Artifact Keeper serves as a self-hosted universal software artifact repository that consolidates container images, application libraries, and infrastructure bundles under a unified management control plane. Software development teams can publish and resolve dependencies using their existing build tools, including Docker, Helm, npm, PyPI, Maven, Cargo, NuGet, and Terraform without installing proprietary client plugins. Remote repositories act as transparent pull-through caching proxies for public upstreams like Docker Hub and PyPI, accelerating internal CI/CD build speeds while insulating production pipelines from external registry outages. Virtual repositories combine multiple local, remote, and third-party endpoints into single URLs, resolving packages across prioritized internal teams and public registries automatically. Automated security scanners evaluate incoming packages for Common Vulnerabilities and Exposures using Trivy and Grype engines, assigning letter grades and enforcing quarantine policies to block vulnerable binaries before production release. Administrators can sign package metadata with cryptographic GPG keys, configure peer mesh replication across geographic regions, and manage team permissions using OpenID Connect, SAML, and granular access tokens. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Trusted by millions of developers and integrated into CI/CD pipelines at organizations worldwide, Sonatype Nexus Repository is the industry-standard binary artifact repository manager that stores, organizes, and distributes software components across every major package ecosystem. Community Edition supports over 20 formats including Maven for Java builds, npm for JavaScript packages, Docker for container images, PyPI for Python libraries, NuGet for .NET assemblies, Helm for Kubernetes charts, Go modules, RubyGems, Cargo for Rust crates, Conda for data science environments, APT for Debian packages, Yum for RPM distributions, and Hugging Face for AI/ML models. Three repository types serve different needs: hosted repositories store internally-produced artifacts, proxy repositories cache remote registries like Maven Central, npmjs.org, and Docker Hub reducing bandwidth and improving build reliability, and group repositories aggregate multiple hosted and proxy repositories behind a single URL endpoint. The web UI provides component browsing and search, repository configuration, blob store management with configurable cleanup policies, and direct artifact upload via drag-and-drop. Role-based access control enforces fine-grained permissions per repository with configurable security realms, while the comprehensive REST API enables automated repository provisioning, component management, and integration with Jenkins, GitHub Actions, GitLab CI, and Azure DevOps. External PostgreSQL database support enables Kubernetes deployments with improved backup, restore, and horizontal scaling capabilities. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Eclipse Public License 1.0 licensed.

Private npm packages without shipping code to the public registry or paying for npm Enterprise: Verdaccio is the standard lightweight, zero-config private registry and caching proxy. It runs as a single Node.js process with its own tiny embedded database; no external database is required to start. Point npm, yarn, or pnpm at it and everything behaves as expected: install, publish, unpublish, dist-tags, and deprecation all work against the standard npm endpoints. The uplink system is where it earns its keep: packages not found locally are fetched from configured upstreams (npmjs.org, yarn, JFrog, Nexus, or another Verdaccio), cached as tarballs, and served locally thereafter - cutting CI latency and surviving registry outages. Multiple uplinks chain for failover, and per-package glob patterns in config.yaml route scopes to specific upstreams while controlling access, publish, and unpublish rights per group. You can even override a public package by publishing a patched version under the same name locally. A plugin architecture swaps in auth backends (htpasswd default, LDAP and others available), storage drivers (S3, Google Cloud Storage), middleware routes, and metadata filters. With official Docker images and a Kubernetes Helm chart, it slots into any pipeline in minutes.

Instead of querying a private registry with curl and its HTTP API, open Docker Registry UI and click through repositories, tags, digests, and layers in a browser. The catalog groups images by namespace, shows tag counts, and filters as you type in the search bar, which Ctrl+F or F3 focuses. Each repository's tag list shows creation date, size, content digest, and CPU architecture, sorts numerically, and copies a ready-made pull reference with one click. A history page expands any tag into its operating system, entrypoint, environment variables, exposed ports, and layer-by-layer build steps, and a Dockerfile view reconstructs the file from those steps. The same view also covers multi-architecture images and OCI Helm exports. When the registry allows deletion, tags go one at a time or in bulk with checkboxes, Alt+Click for a whole page, and Shift+Click for a range. One interface can switch between several registries from its menu, or be locked to a single registry with your own title. Basic authentication passes through the browser, and a built-in proxy option forwards requests to your registry container so CORS needs no configuration. Light, dark, and automatic themes come with color variables for custom branding, and a weekly notice announces newer releases. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

The first container registry to reach CNCF graduated status with over 29,000 GitHub stars since VMware open-sourced it in 2016, Harbor transforms the basic Docker Distribution into a hardened enterprise registry with vulnerability scanning, supply chain signing, multi-datacenter replication, and project-level access control out of the box. Trivy scans every pushed image against the NVD, GitHub Advisory Database, and distribution-specific vulnerability feeds, with scan-on-push policies that block deployment of images exceeding configurable severity thresholds. Artifact signing through Cosign keyless signatures and Notation enforces content trust policies ensuring only cryptographically verified images reach production clusters. Policy-based replication synchronizes images and Helm charts between Harbor instances across multiple datacenters using repository, tag, and label filters with automatic retry and bandwidth throttling — enabling hybrid-cloud and disaster-recovery topologies. The RBAC model isolates projects with per-project quotas, robot accounts for CI/CD automation, webhook notifications, and audit logging that tracks every pull, push, delete, and configuration change. LDAP, Active Directory, and OIDC authentication integrate with existing identity providers, while the proxy cache transparently caches images from Docker Hub, Quay, and other upstream registries to reduce pull latency and rate-limit exposure. The RESTful API with embedded Swagger UI, tag retention policies, garbage collection scheduling, and immutable artifact rules complete the lifecycle management. Deploy via Docker Compose or Helm Chart on Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Used by over 100,000 organizations and ranked first in the Gartner Magic Quadrant for DevOps Platforms, GitLab is the open-core DevSecOps platform that delivers the complete software development lifecycle — from planning and source code management through CI/CD, security scanning, and monitoring — in a single self-managed application. The built-in CI/CD engine executes pipelines defined in YAML with parallel jobs, directed acyclic graph scheduling, multi-project pipelines, and auto-scaling runners on Docker, Kubernetes, or bare metal. Merge requests provide inline code review with approval rules, code owners, merge trains for serialized merging, and five merge strategies including fast-forward and semi-linear history. The integrated container registry stores Docker images alongside code, while the package registry supports npm, Maven, NuGet, PyPI, Conan, Go, and generic packages. Issue boards with epics, milestones, and labels enable agile planning, while the built-in wiki and GitLab Pages provide documentation hosting and static site publishing. Security scanning in the Community Edition includes basic SAST, secret detection, and container scanning running as pipeline jobs. The Omnibus installer bundles Rails, Puma, Gitaly, Workhorse, Nginx, PostgreSQL, Redis, Sidekiq, and Prometheus into a single package installable in minutes, while Docker and Helm chart options support containerized and Kubernetes deployments. GitLab Duo AI assists with code suggestions, merge request summaries, and vulnerability resolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 15,100 GitHub stars and seven years of battle-tested production use, OneDev replaces entire DevOps toolchains — GitLab, Jenkins, Jira, Artifactory — with a single Java application that runs comfortably on a 1-core 2GB server for medium-sized projects. The platform unifies Git hosting with ANTLR-powered language-aware code search and symbol navigation, pull request workflows with configurable branch protection rules and required reviewers, and customizable issue tracking with scripted state transitions that automatically advance issues when code is committed, builds pass, or deployments complete. The GUI-based CI/CD editor creates pipelines without writing YAML, supporting typed parameters, matrix builds, job templates, cache management, and artifact publishing in a single visual interface. Jobs execute via Docker containers, bare metal shell, Kubernetes pods, or distributed agent pools, with web terminal access for live debugging and the ability to pause running jobs for inspection. Built-in package registries handle Docker images, npm packages, Maven artifacts, NuGet libraries, PyPI wheels, and RubyGems without external infrastructure. AI users can be assigned to issues and pull requests to autonomously implement features, review code, fix CI/CD failures, and resolve merge conflicts. The automated Kanban board supports rule-based card movement, time tracking, timesheets, and service desk ticket creation via email. Cluster deployment enables project replication across servers for high availability and horizontal distribution for scalability. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Governed by the non-profit Codeberg e.V. with over 150 contributors and quarterly major releases reaching v16.0 in July 2026, Forgejo delivers a complete code collaboration platform in a single Go binary that runs comfortably on 512 MB of RAM — providing full Git hosting with SSH and HTTPS, pull requests with inline code review, issue tracking with labels and milestones, kanban project boards, wikis, and an integrated package registry supporting Docker, npm, PyPI, Maven, NuGet, and Cargo. Forgejo Actions provides GitHub Actions-compatible CI/CD with reusable workflows, OpenID Connect for secure third-party access, ephemeral runners for autoscaling, and dynamic matrix support for complex build pipelines. The platform implements ActivityPub-based forge federation allowing issues, pull requests, and stars to work across independent instances — enabling a decentralized development ecosystem similar to how Mastodon federates social networks. Organizations and team permissions provide fine-grained access control, while LDAP, OAuth2, and OpenID authentication integrate with existing identity infrastructure. Code search indexes repositories for fast discovery, LFS handles large files efficiently, and mirror synchronization imports repositories from GitHub, GitLab, and other forges. Deploy via a single static binary, Docker container, or official Helm charts with SQLite for small instances or PostgreSQL and MySQL for production workloads. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPLv3+ licensed.

With over 57,000 GitHub stars and deployment across thousands of organizations worldwide, Gitea is the most popular self-hosted Git service, delivering a complete software development platform in a single Go binary that runs on as little as 512MB of RAM. The platform provides full repository management with pull requests featuring inline code review, branch protection rules, merge strategies including squash, rebase, and merge commit, and automated status checks through Gitea Actions. The built-in CI/CD system uses the same YAML workflow syntax as GitHub Actions and can directly reuse over 20,000 existing Actions plugins, allowing teams to migrate from GitHub with minimal pipeline rewrites using the open-source act_runner executor. The integrated package registry supports over 20 formats including npm, PyPI, Maven, NuGet, Cargo, Helm, Composer, Conda, RubyGems, Pub, and an OCI-compatible Container registry for Docker images with no additional configuration required. Project management features include issue tracking with labels, milestones, dependencies, and time tracking, alongside kanban project boards for visual workflow management. Gitea supports LFS for large file storage, built-in wiki pages per repository, webhook integrations with Slack, Discord, Telegram, Microsoft Teams, and custom HTTP endpoints, and OAuth2 authentication with LDAP, SAML, and PAM backend support. Repository mirroring enables bidirectional synchronization with GitHub, GitLab, and Bitbucket, while the comprehensive REST and GraphQL APIs power external integrations and the official tea CLI tool. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

To pull a team's skills, MCP servers, hooks, prompts, and agent files out of scattered Git repositories, Observal keeps them in one reviewed registry and traces real sessions to show which ones help. Build an agent visually, with a live config preview for every harness. Submissions wait in an admin review queue, where reviewers inspect side-by-side version diffs before approving a release. Teamspaces give each team its own namespace, and approved releases can be forked into independent drafts. One pull command then writes the right config for Claude Code, Cursor, Kiro, Codex, Copilot, Pi, OpenCode, Antigravity, or Goose. Every approved resource is discoverable through the open Agentic Resource Discovery standard, and a running agent can hand part of its task to another approved agent or a remote Agent2Agent service. Hooks record each session as a trace of prompts, tool calls, MCP round trips, tokens, and errors, with turn-by-turn replay for debugging and audits. Insight reports, generated through providers such as Anthropic, OpenAI, or Ollama, list what is working, what is hindering, and quick wins. A dashboard follows adoption, cost, and department usage, a leaderboard ranks agents by downloads, and audit logs, SAML single sign-on, and SCIM provisioning are included. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

One endpoint for every MCP server you run: MCPHub gathers local and remote Model Context Protocol servers behind stable URLs, so AI clients connect once and see what you allow. Claude Code, Cursor, and Cherry Studio can use four routes: everything at /mcp, a named group at /mcp/{group}, one server at /mcp/{server}, or semantic tool search at /mcp/$smart. Smart routing runs vector search on PostgreSQL with pgvector and an OpenAI-compatible key, so the model gets a shorter tool list. Servers attach over stdio, SSE, or streamable HTTP, OpenAPI services can be wrapped as MCP tools, and changes apply without downtime. In the other direction, MCP tools can be exported as an OpenAPI 3.0.3 spec for OpenWebUI and other OpenAPI clients. Bearer keys, OAuth 2.0 (client and server modes), and GitHub or Google sign-in in database mode control access, with per-user visibility for servers and groups. Encrypted per-user credentials let one shared server use each person's own key. Logs show tool-call activity, request status, and latency, health checks track each connection, and the dashboard controls which tools, prompts, and resources each server exposes. Large text tool results can be compressed, interactive MCP Apps are proxied through MCPHub routes, and a built-in market lets you browse a server catalog. Typical uses include a team-wide gateway, per-project groups, and direct single-server routes for debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

ToolHive is an open-source MCP server management platform that lets you run, secure, and orchestrate Model Context Protocol servers in isolated containers, giving AI agents structured access to tools like GitHub, databases, and cloud services without exposing host credentials or network. Every server launches inside its own sandboxed container with a minimal permission file, network access filtering, and encrypted secrets management, preventing misbehaving connectors from reaching beyond their defined scope. The built-in registry provides a catalog of vetted servers you can install with one command, while custom images and package-manager references let you onboard proprietary connectors without writing Dockerfiles. Platform teams deploy the Kubernetes operator to declare MCP servers as cluster resources using Custom Resource Definitions, with automated lifecycle management and multi-namespace isolation. The Virtual MCP Server gateway aggregates multiple backends behind a single endpoint, centralizing OIDC authentication, tool filtering, and composite cross-server workflows so clients connect once instead of juggling separate URLs. An MCP Optimizer analyzes tool schemas via semantic search and surfaces only relevant tools per request, cutting token consumption by up to 85%. OpenTelemetry traces and Prometheus metrics deliver full visibility into tool execution, latency, and request audit trails across every managed server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 5,000 GitHub stars since its June 2026 launch, OOMOL OpenConnector bridges the gap between AI agents and the real world by handling the authentication nightmare that stops LLMs from calling external APIs safely. The runtime connects to more than 1,000 SaaS providers — GitHub, Gmail, Notion, Slack, Microsoft, HubSpot, Google Workspace, and hundreds more — through 10,000+ prebuilt typed Actions that agents can discover and execute without ever touching raw credentials. OAuth2 flows, API key rotation, custom credentials, and no-auth providers are all managed centrally with AES-encrypted storage, scoped runtime tokens, and configurable action allowlists and blocklists that enforce least-privilege access. Agents interact through five access surfaces: the Model Context Protocol endpoint at /mcp for Claude and other MCP-capable hosts, a full REST API at /v1 for programmatic control, an auto-generated OpenAPI specification for code generation, a TypeScript SDK for application integration, and the oo CLI for local agent relay. The built-in Web Console provides browser-based administration for configuring OAuth apps, managing connections, inspecting action schemas, and reviewing execution logs with redacted inputs. Deploy via Docker Compose with SQLite for single-server setups, run from source on Node.js 22+, or push to Cloudflare Workers with D1 and R2 for edge deployment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

OpenFGA answers the question 'can this user perform this action on this resource?' in single-digit milliseconds, implementing Google's Zanzibar paper as a production-ready authorization engine adopted by Auth0, Grafana Labs, Canonical, Docker, Agicap, and Read.AI. The server exposes both gRPC and HTTP APIs for authorization queries including Check, ListObjects, ListUsers, Expand, and the high-throughput BatchCheck endpoint that deduplicates and processes multiple authorization decisions in a single request. Authorization models combine relationship-based access control with role-based and attribute-based patterns through a purpose-built DSL that supports contextual tuples, conditional relationship tuples with CEL expressions, and time-based filtering via the ReadChanges API. Storage backends include PostgreSQL 14+, MySQL 8, and SQLite in beta, with an in-memory adapter for development and testing. Official SDKs for Java, .NET, Node.js, Go, and Python provide type-safe client integration, while a Terraform provider enables infrastructure-as-code management of authorization stores and models. The built-in browser playground at port 3000 lets developers visually model authorization schemas, write relationship tuples, and test access control queries interactively before deployment. OpenTelemetry instrumentation integrates with existing monitoring infrastructure, and Helm charts simplify Kubernetes deployment. A VS Code extension provides syntax highlighting and validation for FGA model files, and GitHub Actions automate model testing in CI/CD pipelines. A CNCF incubating project with transparent governance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Cerbos decouples authorization logic from application code entirely, evaluating human-readable YAML policies in under one millisecond through a stateless Policy Decision Point that requires no application state synchronization or cross-network fan-out. Its custom decision engine benchmarks up to 17x faster than OPA-based alternatives. Access control policies use conditions expressed in Google's Common Expression Language, supporting role-based, attribute-based, and policy-based access control patterns including derived roles, scoped policies, and permissions-aware data filtering that pushes authorization predicates directly into database queries. The PDP exposes both gRPC and HTTP APIs with SDKs for JavaScript, Python, Go, Java, .NET, Rust, PHP, and Ruby, making integration a single function call regardless of tech stack. GitOps-native workflows treat policies as code with Git versioning, CI validation through GitHub Actions, coverage reports, breaking-change detection, and audit logs of every authorization decision for ISO27001, SOC2, and HIPAA compliance. Deployment flexibility spans Kubernetes sidecars, standalone services, systemd daemons, AWS Lambda functions, and WebAssembly-embedded PDPs that run authorization logic directly in browsers, serverless architectures, and edge devices. The Admin API manages policy lifecycle operations programmatically, while the built-in Playground and REPL provide interactive testing environments for policy authoring and debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 24,000 GitHub stars and a rapidly growing community of self-hosters, authentik delivers enterprise-grade identity management that replaces commercial solutions like Okta and Auth0 with a fully self-hosted platform requiring no per-user licensing fees. The platform serves as a unified identity provider supporting SAML 2.0, OAuth 2.0 and OpenID Connect, LDAP for legacy application compatibility, SCIM 2.0 for automated user provisioning, and RADIUS for network device authentication. The visual flow designer enables administrators to create custom authentication workflows combining password verification, multi-factor authentication with TOTP, WebAuthn, and SMS codes, email verification, captcha challenges, and conditional logic based on user attributes or device context. The forward-auth and reverse proxy integration works seamlessly with Traefik, Nginx, Caddy, and Envoy to protect applications that lack built-in authentication. User enrollment flows support self-registration with configurable approval workflows, invitation links, and automatic group assignment. The LDAP outpost exposes user and group data to legacy applications requiring LDAP bind authentication, while the SCIM provider automates user lifecycle management with downstream applications. Multi-tenancy support through brands allows a single authentik instance to serve multiple organizations with independent domains, branding, and authentication policies. The admin interface provides comprehensive user management, group hierarchy, application catalog, event logging with GeoIP enrichment, and system health monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Licensed under a source-available license with an open-source community edition.