The Private PyPI That Follows Every Python Packaging Standard
pip, uv, Poetry and twine work exactly as they do with PyPI, down to metadata files, yanked releases and project status. Docker, npm, Debian, Conda and Maven registries are on the same account.
uv add mypackage --index https://api.repoforge.io/my-repoforge-id/14-day free trial. No card required.
Used by teams at
- Sainsbury's
- Dover
- Keenious
- Aiwizo
- Odyssey
- Inocean
- Sevan SSP
- G2M Insights
Every Python Packaging Standard, Implemented
pip, uv, Poetry and twine talk to RepoForge.io the same way they talk to PyPI, because the index follows the same PyPA specifications. Metadata files mean uv resolves your dependency tree without downloading every wheel.
Full list of supported standardsSimple Repository API
The HTML and JSON indexes every Python installer reads.
Core Metadata Files
Resolvers read a release's dependencies without downloading the wheel.
Python Version Checks
Installers skip releases that don't support the interpreter they're running on.
Yanked Releases
Pull a bad release from resolution without breaking installs that pin it.
Project Status
Mark a package archived, deprecated or quarantined, and installers can tell your users.
Checked Uploads
Filenames follow the wheel and sdist rules, digests are verified, and a file can't be overwritten.
Your Package Names Stay Yours
Dependency confusion works by publishing a public package with the same name as a private one. RepoForge.io closes that gap, and tells you when your dependencies have known vulnerabilities.
Dependency-Confusion Protection
With upstream mirroring on, one RepoForge.io URL serves your private packages and PyPI. Any name that exists in your account, or ever did, is never fetched from PyPI, so a deleted private package can't quietly resolve to someone else's.
Standard plan and up
Vulnerability Scanning on Publish
Every Python package you publish is checked for known CVEs in its pinned dependencies, with severity and fixed versions in the dashboard. On Advanced, packages keep being monitored and you're alerted when a new CVE affects one.
All paid plans; active monitoring on Advanced
What You Get
Access Control
Tokens scoped to a package or a registry, read-only or read-write. Rotate or revoke any token from the dashboard.
Ship Libraries to Your Customers
Selling a Python library? Give each customer a read-only token for the packages they've paid for, and revoke it when they stop paying.
Works in Any CI
Publish with our GitHub Action, or from GitLab CI or any pipeline with a token. Install with the same index URL locally and in CI.
Upstream Mirroring and Edge Caching
One index for private and public packages, served from a global CDN. In our tests a cold install dropped from 18s to 4s. Standard plan and up.
SSO and Two-Factor
SAML/OIDC single sign-on on Standard and up. Authenticator-app two-factor on every paid plan.
Custom Domains
Serve from pkg.yourcompany.com on Advanced. HTTPS, no RepoForge branding in your config.
Python First, Five More Formats Alongside
Python Packages
Your private PyPI server, compatible with uv, pip, Poetry and twine. Mirror upstream PyPI for consistent, fast installs across every environment.
Upstream mirroring and vulnerability scanning are available for Python registries
# pyproject.toml [[tool.uv.index]] name = "repoforge" url = "https://api.repoforge.io/my-repoforge-id/" authenticate = "always" # Publish with uv export UV_PUBLISH_USERNAME=__token__ export UV_PUBLISH_PASSWORD=$REPOFORGE_TOKEN uv publish \ --publish-url https://api.repoforge.io/my-repoforge-id/ # Or install with pip pip install mypackage \ --index-url https://api.repoforge.io/my-repoforge-id/
Docker Images
Host private Docker images in a fully OCI-compliant registry. Authenticate with credentials or an access token, push and pull with the standard Docker CLI.
# Log in (Docker hash is always lowercase) docker login docker.repoforge.io/my-repoforge-id/my-registry # Build and tag your image docker build -t my-app . docker tag my-app \ docker.repoforge.io/my-repoforge-id/my-registry:latest # Push to RepoForge docker push docker.repoforge.io/my-repoforge-id/my-registry:latest
npm Packages
A private npm registry for your Node.js packages. Scope packages to your organisation, authenticate with an access token, and publish with the standard npm CLI.
# Point your scope at RepoForge npm config set @myorg:registry \ https://api.repoforge.io/npm/my-repoforge-id/ # Authenticate with an access token npm config set \ //api.repoforge.io/npm/my-repoforge-id/:_authToken $REPOFORGE_TOKEN npm publish npm install @myorg/package-name
Debian Packages
Host private .deb packages in a fully APT-compatible repository. Configure any Debian or Ubuntu system to install from your private registry using standard apt tools.
# /etc/apt/sources.list.d/repoforge.list deb https://api.repoforge.io/debian/my-repoforge-id/ stable main apt-get update apt-get install my-private-package # Push a .deb via the REST API curl -X POST \ https://api.repoforge.io/debian/my-repoforge-id/ \ -F package=@mypackage_1.0_amd64.deb
Conda Packages
Host private Conda packages for your data science and ML teams. Create named channels within your registry and point conda or mamba at them directly.
# Add your private channel (define your channel name) conda config --add channels \ https://api.repoforge.io/conda/my-repoforge-id/my-channel conda install \ -c https://api.repoforge.io/conda/my-repoforge-id/my-channel \ my-private-package # Upload via the REST API curl -X POST \ https://api.repoforge.io/conda/my-repoforge-id/my-channel \ -F package=@mypkg-1.0-py311_0.conda
Maven Artifacts
Publish Java and Kotlin libraries with mvn deploy or Gradle, and resolve them in any Maven or Gradle build. Keep artifacts private, or make an SDK public so your customers need no credentials.
<!-- pom.xml --> <distributionManagement><repository> <id>repoforge</id> <url>https://api.repoforge.io/maven/my-repoforge-id/</url> </repository></distributionManagement> # Token in ~/.m2/settings.xml, then publish mvn deploy # Or with Gradle's maven-publish plugin ./gradlew publish
Pricing
Per user, per month. Only people who sign in to the dashboard need a seat: CI pipelines and anyone who only installs packages use access tokens, and you can create as many as you like. Storage is per plan; bandwidth isn't metered.
- 100 MB storage
- Free forever
- Unlimited public packages
- Not for commercial use
- All free features
- 1 GB storage per user
- Unlimited private packages
- Unlimited access tokens
- REST API access
- Python vulnerability scanning
- All basic features
- 5 GB storage per user
- Upstream mirroring with dependency-confusion protection
- Edge caching
- SSO authentication
- All standard features
- 30 GB storage per user
- Active vulnerability monitoring
- Custom domain names
Need self-hosted or a bigger plan? Email us.
How It Compares
Prices checked October 2026.
| Feature | RepoForge | JFrog Artifactory | Cloudsmith | Packagecloud | Gemfury | GitHub Packages | GitLab | AWS CodeArtifact |
|---|---|---|---|---|---|---|---|---|
| Private repositories | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Python | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ |
| Docker | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ |
| npm | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Debian | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | Experimental | ✗ |
| Conda | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Maven | ✓ | ✓ | ✓ | ✓ | ✓ | Login to read | ✓ | ✓ |
| CI/CD integration | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Security scanning | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Pricing (starting at) | £10/user/month, billed yearly | $150/month | Free tier; Pro $149/month | $89/month | $9/month (1 user), $14/month (5 users) | 500 MB free, then usage-based | Free | Per GB + per request |
From Customers
RepoForge.io is great and a vital part of our inner source ecosystem now.
I'm very impressed by your response times and always able to solve our RepoForge.io problems even if they are actually on our side!
Very satisfied when we found RepoForge.io. Solved our day to day challenges with ease dealing with private Python packages.
RepoForge SFTP
Managed SFTP with SSH key and password logins, per-user folders, an activity log and encrypted storage on S3. £20 a month.
Try It
Free tier for open source, 14-day trial on paid plans. No card needed.