MLX LM is a Python package for generating text with large language models and fine-tuning them on Apple Silicon, built on MLX, Apple's machine learning framework. One command downloads a model from Hugging Face and generates text or opens a chat; thousands of ready-converted models are in the mlx-community organisation, and any supported model can be converted and quantised to 4 or 8 bits yourself.
It is the reference way to use MLX for language models. Beyond generation it does LoRA and full fine-tuning, including on quantised models, prompt caching for long contexts, a rotating key-value cache to cap memory, distributed inference across several Macs, and an OpenAI-style HTTP server. Apps such as LM Studio use MLX for their Mac engine, and mlx-lm is where new model architectures land first.
It is MIT-licensed, with about 7,500 stars and 262 contributors, at v0.32.2 when scanned. The included server is, in the project's own words, not recommended for production because it only implements basic security checks.
- Repository: github.com/ml-explore/mlx-lm
- Licence: MIT (MIT License)
- Language: Python. Stars: 7,476. Forks: 1,156. Last push: Oct 24, 2026.
- Scan: safe, Oct 26, 2026, commit 4cfc647
Who it is for
Mac users with an M-series chip who want to run or fine-tune open models locally from Python or the terminal, and developers who want the speed of MLX without a GUI app on top.
Getting started
1. Install with pip (Homebrew and conda-forge also carry it)
pip install mlx-lm2. Chat with the default model
mlx_lm.chat3. Generate with a model of your choice
mlx_lm.generate --model mlx-community/Mistral-7B-Instruct-v0.3-4bit --prompt "How tall is Mt Everest?"The default model is mlx-community/Llama-3.2-3B-Instruct-4bit, downloaded from Hugging Face on first use. For an OpenAI-style API, run mlx_lm.server --model followed by a model name, and keep it on localhost.
Safety scan
We cloned ml-explore/mlx-lm at commit 4cfc647 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no install hooks and no committed binaries across 264 files and about 77,000 lines of Python.
- Models download from huggingface.co on first use. The --trust-remote-code flag, which runs Python code shipped with a model's tokenizer, is off by default in generate, chat and server; the benchmark command always enables it for the tokenizer, so only benchmark models from sources you trust.
- There is no lockfile: dependencies such as mlx and transformers are version ranges that pip resolves at install time, so the scanner had nothing to check for advisories.
- 3 workflows. update_bypass_list.yml uses pull_request_target when a pull request closes, but checks out the base branch and runs the maintainers' own script to update contributor permissions, never pull request code. The 3 third-party actions are not pinned to commits. Licence, contributing guide and code of conduct present; no security policy or Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 3 workflows. 1 uses pull_request_target, none check out the pull request head. 3 of 3 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 9 distinct hosts referenced from source; most often github.com, huggingface.co, api.github.com, arxiv.org. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Workflows worth a look
- .github/workflows/update_bypass_list.yml: pull_request_target
By the numbers
| Stars | 7,476 |
|---|---|
| Forks | 1,156 |
| Contributors | 262 |
| Commits | 992 |
| Open issues | 156 |
| Open pull requests | 93 |
| Releases | 31 |
| Latest release | v0.32.2 |
| Licence | MIT |
| Main language | Python |
| Project age | 1 year |
| Last push | Oct 24, 2026 |
| Tracked files | 264 |
| Lines of code | 77.5K |
| Checkout size | 3 MB |
Lines by language: Python 75.2K, Markdown 1,513, JavaScript 383, YAML 247, TOML 86.
Questions
Is MLX LM free?
Yes. MLX LM is free and open source under the MIT licence, from Apple's ml-explore team. The models it downloads each have their own licences, set by their publishers.
Does MLX LM work on Intel Macs or Windows?
It is built for Apple Silicon, the M-series chips, where MLX uses the unified memory and GPU. On other machines, llama.cpp or Ollama are the usual choices.
What is the difference between MLX LM and Ollama?
Ollama is a background service with a model registry and an API, built on llama.cpp and GGUF files. MLX LM is a Python library and set of commands built on Apple's MLX, often faster on Macs, and it adds fine-tuning and model conversion, with less of the convenience.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.