and update project dependencies non-interactively, with clear exit codes and errors when something fails

    partialq6/10moves PA Scoreimpact 12

    Missing: explicit exit-code documentation, structured/machine-readable error output, and independent verification that failures are clearly signaled in agent/CI pipelines.

  8. Performance caching — stories about performance caching in this arenaInstall prebuilt binary packages from a cache instead of compiling from source

    partialq6/10moves PA Scoreimpact 12

    Missing: explicit documentation of prebuilt/precompiled binary caching for native addons, independent benchmark isolating compile-skip behavior.

Showing the top 8 of 18 — every none/partial verdict in the story verdicts table is headroom.

Think a verdict is wrong? Every verdicts-table row has a Flag link — see the methodology.

Coverage map — which docs area, API section, or community source covers which judged storiesCoverage map9 surfaces · 26 covered stories

Where the cited evidence behind each covered verdict came from — the same citations the verdicts table shows, no extra judging.

pnpm.io18 stories

Hacker News17 stories

CLI docs15 stories

Continuous integration docs12 stories

Motivation docs5 stories

GitHub README3 stories

Settings docs3 stories

Pnpm CLI docs1 story

Workspaces docs1 story

Probe proofs — replayable recordings from the probe harnessProbe proofs

Replayable recordings from our probe harness — see the Prove-It protocol to submit one.

$pnpm --versionreproduced
$ pnpm --version
11.24.0
proves: Use an official CLIrecorded 2026-09-04
$mktemp -d && printf '{"dependencies":{"is-odd":"3.0.1"}}' > package.json && pnpm install --reporter=append-only && head -3 pnpm-lock.yamlreproduced
$ mktemp -d && printf '{"dependencies":{"is-odd":"3.0.1"}}' > package.json && pnpm install --reporter=append-only && head -3 pnpm-lock.yaml
Progress: resolved 1, reused 0, downloaded 0, added 0
Packages: +2

Packages are cloned from the content-addressable store to the virtual store.
  Content-addressable store is at: /Users/judegomila/Library/pnpm/store/v11
  Virtual store is at:             node_modules/.pnpm
Progress: resolved 2, reused 2, downloaded 0, added 2, done

dependencies:
+ is-odd 3.0.1

Done in 259ms using pnpm v11.24.0
lockfileVersion: '9.0'

settings:
proves: Have an agent install and update project dependencies non-interactively, with clear exit codes and errors when something failsproves: Install dependencies from a lockfile and get the exact same resolved versions on every machinerecorded 2026-09-04

Claims vs evidence — vendor claims reconciled against independent verdictsClaims vs evidence

7 of 12 testable claims verified · 0 contradicted → integrity 58/100

23 distinct capability claims found in pnpm’s own claimed-docs/GitHub materials, reconciled against our judge’s independent verdicts.

7

Verified

5

Unverified

0

Contradicted

14

Undersold

Verified (10)
Unverified (9)
Undersold (14)
Claims outside our story set (5)

Real capability claims found in pnpm’s own materials, but no story in this arena’s taxonomy covers them yet — that’s feedback on the taxonomy, not a mark against the product.

  • “Lets you patch a dependency's code with a persistent patch reapplied on every install”

    source ↗

  • “Only explicitly declared dependencies are accessible from node_modules, preventing phantom imports”

    source ↗

  • “Dry-run mode resolves dependencies and reports what an install would change without writing to disk”

    source ↗

  • “Supports per-workspace-package configuration settings, replacing per-project .npmrc files”

    source ↗

  • “Provides a `pnpm licenses list` command to inspect dependency licenses”

    source ↗
Suggest a story for these →

Business model

open-source

Free, MIT-licensed npm-compatible package manager maintained by Zoltan Kochan and contributors; funded by open-source sponsorships (Bit, Sanity, and others).

pricing ↗

Score trend

How this product’s scores have moved as evidence and verdicts are re-derived — a point per change, not per day.

PA Scoretracked since Sep 4 '26 — no movement recorded yet
Agent-readytracked since Sep 4 '26 — no movement recorded yet

Try Experimental

Run it in the microterminal →

Recorded agent sessions — and a live MCP handshake where the vendor ships one.

Flag

⚑ Flag a verdict

Think a verdict is wrong? Opens a prefilled GitHub issue — or use the ⚑ next to any verdict above.

Badge

Embed this product's score badge →

Hotlinked SVG — always shows the live current score.

For agents

This page as markdown/llms.txt

Data

Evidence (JSON)Verdicts (JSON)