Skip to the main content

Product

Overview

How it works Watch it work All 35 features Screenshots How ForgeRepo™ is secured

Keep bad packages out

Malware scanning Typosquat detection Dependency confusion protection Cooling off new releases Allow lists and block lists

When something goes wrong

Kill switch Who has it Lockdown and degraded modes Vulnerability monitoring

Developers and approvals

Requests and auto approve Check, walk and review Waivers Dry run

Formats

Languages

Private npm registry PyPI proxy and private index Private NuGet feed and proxy Maven repository proxy RubyGems mirror Composer and Packagist proxy

Apple, containers and Linux

CocoaPods CDN mirror Swift package registry Docker registry mirror RPM mirror for dnf and yum APT mirror for Debian and Ubuntu

Use it as

An npm firewall Artifacts, SBOMs and lifecycle More than one node SSO, roles and allow lists

Learn

Guides

Learn secure development Secure coding Secure pipelines Unsafe vs safe Security and development

Supply chain

Supply chain attacks, 2016 to 2026 Software supply chain security

Compare

Side by side, all four ForgeRepo™ vs JFrog ForgeRepo™ vs Sonatype ForgeRepo™ vs Cloudsmith

Docs

Start

Getting started Download All documentation Questions

For developers

npm setup pip setup docker login Push a Docker image CI basics

For administrators

First setup Rules and their order Six incidents, walked through Backup and upgrade

Pricing Install it

Screenshots

Every screen, nothing mocked up

34 captures of ForgeRepo™ 1.0.0, taken with a headless browser against a seeded demo registry. Click any of them to see it full size, and use the arrow keys to move through them.

Security at a glance Packages and rules Developers and approvals Watching and investigating Settings and access

Or let it show you around

The same screens, in the order a developer meets them.

https://packages.company.internal/_admin/

Step 1

A developer's first ten minutes

A guided walkthrough built from real screenshots, not recorded video. Use the arrows, or the left and right keys, to go at your own pace.

Security at a glance

The dashboard. Registry mode, auto approve, and cards for what needs a look.

Dashboard cards: vulnerable, malicious, license violations, risky packages in use, integrity alerts, waivers and bandwidth.

The kill switch. One package, some versions, a file hash, an advisory, or a CSV of hundreds.

Vulnerabilities, with the developer switches: answer npm audit, warn during the install, record who downloaded what.

Quarantine. Every held file, why, and release or reject.

Waivers. Time boxed exceptions, scoped to an application or environment, with a ticket.

Packages and rules

Adding a rule: type, pattern, allow or deny, version range, priority, application and environment.

The version ranges a rule understands, the same ones npm does.

Packages. Everything asked for, what the rules say, and what is cached.

Artifacts. npm tarballs, Python wheels and image layers, each stored once by SHA-256.

Dry run. A proposed deny rule replayed against 30 days of real downloads.

Import and export. Rules as JSON or CSV, or the whole config, with a try it first button.

Developers and approvals

Requests as an approver sees them, each already scanned, with approve, block, clear and check deps.

A developer asking for a package, with the state of everything they asked for.

Check a package. What the rules say about a name and version before anybody installs it.

The dependency tree of axios: 29 packages, every one of them judged.

Reviewing a package-lock.json against the rules and the advisory feed.

Tokens. Name, expiry and a contact address for shared build tokens.

A new token, shown once, with the npm, pip and docker commands to use it.

The documentation built into the portal, written for the reader's role.

Watching and investigating

Traffic. Every request, with the token, application and environment, and a why link on each line.

Consumers. Who took a package, a version, a file or an advisory.

The audit trail. Who, from where, what, and whether it worked, failed or was refused.

Utilization. Live gauges for CPU, memory, disk and network, and trends you can zoom.

Settings and access

The sign in page. Local accounts, or single sign on with OpenID Connect.

Settings, Policy: whitelist or blacklist, audit only, quarantine, safe version resolution and cooling off.

Settings, Registries: package types, which clients to answer, and the upstream registries.

Settings, Malware: scanners, what each verdict does, and scan before serving.

Settings, Licenses: allowed, needs review and blocked, in SPDX.

Settings, Storage: local disk or an S3 or Azure bucket.

Settings, SSO: OpenID Connect against Okta, Entra ID, Google or Keycloak.

Users and their roles.

Whitelists: which networks may reach the portal and the registry, and break glass keys.

Integrations: a signed SIEM webhook and its deliveries.

Seen enough to try it?

A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.

Getting started Read the docs