Artifact Keeper
Artifact Keeper is a self-hostable artifact registry for storing and managing software packages.
What Artifact Keeper is
Artifact Keeper is a self-hostable artifact registry for storing and managing software packages. It supports more than 45 package formats, local, proxy, and virtual repositories, and custom format handlers through a WebAssembly plugin system. Proxy repositories can connect to public registries including npmjs.com, PyPI, Maven Central, and Docker Hub. Security capabilities include vulnerability alerts, SBOM analysis, and compliance scanning, with Trivy, OpenSCAP, and OWASP Dependency-Track included. Teams can use fine-grained repository permissions, RBAC, API keys, and single sign-on through LDAP, SAML 2.0, or OIDC. GPG and cosign signing and an audit trail are also listed, along with encryption at rest and in transit. Migration tools import repositories, artifacts, metadata, users, and permissions from Artifactory through a read-only process with integrity checks. Storage options include filesystem and S3-compatible services. The free plan is free, with all features included and no per-user fees.
Good
- Supports more than 45 package formats.
- Includes local, proxy, and virtual repositories.
- Security scanning tools are included.
- Free plan includes all features with no per-user fees.
- Provides Artifactory migration tooling with integrity checks.
Watch out
- Android and iOS apps are described as coming soon.
- Self-hosting requires operating it on your infrastructure.
Who it suits
It suits teams that need a self-hosted registry for varied package formats, with repository controls and security scanning. Teams moving from Artifactory may find its migration tooling relevant.
Verdict
Artifact Keeper combines broad package-format support with repository management, access controls, scanning, and migration capabilities. Its listed plan is free, while mobile apps are not presented as available downloads.
Plans and prices
From Artifact Keeper's own pricing page, checked 3 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Artifact Keeper | Free | No per-user fees · All features included · MIT licensed |
The facts
Each one read from Artifact Keeper's own pages, with the date it was checked.
What it does
- Access control
- It supports fine-grained repository permissions, RBAC, API keys, and SSO through LDAP, SAML, and OIDC.checked 3 Oct 2026
- Deployment
- The maker documents Docker Compose and Kubernetes Helm deployments, and its installation guide describes Windows support as beta.checked 3 Oct 2026
- Encryption
- The site states that encryption at rest and in transit is standard.checked 3 Oct 2026
- Integrations
- Trivy, OpenSCAP, OWASP Dependency-Track, OpenSearch, PostgreSQL, S3-compatible storage, LDAP, SAML 2.0, OIDCchecked 15 Sep 2026
- Migration
- Its Artifactory migration tooling can import repositories, artifacts, metadata, users, and permissions, and the site describes the migration as read-only with integrity checks.checked 3 Oct 2026
- Mobile availability
- The website says Android and iOS apps are coming soon; it describes native macOS, iOS, and Android apps, but does not give app store download links as available.checked 3 Oct 2026
- Observability
- It provides Prometheus metrics and optional OpenTelemetry tracing with OTLP export to Jaeger, Tempo, or Datadog.checked 3 Oct 2026
- Package formats
- It supports more than 45 package formats and allows custom format handlers through a WebAssembly plugin system.checked 3 Oct 2026
- Product
- Artifact Keeper is a self-hostable artifact registry described as an open-source alternative to JFrog Artifactory and Sonatype Nexus.checked 3 Oct 2026
- Repository types
- It supports local, proxy, and virtual repositories, including proxies for public registries such as npmjs.com, PyPI, Maven Central, and Docker Hub.checked 3 Oct 2026
- Security scanning
- The site says Trivy, OpenSCAP, and Dependency-Track are included; its security features include vulnerability alerts, SBOM analysis, and compliance scanning.checked 3 Oct 2026
- Signing and audit
- The site lists GPG and cosign artifact signing and a full audit trail of actions.checked 3 Oct 2026
- Storage integrations
- The installation guide documents filesystem and S3-compatible storage, including AWS S3, MinIO, and DigitalOcean Spaces.checked 3 Oct 2026
- Support
- The site offers migration planning and execution, architecture review, and priority bug fixes as support and consulting.checked 3 Oct 2026
Alternatives to Artifact Keeper
- 1
Azure Test Plans
Free planWebAPIExtensionLinux8.1From $6 a month - 2
Nexspence
Free planOpen sourceWebAPILinuxmacOS8.1From $25 a month - 3
Oracle WebCenter Content
AndroidiOSWebAPI7.7$3,450 one-time - 4
Packagecloud
Free planWebAPILinuxmacOS7.7From $89 a month - 5
Sonatype Nexus Repository
Free planWebAPILinuxmacOS7.5From $1,950 a year - 6
Inedo ProGet
Free planWebAPILinuxSelf-hosted7.4From $2,395 a year