JavaScript · TypeScript · Node.js
via the npm registry protocol on /npm/
Supported Ecosystems
A dependency firewall for every package manager your teams already use
ShieldedStack applies the same allow, deny, CVE, license, age, and audit controls across 9 package ecosystems and 22 package managers. Developers keep their normal tools; the proxy becomes the centralized enforcement point.
Languages covered
C# · F# · .NET
via the NuGet v3 protocol on /nuget/v3/index.json
Python
via the PyPI simple-index protocol on /pip/
Java · Kotlin · Scala
via the Maven repository protocol on /maven/
Go
via the Go module proxy protocol on /go
Rust
via the Cargo sparse registry protocol on /cargo/
Ruby
via the RubyGems protocol on /rubygems
Dart · Flutter
via the hosted Pub repository protocol on /dart
PHP
via the Composer repository protocol on /composer
How each package manager is handled
Every client below resolves through the proxy, so policy is enforced at install time rather than reported afterwards. Full setup instructions live in the documentation.
npm
JavaScript, TypeScript
Registry and auth token set in .npmrc, with metadata requests authenticated so installs are attributed to a project. npm setup guide
pnpm
JavaScript, TypeScript
Reads the same .npmrc as npm, so no separate configuration is needed. pnpm setup guide
Yarn
JavaScript, TypeScript
Configured through .yarnrc.yml with its own registry, auth-token, and always-auth settings. Yarn setup guide
Bun
JavaScript, TypeScript
Reads .npmrc, so an existing npm configuration applies unchanged. Bun setup guide
Deno
JavaScript, TypeScript
Resolves npm: specifiers through the registry environment variable. Deno setup guide
NuGet
C#, F#
Package source and credentials declared in nuget.config, which nuget.exe and IDEs both read. NuGet setup guide
dotnet CLI
C#, F#
Uses the same nuget.config, with the source and credentials set from the CLI. dotnet CLI setup guide
Paket
C#, F#
Resolves from the same feed, taking the endpoint and key through its own source settings. Paket setup guide
pip
Python
Index URL and credentials set on the command line or in pip.conf. pip setup guide
uv
Python
Speaks the same simple-index protocol, through its own index-URL and credential settings. uv setup guide
Poetry
Python
Resolves from the proxy as a configured source, with credentials supplied per source. Poetry setup guide
Pipenv
Python
Resolves from the proxy through its own index and credential settings. Pipenv setup guide
Maven
Java, Kotlin
Mirror and server credentials in settings.xml, covering every repository the build declares. Maven setup guide
Gradle
Java, Kotlin
Repository declared in the build, with credentials supplied from outside the build file. Gradle setup guide
sbt
Java, Kotlin
Resolves from Maven repositories through its own resolver settings. sbt setup guide
go
Go
GOPROXY pointed at the proxy with no direct fallback, so every module resolves through it. go setup guide
cargo
Rust
Source replacement against the sparse registry, redirecting crates.io resolution wholesale. cargo setup guide
Bundler
Ruby
Mirror configured against rubygems.org, with a credential entry matching the mirror exactly. Bundler setup guide
gem
Ruby
Proxy added as a gem source and the public source removed, so only one can satisfy a package. gem setup guide
pub
Dart, Flutter
PUB_HOSTED_URL pointed at the proxy, with a bearer token registered per machine. pub setup guide
Flutter
Dart, Flutter
flutter pub get honours the same hosted URL and token as the Dart SDK. Flutter setup guide
Composer
PHP
Repository entry and HTTP basic credentials in composer.json or auth.json, with packagist.org disabled so it cannot satisfy a package. Composer setup guide
Not seeing your package manager?
Any client that speaks one of the 9 protocols above resolves through the same endpoint and the same key. Start a trial and point your own toolchain at it.
Start free trial