Crate

Crate is a private Composer registry that runs in your own Laravel Cloud account. You register the private repositories you want to serve, Crate builds Composer metadata and mirrored zip archives for them with Satis, and every download goes through a credential check that you can revoke at any time.

It is meant for teams that keep a handful of private packages in GitHub (or another Git host) and want composer require to work for them without a hosted registry. Each deployment is one registry with its own database, queue and storage bucket.

What Crate does and does not do

Crate serves the packages you register, and only those. It does not mirror packagist.org; public dependencies still come from Packagist as usual.

Access is all or nothing. Any active registry credential can read every package the deployment serves. There are no per-package, per-vendor or per-team permissions.

Crate has no package dashboard. You manage served repositories from Artisan commands (or a small JSON API for signed-in users). The web screens Crate does have come from Built for Cloud: sign-in, members, sessions and credentials.

Builds run when you register, remove or change a repository, when you ask for one, and once a day on a schedule. Crate does not rebuild when you push to a repository.

How it fits with Scalpels

Scalpels forks Crate into your GitHub account, provisions its database, queue, object storage and scheduler on your Laravel Cloud account, and deploys it. Crate follows the address Laravel Cloud supplies. See Install a product for how installs work in general.

Crate is a provider. Once it is running, Scalpels can attach your other applications to it, which issues each one a registry credential and opens a pull request that adds the Crate client package. See Connecting your apps.

In these docs

• Getting started: installing Crate through Scalpels, signing in, and serving your first package.
• Serving packages: registering repositories, source tokens, and how builds work.
• Credentials: the registry credential Composer uses, and who can issue, rotate and revoke one.
• Connecting your apps: the crate-client package, attaching through Scalpels, and checking that Composer can read the registry.
• Configuration: the optional environment values Crate reads and the settings managed inside the app.
• Agents: the read and write MCP tools Crate exposes.
• Troubleshooting: failed builds, 401 responses and other problems you can diagnose yourself.

Want a branded address for this deployment? Use your own domain.