DepAegis
DepAegis is a private package registry for securing software supply chains, offered through web use or self-hosted deployment.
What DepAegis is
DepAegis is a private package registry for securing software supply chains, offered through web use or self-hosted deployment. It lists npm, NuGet, Maven, PyPI, Docker/OCI, Go Modules and Helm package formats. Security checks include real-time OSV.dev and NVD vulnerability scanning, secrets detection, license compliance and typosquatting analysis. A dependency firewall provides eight built-in policy types and OPA Rego integration. Publishing features include SLSA provenance, Sigstore signing and SBOM generation, while VEX/VDR reports and EU Cyber Resilience Act reports provide compliance information with attestations, vulnerability summaries and audit trails. GitHub Actions, GitLab CI and Jenkins integrations are listed, alongside a CLI for publishing, scanning and SBOM generation. Docker, Helm and bare-metal installation are documented. Community is free forever but limited to three users, five feeds, 50 packages, 1 GB storage, and npm and NuGet registries.
Good
- Supports seven package registry formats
- Real-time OSV.dev and NVD scanning
- Dependency firewall with OPA Rego integration
- Self-hosted and web deployment options
- Free Community plan available
Watch out
- Community plan limited to three users
- Community storage limited to 1 GB
- Community supports only npm and NuGet
- Documentation is still being written
Who it suits
DepAegis suits teams managing private package feeds and software supply-chain controls. It is intended for organizations needing self-hosting, registry policies, scanning, SBOMs or compliance reporting.
Verdict
DepAegis combines package hosting with scanning, policy enforcement, provenance, signing and compliance reporting. The free tier is tightly limited, while paid plans expand users, storage, formats and support.
Plans and prices
From DepAegis's own pricing page, checked 10 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Community | Free | Up to 3 users · Up to 5 feeds · Up to 50 packages · 1 GB storage · npm & NuGet registries · OSV.dev vulnerability scanning · Community support · Free forever |
| Starter | €39 a month | Up to 10 users · Up to 500 packages · 25 GB storage · 7 registry formats · SBOM generation · Dependency firewall and policy engine · Email support · €39/org/month |
| Pro | €149 a month | Up to 25 users · Up to 5,000 packages · 100 GB storage · AI-powered vulnerability scanning · SLSA provenance and Sigstore signing · SSO · Custom roles · Priority support · €149/org/month |
| Business | €449 a month | Up to 100 users · Up to 25,000 packages · 500 GB storage · SAML SSO · SCIM provisioning · CRA/DORA/NIS2 reports · 99.9% SLA · Cargo and RubyGems included · €449/org/month |
| Enterprise | Priced on request | Unlimited users and packages · Unlimited storage and bandwidth · Air-gapped deployment · OIDC/SAML · FIDO2/WebAuthn · Custom SLA and dedicated support · On-premise or private cloud · Custom |
The facts
Each one read from DepAegis's own pages, with the date it was checked.
What it does
- CI/CD integrations
- The site lists GitHub Actions, GitLab CI, and Jenkins integrations, plus a CLI for publishing, scanning, and SBOM generation.checked 10 Oct 2026
- Compliance
- DepAegis lists EU Cyber Resilience Act reports with SBOM attestations, vulnerability summaries, and audit trails.checked 10 Oct 2026
- Dependency firewall
- The dependency firewall has eight built-in policy types and OPA Rego integration.checked 10 Oct 2026
- Deployment
- The installation instructions offer Docker, Helm, or bare-metal deployment; Enterprise lists air-gapped, on-premise, or private-cloud deployment.checked 10 Oct 2026
- Documentation
- The documentation page says its guides, API references, and tutorials are being written and invites users to contact the company for early access.checked 10 Oct 2026
- Enterprise authentication
- Enterprise lists Duende IdentityServer for OIDC/SAML and FIDO2/WebAuthn.checked 10 Oct 2026
- Package formats
- The registry lists npm, NuGet, Maven, PyPI, Docker/OCI, Go Modules, and Helm support.checked 10 Oct 2026
- Product
- DepAegis describes itself as a private package registry for securing software supply chains.checked 10 Oct 2026
- Supply chain security
- The site says publishes include SLSA provenance, Sigstore signing, SBOM generation, and VEX/VDR compliance reports.checked 10 Oct 2026
- Support
- Listed support varies by plan: community support on Community, email support on Starter, priority support on Pro, and dedicated support on Enterprise.checked 10 Oct 2026
- Vulnerability scanning
- The site lists real-time OSV.dev and NVD scanning, secrets detection, license compliance, and typosquatting analysis.checked 10 Oct 2026
Money
- Free plan limits
- The free Community plan is limited to three users, five feeds, 50 packages, 1 GB of storage, and npm and NuGet registries.checked 10 Oct 2026
Alternatives to DepAegis
- 1
Azure Test Plans
Free planWebAPIExtensionLinux8.1From $6 a month - 2
Nexspence
Free planOpen sourceWebAPILinuxmacOS8.1From $25 a month - 3
Oracle WebCenter Content
AndroidiOSWebAPI7.7$3,450 one-time - 4
Packagecloud
Free planWebAPILinuxmacOS7.7From $89 a month - 5
Sonatype Nexus Repository
Free planWebAPILinuxmacOS7.5From $1,950 a year - 6
Inedo ProGet
Free planWebAPILinuxSelf-hosted7.4From $2,395 a year