Full-featured artifact management with no feature gates, no vendor lock-in, and no surprise bills. Security scanning, all 45+ package formats, proxy repositories, and enterprise features—included free.

Many commercial registries offer vulnerability scanning only as a paid add-on. With Artifact Keeper, Trivy, OpenSCAP, and Dependency-Track are included from day one at no extra cost.

Replication, high availability, and advanced auth are often reserved for higher-priced plans. Artifact Keeper includes every feature in the open-source release.

Moving between artifact registries typically requires re-engineering CI/CD pipelines. Artifact Keeper includes built-in migration tooling to import repositories, artifacts, and permissions from existing registries.

Per-seat licensing means costs grow with your team. Artifact Keeper is MIT licensed with no per-user fees, so you can scale your engineering team without scaling your registry bill.

We built Artifact Keeper because DevOps tooling shouldn’t have a paywall.

Competitor pricing and feature availability based on publicly available information as of January 2026. “JFrog” and “Artifactory” are trademarks of JFrog Ltd.

“Security isn’t a premium feature. It’s a baseline requirement.”

That’s why vulnerability scanning is included in every Artifact Keeper

deployment—free.

Don't see your format? Our WASM plugin system lets you add custom formats.

Our built-in migration tool handles everything—repositories, artifacts, metadata, users, and permissions.

Connect to your Artifactory instance

Select what to migrate

Click start—we handle the rest

Verify with built-in integrity checks

Read-only migration from Artifactory with full metadata preservation. Resume interrupted migrations automatically. Your source registry is never modified.

Trivy + OpenSCAP integrated, automatic CVE alerts

Fine-grained permissions, RBAC, API keys

Full audit trail of all actions

GPG and cosign support for provenance verification

LDAP, SAML, OIDC out of the box

CycloneDX SBOM generation, dependency analysis

SCAP policy scanning for container images

At-rest and in-transit encryption standard

Other registries charge $30,000+/year for security scanning. We include it because securing your supply chain shouldn't be a luxury.

Security scanning powered by Trivy, OpenSCAP, and OWASP Dependency-Track — all open-source.

docker compose up -d Native apps for macOS, iOS, and Android. Browse repositories, monitor builds, trigger scans, and administer users—all from your device.

Coming soon to the App Store & Google Play

Android

iOS

Artifact Keeper is MIT licensed. Every feature ships in the open-source release—no open-core model, no source-available restrictions. Genuinely open source.

Every feature—security scanning, all package formats, RBAC, SSO, migration tools—is included in the open-source release. No separate enterprise edition. Fork it, modify it, run it however you want.

View on GitHub