haymon Request access
Request access

Control your software supply chain in the age of AI agents.

Developers and AI agents add dependencies faster than anyone can review them. haymon is a private registry on your own server that serves only the packages you've let in.

  • The haymon packages overview
  • The details page of the acme/payments-core package
  • The haymon sources overview
  • The details page of the payments git source
  • The haymon users overview
  • The haymon credentials overview

Packages

Every package the registry serves, the source it came from, how many versions it holds and when it last changed. Search it, or import a whole lock file at once.

Control

Nothing reaches your builds that you didn't let in.

  • A closed catalog

    haymon serves the packages you imported and everything they require. Any other name gets a 404.

  • Versions you allow

    Set a version range on a package, and releases outside it are never mirrored and can never be downloaded.

  • Private names stay private

    A package from your own source is only ever fetched from it. Public registries are never asked, so a squatter can't slip in.

  • Copies on your disk

    Archives are served from your server once built, each with its checksum recorded.

  • Clear roles

    Only administrators add sources, credentials and users. Everyone else browses packages and installs with their own token.

Ecosystems

A truly universal home for all your packages.

  • Available

    Composer PHP

    • Composer v2 metadata protocol
    • Packagist and any Composer repository
    • GitHub, GitLab and git sources
  • Next

    npm JavaScript

    The next ecosystem on the platform, on the same sources, credentials and access control.

  • Planned

    More to follow

    More languages and protocols will follow npm. Tell us which ones your team needs.

Architecture

Many sources in. One endpoint out.

  • Public registriesMirrored upstream
  • gitlab.acme.devGit · GitLab token
  • github.com/acmeGit · SSH key
  • Your own archivesHosted in haymon
One endpoint haymon Your private registry
  • Developer machinesLocal installs
  • CI pipelinesEvery build
  • DeploysProduction releases

  • Every release, one name

    When a fork continues where the public registry stops, your clients see the releases from both under the same package name.

  • Priority settles ties

    When two sources offer the same release, the higher-priority source supplies it.

  • Outages don't empty it

    A source that's down keeps every release it already supplied, and your builds keep installing them.

FAQ

Frequently asked questions

What is haymon?

A private package registry you run yourself. It mirrors the packages you choose from public and private sources, and serves only those to your developers, CI and AI agents.

Which sources can it mirror?

Any Composer repository such as packagist.org, git remotes on GitHub, GitLab or anywhere else, inline package definitions, and archives you host in haymon itself.

How do developers and CI authenticate?

Each user has one Composer token, used with http-basic (username and token) or as a Bearer token. Users can regenerate their own token at any time.

What does it take to run?

One binary and a storage directory. The database is SQLite, the web interface is built in, and background jobs run in the same process. Configuration is environment variables or a .env file.

Does it download every archive up front?

No. An archive is built or fetched the first time a client asks for it, then served from disk. The first install of a new version waits for that build; every one after it doesn't.

How do I get it?

haymon is in early access. Request access and we'll get you set up.

Early access

Take control of your supply chain.

haymon is in early access, starting with Composer. Tell us about your team and which ecosystems you need next.

Request access