Product

Overview

How it works Watch it work All 35 features Screenshots How ForgeRepo™ is secured

Keep bad packages out

Malware scanning Typosquat detection Dependency confusion protection Cooling off new releases Allow lists and block lists

When something goes wrong

Kill switch Who has it Lockdown and degraded modes Vulnerability monitoring

Developers and approvals

Requests and auto approve Check, walk and review Waivers Dry run
Formats

Languages

Private npm registry PyPI proxy and private index Private NuGet feed and proxy Maven repository proxy RubyGems mirror Composer and Packagist proxy

Apple, containers and Linux

CocoaPods CDN mirror Swift package registry Docker registry mirror RPM mirror for dnf and yum APT mirror for Debian and Ubuntu

Use it as

An npm firewall Artifacts, SBOMs and lifecycle More than one node SSO, roles and allow lists
Learn

Guides

Learn secure development Secure coding Secure pipelines Unsafe vs safe Security and development

Supply chain

Supply chain attacks, 2016 to 2026 Software supply chain security
Compare Side by side, all four ForgeRepo™ vs JFrog ForgeRepo™ vs Sonatype ForgeRepo™ vs Cloudsmith
Docs

Start

Getting started Download All documentation Questions

For developers

npm setup pip setup docker login Push a Docker image CI basics

For administrators

First setup Rules and their order Six incidents, walked through Backup and upgrade
Pricing Install it
  1. Home
  2. Pricing

Pricing

$0. Not a trial, not a tier.

One version, MIT licensed, with every feature in it. No seats, no nodes, no sales call and no license key.

ForgeRepo™

$0forever

  • All 35 features, including blocking before download
  • All eleven formats: npm, PyPI, images, NuGet, Maven and more
  • Unlimited users, tokens, nodes and downloads
  • Kill switch, cooling off, reserved names and malware scanning
  • SSO, roles, audit trail, SIEM and more than one node
  • Every update, and the source to read
Install it in two minutes Download

What you still pay for

  • A server. One Linux box with Docker, or one the installer sets up. About 2 GB of disk to start, and room for the cache to grow, or put it in S3 or Azure.
  • Your time. You run it, upgrade it and back it up. The installer is safe to run twice and upgrades are one command.
  • No support contract. There is nobody to call and no SLA. Full documentation, readable source, and an honest list of what it will not do.

What the others charge for the same job

Blocking bad packages before they are downloaded is what ForgeRepo™ does. Elsewhere it is a paid tier or an add-on. Prices from each vendor's own pages, read 18 September 2026; follow the links to check them.

JFrog Artifactory, Xray and Curation

  • Free editions: Artifactory OSS (AGPL, Maven, Gradle, Ivy, SBT, generic), JFrog Container Registry (Docker, Helm), and a C/C++ edition. None has npm, PyPI or Xray. Source
  • Cloud Pro: $150 a month list price, 25 GB of storage and transfer included. No Xray. Source
  • Cloud Enterprise X: From $950 a month, 125 GB included, adds SAML, SCIM and 24/7 SLA support. Source
  • Self hosted Pro X: From $27,000 a year, one server, includes Xray. Source
  • Self hosted Enterprise X: From $51,000 a year, three servers, includes HA. Source
  • Curation: Paid add-on for Enterprise X and Enterprise+. Self hosted it also needs Xray and the JFrog Catalog service. Source
ForgeRepo™ vs JFrog

Sonatype Nexus Repository and Repository Firewall

  • Nexus Community Edition: Free under a Sonatype EULA, with a cap of 40,000 components or 100,000 requests a day. No blocking. Source
  • Nexus Repository Pro, cloud: From $1,950 a year plus consumption at $1.10 a GB up to 1 TB. Source
  • Nexus Repository Pro, self hosted: From $7,500 a year, including 50,000 components and 15 million requests a month. Source
  • Repository Firewall Pro: $4,800 a year. SaaS, npm, Maven, PyPI and NuGet, allow or block only, no quarantine or review state. Source
  • Repository Firewall: Priced on request. Cloud or self hosted, air gapped and HA available. Source
ForgeRepo™ vs Sonatype

Cloudsmith

  • Core: $0, 500 MB of storage and 1 GB of delivery. No security policies. (From search results of the pricing page, which refused our requests.) Source
  • Pro: $149 a month, 5 GB of storage and 25 GB of delivery. (Same source, and matches a third party write up.) Source
  • Ultra and Enterprise: Priced on request. This is where vulnerability, license, deny and malware policies are. Source
  • Policy as code: Paid add-on on Ultra and Enterprise. Needed for the cooldown policy. Source
ForgeRepo™ vs Cloudsmith

Price is not everything. The commercial products cover more formats, employ malware researchers and answer the phone. The full comparison scores all four, row by row, and we come third.

Questions about the price

1Is it really free, or is this a trial?

It is really free. There is one version, it is MIT licensed, and nothing is held back for a paid tier. There is no account to create and no license key.

2Are there limits on users, nodes or downloads?

No. Run as many nodes, users, tokens and downloads as your hardware takes. The only limits are your server and your disk.

3What does it cost to run?

A Linux server you already have or rent, and its disk. It runs as one container. ClamAV, if you turn it on, wants about 1 GB of memory of its own.

4Can I buy support?

No. There is no support contract and no SLA. There is full documentation and readable source. If you need someone to call at three in the morning, one of the commercial products is the better choice, and the comparison says so.

5What if the project changes its license later?

The MIT license on the version you download cannot be taken back. You keep the right to run, change and share that code forever.

Free is easier to check than to explain

Run the installer on a spare server and see every feature on this page for yourself. About two minutes, nothing to sign up for.

Getting started Read the docs