MLX (mlx-lm)
Version in force mlx-lm 0.31.3 (mlx 0.32.1)2026-04-22 (mlx-lm) / 2026-08-18 (mlx)Tree audited mlx-lm tag v0.31.3 (lo que instala pip) y rama main del 2026-08-25; mlx 0.32.1Licence MIT
For anyone with an Apple Silicon Mac who wants maximum native performance and does not mind Python.
Apple’s array framework for Apple Silicon, plus the mlx-lm layer that turns it into a language-model runtime. They are two different packages: mlx is the maths framework, like NumPy or PyTorch, and mlx-lm is what actually runs models. It exploits unified memory: CPU and GPU share the same pool with no copying.
Steps to the first token
Vendor declared
Hosts it contacts out of the box
Measured by Local AI Scope
Licence
Measured by Local AI Scope
How we checked this
Everything this sheet says about the network comes from reading the published source code and the official documentation on the date shown — not from watching the traffic. We have not run the program with a network analyser in front of it, so this is static analysis, not observation. A real capture is still pending; the day we have one, these cells move up a level of evidence. We would rather say that than let you assume we sniffed the wire.
What leaves your machine
The four questions a local runtime has to answer before it deserves your documents: what it sends on its own, who else it calls, on which address it listens, and whether you can check any of it yourself.
Telemetry out of the box
None of its own — it inherits the download library’s. Verified by us in the primary source
We swept the whole mlx_lm package, both the main branch and the published 0.31.3, looking for telemetry, analytics, posthog, sentry, mixpanel and usage stats: zero matches in both. Same in the mlx framework. But mlx-lm downloads through huggingface_hub, and that library does collect data by default. This is the transferable finding of the whole comparison: the telemetry is not put there by the runtime, it is put there by the download library. A detail that says a lot: mlx-lm does not identify itself to Hugging Face at all, so its user-agent header literally starts with «unknown/None».
«By default, some data is collected by HF libraries (transformers, datasets, gradio,..) to monitor usage […]. You can set HF_HUB_DISABLE_TELEMETRY=1 as environment variable to globally disable telemetry.»
How to switch it off: HF_HUB_DISABLE_TELEMETRY=1, or the cross-vendor DO_NOT_TRACK=1. For a fully offline run, HF_HUB_OFFLINE=1 — Hugging Face’s own documentation warns that even when the model is already cached, an HTTP request is made to check whether the file has a newer version.
Source · consulted 2026-08-25
Other calls home
| What | Where to | When | Can you avoid it | Evidence |
|---|---|---|---|---|
| Model download | huggingface.co (or modelscope with MLXLM_USE_MODELSCOPE) |
When you ask for a model that is not cached, and to check whether cached ones have a newer version. | HF_HUB_OFFLINE=1 | verified by us |
| Calibration file for quantising | a GitHub gist |
Once only, and only if you quantise with AWQ, DWQ or GPTQ. | Do not use those methods | verified by us |
Source · consulted 2026-08-25
Which address it listens on
| Setting | Out of the box |
|---|---|
| Listens on | 127.0.0.1:8080 |
| Authentication out of the box | none |
| CORS out of the box | Wide open: any origin, any method, any header |
It listens on localhost, but with CORS wide open — any origin, any method, any header — and with no authentication anywhere: its own examples say api_key=”not-needed”. The server is built on Python’s standard library, not a production server, and the documentation says as much. One citable detail: that documentation file does not ship inside the PyPI package, so whoever installs with pip never sees the warning unless they go to the repository. Verified by us in the primary source
«The MLX LM server is not recommended for production as it only implements basic security checks.»
Source · consulted 2026-08-25
Can this be audited?
Yes. MIT, Apple Inc., both mlx and mlx-lm. That is what lets us say «no telemetry of its own» as a checked absence rather than a claim — and, more importantly, what lets us say that its device types are exactly two. Verified by us in the primary source
Source · consulted 2026-08-25
Privacy policy
There is no privacy policy, and here that is not a gap: there is no service behind the program and no data controller to demand one from. not verified
What it runs, and where
Platforms, accelerators and model formats — the three walls you hit on the first evening, and the ones nobody writes down until you have hit them.
Where it runs
| Platform | Support | Evidence |
|---|---|---|
| Windows | Partial and undocumented. The mlx framework has published official Windows wheels (x64 and ARM64) since July 2026 and tests them in CI, but its documentation never mentions Windows, and mlx-lm declares its dependency for macOS only — so outside macOS `pip install mlx-lm` does not install the engine. Whether mlx-lm works on Windows is not verified. | verified by us |
| macOS Apple Silicon | Yes, this is its platform. macOS 14.0 or newer to install; some large-model features need macOS 15. | verified by us |
| macOS Intel | No. All the macOS wheels are arm64; there is no x86_64 one. Watch out for running Python under Rosetta — their own guide warns about it. | verified by us |
| Linux | Yes for the mlx framework, which has a CUDA backend and a CPU-only build. Whether mlx-lm works well there we have not verified: its README only talks about Apple Silicon. | vendor declared |
What it accelerates
| Backend | Status | Evidence |
|---|---|---|
| Metal | Yes — the native path on Apple Silicon, with unified memory: CPU and GPU share one pool without copying data between them. | vendor declared |
| CUDA | Yes, in the mlx framework on Linux, requiring NVIDIA architecture SM 7.5 or higher. | vendor declared |
| CPU | Yes. It is one of the only two device types that exist in MLX. | verified by us |
| ROCm | We could not verify this. Their installation documentation only offers Apple Silicon, CUDA and CPU — but nowhere do they state that AMD is unsupported, so we report the absence rather than a «no». | not verified |
| Vulkan | We could not verify this. It does not appear in the documentation or in the backend tree, and there is no statement either way. | not verified |
| Neural Engine | No, and this one is a verified absence rather than a missing source: the device-type enumeration in the code has exactly two values, cpu and gpu, and the public documentation says so too. A lot of people assume MLX uses the Neural Engine. It does not. | verified by us |
«Currently supported device types are the CPU and GPU.»
Model formats it runs
MLX format and Hugging Face safetensors. It cannot run a GGUF. It only knows how to export to GGUF after merging an adapter, and even then only for Mistral, Mixtral and Llama-style models in fp16. verified by us
Source · consulted 2026-08-25
Installing it, and living with it
How many steps to the first token, what it leaves on your disk, under which licence and at what pace it changes under you.
Steps to the first token
2 steps. Install the package and run mlx_lm.generate or mlx_lm.chat: it downloads the default model and answers. vendor declared
What it writes to your disk
| What | Where | Evidence |
|---|---|---|
| Models — the Hugging Face cache | ~/.cache/huggingface/hub — the Hugging Face cache (HF_HOME · HF_HUB_CACHE) |
vendor declared |
| Chat history — not saved at all. The context lives in memory and is lost when you quit. It is the only one of the five that leaves no trace of your conversations on disk | Nowhere — nothing is written | verified by us |
| Quantisation calibration file — only created if you quantise with AWQ, DWQ or GPTQ | ~/.cache/mlx-lm/ |
verified by us |
Licence
MIT, Apple Inc. Both the framework and mlx-lm. verified by us
Source · consulted 2026-08-25
Version and release pace
Historically one release every one to three weeks, but publishing has been stopped since 22 April 2026 even though development continues daily. The mlx framework does publish: around sixteen releases a year. verified by us
Source · consulted 2026-08-25
What to know before you install it
- The package people actually install has been frozen for four months. `pip install mlx-lm` gives you version 0.31.3 of 22 April 2026, while the repository takes commits daily and its version file already reads 0.32.0. Models added since April are only there if you install from the repository. There is no primary announcement explaining why: we state the fact, not the reason.
- MLX does not use the Neural Engine. The device types that exist in its code are exactly two: CPU and GPU.
- It does not run GGUF. If your model collection is GGUF, MLX is no use to you without reconverting it.
- The server listens on localhost but with CORS wide open and no authentication at all, and its own documentation says it is not for production. That warning does not travel inside the PyPI package.
- It is the only one of the five that does not keep conversations on disk.