Skip to content
Stout
Overview
The registry that refuses known-bad code at the gate

Welcome to Stout

Point your package manager at Stout and it refuses known-vulnerable and known-malicious versions at install: every public dependency scanned, decided, and refused if dangerous, across 14 package formats plus an agent protocol, behind one consistent installation surface. Building trusted packages from source is an Enterprise path, in private preview.

Pull-Through Proxy

Point your package manager at Stout's gate: every public dependency scanned, decided, and refused if dangerous before it serves.

Start here

Build Pipelines

Enterprise

Enterprise: submit source code and let Stout build, scan, sign, and publish your packages from source.

Read guide

Custom Builds

Enterprise

Enterprise: customize the build pipeline with a stout.yaml manifest in your project root.

Read guide

Mirror or build

Start with the pull-through proxy: every public dependency through the gate. Source builds are the advanced, Enterprise path.

Mirror upstream -> Pull-Through Proxy

  • You want every public dependency fetched through the gate: scanned, decided, and refused if dangerous before it serves.
  • You want cache misses fetched from the upstream source and served from cache on later installs.
  • You want global or organization-scoped proxy paths with trust policy routing.
Open guide

Publish from source -> Build Pipelines (Enterprise)

  • Enterprise: you want Stout to clone a repository ref and run ecosystem-specific build commands.
  • You need the binary proven to match the source: SBOM generation, Sigstore signing, and publishing after the build.
  • You want source-built first-party packages across the supported ecosystems.
Open guide

Quick start

Point your package manager at Stout's gate and install through the proxy. Building a package from source is the advanced, Enterprise step.

terminal
# Point your package manager at Stout's gate: every install scanned, decided, refused if dangerous
npm config set registry https://your-stout-host/npm/
npm install react
# Advanced (Enterprise): build a package from source instead of mirroring
stout auth login
stout submit npm --repo https://github.com/acme/widgets --version 1.0.0

14 package formats + an agent protocol

One registry front door for application packages, infrastructure modules, containers, and agent bundles.

GonpmMavenPythonRustHelmDockerNuGetRubyPHPDartSwiftConanTerraformAI Agents

Common questions

Point your package manager at Stout and every public dependency is fetched through the gate: scanned, decided, and refused at install if it's a known-vulnerable or known-malicious version, before it ever reaches your machine.