Artisan Build
USA
We run Scalpels, as well as a suite of other tools for developers and development teams.
Agency
Ask for help
Ask Artisan Build for help
Replace expensive subscriptions
scalpels.app
Crate
Any stack
MIT licensed
A private Composer registry you fork and deploy into your own Laravel Cloud account. Register the private repositories you serve, build metadata and mirrored dist archives into your own object storage, and hand each consumer a credential you can revoke. Nobody else holds your packages, and there is no per-seat bill.
- Replaces
- Per-seat private package registries
- Runs on
- Your Laravel Cloud account
- Needs
- Compute · Database · Queue · Object storage · Scheduler · Cache
What it serves
Ordinary Composer on the consuming side
-
Registered, not committed
Add a served repository from the terminal; it lives in Postgres with its source token encrypted, so adding a package is not a redeploy.
-
Queued Satis builds
A build job generates the Satis config from the database, runs an isolated Satis, and records every run with tokens redacted from the log.
-
Mirrored dist archives
Metadata and zip archives land on your object storage and stream back through Crate, never as public bucket URLs.
-
One gate for everything
packages.json, p2 metadata and dist files all sit behind the same credential check, with a 401 for anything expired or revoked.
-
Credentials you issue and revoke
An admin-token API issues a named credential, lists the ones already out, and revokes any of them by stable id.
-
Incremental rebuilds
Rebuild one package on demand and let the daily scheduled build reconcile the rest.
-
Single-tenant by construction
Each deployment is a fork in your own Laravel Cloud account with its own Postgres, queue and bucket. There is no hosted control plane on our side, so there is no account of ours to trust or outgrow.
-
Headless, and honest about it
This release has no dashboard: Crate is operated from Artisan commands and the credential API. It does not mirror packagist.org, and any valid credential may read every package you serve.
Crate vs. the incumbents
We rebuilt the floor, not the building
Private Packagist, Repman and Satis are the three ways teams serve private packages today, and Crate is not trying to replace the top of that range. It does one slice — a credential-gated registry on infrastructure you own, fed from repositories you register — and deliberately does not do the rest. The question is which slice you actually use.
| Feature | Crate Self-hosted, MIT | Private Packagist Hosted, per user | Repman Hosted free, or self-host | Satis Free, you run it |
|---|---|---|---|---|
| Credential-gated metadata and dist the row we rebuilt | Does this well:One gate, yours | Does this well:Per-user tokens | Does this well:Org tokens | Not built:Web-server auth |
| Issue and revoke credentials by API the row we rebuilt | Does this well:Admin-token API | Does this well:UI and API | Does this well:UI and API | Not built:Edit a file |
| Per-package or per-team permissions we did not build this | Not built:All or nothing | Does this well:Teams and grants | Partly, or with a caveat:Per organisation | Not built:Not offered |
| Mirror packagist.org we did not build this | Not built:Private repos only | Does this well:Unlimited | Does this well:Proxy and CDN | Not built:Static only |
| Rebuild on push we did not build this | Partly, or with a caveat:Manual, plus daily | Does this well:Immediate | Does this well:Webhooks | Not built:Cron |
| Web dashboard we did not build this | Not built:Artisan and API | Does this well:Full UI | Does this well:Full UI | Not built:Not offered |
| Security advisories and usage stats we did not build this | Not built:Not built | Does this well:Alerts and tracking | Partly, or with a caveat:Scans, no stats | Not built:Not offered |
| Where your packages live | Does this well:Your bucket | Works, but on their terms:Their infrastructure | Partly, or with a caveat:Theirs, or self-host | Does this well:Your server |
| Cost of adding a developer | Does this well:Nothing | Works, but on their terms:Per user, per month | Does this well:Nothing | Does this well:Nothing |
| Who is on call for the registry | Partly, or with a caveat:You are | Does this well:They are | Partly, or with a caveat:Depends how you run it | Partly, or with a caveat:You are |
- Does this well
- Partly, or with a caveat
- Not built
- Works, but on their terms
The honest test
Look at what the registry actually does for you today. If these are all true, you are paying per seat for a gate.
- You serve a handful of private packages and are happy to add them from a terminal.
- Everyone who gets a credential may read every package you serve.
- You do not need packagist.org mirrored, a dashboard, or push-triggered rebuilds.
Then you lose very little by moving. The registry runs on infrastructure you already pay for, with no per-user line on any invoice.
Keep paying them if
These are the parts we chose not to build, and we are not going to pretend otherwise.
- You need per-package or per-team permissions.
- You want a UI your non-developers can use.
- You rely on vulnerability alerts, licence review or usage tracking.
- You need packagist.org mirrored so deploys survive an upstream outage.
Private Packagist is the upgrade path when you outgrow a credential-level gate. Crate is the floor beneath it, and it will stay a floor.
Be honest about it
You don't need us to run Crate
The repository is public and MIT licensed. These are the steps, and you are welcome to spend the afternoon doing them by hand.
-
1
Fork the Crate repository into your own GitHub organisation.
-
2
Deploy the fork to Laravel Cloud with its own compute, Postgres, queue and object storage.
-
3
Register the repositories you serve, run a build, and issue a credential to each application that pulls from it.
Or let Scalpels do it, free. It forks the app, provisions exactly what it needs on your Laravel Cloud account, and deploys it. The app and the infrastructure are yours either way — the only question is who spends the afternoon.
Deploy Crate for freeWant some help?
After you buy, we will pay for an hour with one of these experts to help you get everything up and running.