What you'll find here

Repository lifecycle

Follow what happens from creation through inactivity, cleanup, and possible reactivation.

Robot accounts

Declare robot accounts in the Control Plane and later issue tokens for authorized owners in the Robot accounts tab in Craftifact.

Explore dependencies

Use the Dependencies view to look up components, review candidates, and jump to consumer artifacts.

Review vulnerability findings

Use Findings -> Vulnerabilities to review subject-scoped vulnerability results, priority signals, freshness state, and suppressions.

CRA-relevant workflows

Map artifact, SBOM, dependency, vulnerability, suppression, access, API, and backup workflows to CRA-relevant technical preparation without turning the guide into legal advice.

AI vulnerability triage MCP

Connect your own MCP-capable AI agent to read vulnerability queues, prepare proposals, or write suppressions when you deliberately enable write mode.

AI evidence gathering MCP

Use your own MCP-capable AI agent to collect technical evidence snapshots for explicit package artifact and OCI subject sets, then export a review bundle.

Client tools

Configure Maven, pip, Docker, npm, and Gobeta with the right context path, repository name, and token.

AI agent package cooldowns

Route Codex, Claude Code, npm, and Python installs through Craftifact proxies with strict cooldown gates.

SBOM generation

Generate CycloneDX SBOMs with client tools or use Craftifact-generated SBOMs for supported hosted content so the Dependencies view can surface them later.

Go proxy demo

Run a minimal Gobeta module through the Craftifact demo instance with real go tooling.

Nexus import

Import from Nexus with the current selection rules, quota checks, and follow-up steps.

Backup and restore

Understand hosted backup defaults and choose the restore path that fits your situation.