Vein

Single endpoint: Bundler, ore-light, Cargo, and npm can all point at the same Vein base URL. One server handles RubyGems, the crates.io sparse index + crate downloads, and npm metadata + tarballs, detected by path and header. RubyGems upstream is configurable; crates.io and npm use fixed upstreams and work out of the box.

Multi-ecosystem

Proxies RubyGems (configurable upstream), mirrors the crates.io sparse index and crate downloads, and proxies npm registry metadata and tarballs - all with caching. Learn more.

Smart caching

Artifacts (gems, crates, npm tarballs) are cached on first fetch and served from local storage thereafter. Index/metadata endpoints use TTL + revalidation. Learn more.

Supply chain protection

Quarantine delays new package versions from appearing in dependency resolution for a configurable window, giving the community time to catch malicious releases. Learn more.

Admin dashboard

Browse the catalog, inspect quarantine status, and preview/download CycloneDX SBOMs from a web UI. Learn more.

Single binary

Built on Rama, a modular Rust HTTP framework. SQLite or PostgreSQL for metadata, filesystem for cached artifacts. See configuration.

Simple deployment

Docker image, docker-compose stack, or a systemd unit behind Nginx. Learn more.

Get started

The Quickstart takes you from cargo build --release (or docker run) to a running proxy that Bundler, Cargo, and npm can all point at.

Why Vein?

No connectivity, no AI, no 5G - no problem. Vein doesn’t need a cloud API, an AI sidecar, or even a stable uplink to do its job. It’s a single binary: run it on your laptop, on a spare box, or straight on your router, and Bundler, Cargo, and npm keep resolving from a local cache instead of stalling on a dead connection.

The ecosystem got noisy. RubyCentral’s rubygems.org governance drama, npm namespace squatters, and agents now publishing 200 versions of a package a day - all of it pushed toward the same conclusion: don’t trust a single upstream index, unfiltered, by default. Vein started as a simple registry to put a cache and a quarantine window between your dependency resolution and whatever’s happening upstream that week.

Vein was initially built on Cloudflare’s Pingora framework, but Pingora has no FreeBSD support and ignored contributions to add it. Vein now runs on Rama, which compiles on FreeBSD, Linux, macOS, Windows, iOS, and Android, and has a genuinely modular architecture.

Vein is a side project and remains free and open source (dual-licensed MIT for individuals, AGPL-3.0 for commercial/company use). It intentionally stays focused on proxying, caching, and serving packages rather than growing into a general-purpose HTTP platform.