What you'll find here

Repository lifecycle

Follow what happens from creation through inactivity, cleanup, and possible reactivation.

Robot accounts

Declare robot accounts in the Control Plane and later issue tokens for authorized owners in the Robot accounts tab in Craftifact.

Explore dependencies

Use the Dependencies view to look up components, review candidates, and jump to consumer artifacts.

Review vulnerability findings

Use Findings -> Vulnerabilities to review vulnerabilities for a subject, their priority, freshness, and suppressions.

CRA-relevant workflows

Map artifact, SBOM, dependency, vulnerability, suppression, access, API, and backup workflows to CRA-relevant technical preparation without turning the guide into legal advice.

AI vulnerability triage MCP

Connect your own MCP-capable AI agent to read vulnerability queues, prepare proposals, or create suppressions after you enable write access.

AI evidence gathering MCP

Use your own MCP-capable AI agent to collect technical evidence snapshots for explicit package artifact and OCI subject sets, then export a review bundle.

Client tools

Configure Maven, pip, Docker, npm, and Go with the right context path, repository name, and token.

AI agent package cooldowns

Route Codex, Claude Code, npm, and Python installs through Craftifact proxies with strict cooldown gates.

SBOM generation

Generate CycloneDX SBOMs with client tools or use Craftifact-generated SBOMs for supported hosted content so the Dependencies view can surface them later.

Go proxy demo

Run a minimal Go module through the Craftifact demo instance with real go tooling.

Nexus import

Import from Nexus with the current selection rules, quota checks, and follow-up steps.

Backup and restore

Understand hosted backup defaults and choose the restore path that fits your situation.