Dependably
A private package registry that verifies every package before it reaches your build.
Dependably sits between your developers and the public package registries. It caches every package your team pulls, verifies its checksum before storing it, and keeps a full audit trail. The same build works tomorrow even if a package disappears from the internet, and nothing enters your codebase unnoticed.
It speaks the native protocol of each tool you already use. Point npm, pip,
NuGet, Maven, Cargo, go, Terraform, mix, docker, or dnf at your
Dependably URL and they work as before; the only difference is that they talk to
your registry instead of the public one.
What it does
- Each ecosystem gets its own URL on a single self-hosted instance. The table below lists the guides.
- Supply-chain controls sit on top of the cache: first-fetch detection, allowlists, and policy gates for vulnerabilities, malware, deprecation, and unsigned artefacts.
- It runs on your own infrastructure as a container (or a single self-contained binary), with no cloud account, no per-seat licence, and no external services required.
Supported ecosystems
| Tool | Use it for | Guide |
|---|---|---|
| npm / yarn / pnpm | JavaScript & Node.js packages | npm |
| pip / uv | Python packages (PyPI) | PyPI |
| dotnet | C# / .NET packages (NuGet) | NuGet |
| Maven / Gradle | Java & JVM artefacts | Maven |
| cargo | Rust crates | Cargo |
| go | Go modules | Go |
| terraform | Terraform providers | Terraform |
| mix / rebar3 | Elixir & Erlang packages (Hex) | Hex |
| docker / podman | Container images (OCI) | Docker |
| dnf / yum | RPM packages (Linux) | RPM |
Getting started
Every guide needs the same information about your instance. Start here to gather it once, then jump to the guide for your tool:
Developer package managers npm · PyPI · NuGet · Maven · Cargo · Go · Terraform · Hex
Containers & system packages Docker · RPM
The web UI
Dependably has a built-in web console. Open your base URL in a browser to browse packages, check a package before you add it, see which versions carry advisories, create the token your tools need, and copy a ready-made configuration for your package manager. See The web UI for a tour of every page: Overview · Packages · Projects · Lookup · Vulnerabilities · Risk · Policies · Tokens · Setup · Profile
Admins and owners also have Quarantine, and the Audit log is open to admins, owners, and auditors.
Running Dependably
If you operate the instance or administer an organization, see Administration: Configuration · Access control (RBAC) · Users & tokens · Settings · Authentication · Upstreams
Integrations
Connect Dependably to your existing monitoring stack. Metrics are published in Prometheus format, and a ready-made Grafana dashboard shows request rate, tracked advisories, critical findings, supply-chain blocks, and registry storage at a glance. Structured logs go to stdout for your aggregator to pick up; see Log output. SIEM and SOC integration covers feeding security events to a SIEM, and an AI assistant can query the registry through the read-only MCP server. Integrations is the overview.
Reference
- Glossary defines PURL, CVSS, EPSS, KEV, OSV, SPDX, and the other terms used across the UI and the supply-chain gates.
- Blocked packages explains what a
403from your package manager means, and which policy produced it.