Stout registry — self-hosted
A verify-before-serve package registry. Packages are fetched from their upstreams, scanned, and served only on a clean verdict — refused ones come with the evidence.
Serving from this origin
Live statistics appear here once this instance has mirrored and verified its first packages.
Every pull runs the gate
- Fetch from upstream
- Cache no install scripts run
- Scan CVE, malware, intent, behavior
- Verdict serve or refuse
Browse packages Everything this instance mirrors, with each verdict and its evidence. Point your package manager here Per-ecosystem setup for pulling through this instance. Documentation Operating, configuring, and integrating this registry. Sign in Manage organizations, tokens, and verification policy.