Supply chain gateway
Every open source package, through one point of control.
Aquila is a self-hosted gateway between your engineers and npm, PyPI, Docker Hub, and Go modules. It caches what they pull, records who pulled it, and checks your policy before anything is served. It works across an air gap.
Aquila is in private beta. Free for small teams when it is available.
.npmrc registry=https://aquila.internal/npm pip.conf index-url = https://aquila.internal/pypi/simple daemon.json "registry-mirrors": ["https://aquila.internal/docker"]
One line per ecosystem. Nothing else changes.
The gap
Hundreds of dependencies enter your network every build, and nobody signs for any of them.
A single install can pull several hundred packages from machines you do not control, written by people you cannot name, into environments you are accountable for. Most organisations cannot say which versions are in use, who introduced them, or what was known about them at the time.
For a bank or a defence programme, that is an unmanaged flow of third party code into the most sensitive part of the estate. The controls that exist everywhere else in the business, review, approval, record keeping, stop at the registry boundary.
How it works
Policy is applied before the package is served, not after it lands.
Aquila stands in for the public registry as a caching proxy. Here is what happens on every request, in the order it happens.
Fetch and cache
Aquila stands in for the public registry. It fetches once, caches, and serves from disk. Builds get faster, and they keep working when upstream is down.
Check policy
Before anything is served, Aquila applies your rules: known vulnerabilities, package age, allow and block lists. A package that fails is not served, and the developer is told why.
Record
Every download is written to an audit record. Which team, which package, which version, when. The result is a live inventory of the open source actually in use, rather than the one in a spreadsheet.
Re-check what you already have
When a new advisory lands for something cached last month, Aquila tells you, and shows you who has it.
$ npm install left-pad@1.3.0 npm ERR! 403 Forbidden npm ERR! aquila: blocked by policy "no-known-critical" npm ERR! aquila: CVE-2026-XXXXX, critical, published 3 days ago npm ERR! aquila: request an exception at aquila.internal/requests
Illustrative CLI output, to be confirmed against the shipped client.
Retroactive monitoring: a package that passed on the way in is re-checked when the advisory arrives later.
Agents
Developers are no longer the only thing pulling packages.
A coding agent installs dependencies the same way a person does, but faster, more often, and without anyone reading the list afterwards. The gateway does not care which it is. That is the point.
Agents reach for the versions they were trained on
An agent picks the library version it saw most during training, which is by definition an old one, and old versions are where the known vulnerabilities live. Aquila's policy check on known vulnerabilities and package age catches exactly that, before the package is served.
There is nothing for an agent to route around
Aquila works at the registry protocol, not in an editor plugin or a wrapper. An agent using the team's configuration gets the same policy decision a developer gets, and nothing has to be built for agents specifically.
Review that depends on a person reading it does not survive the volume
A small team running agents can pull more packages in a week than it used to pull in a quarter. Policy applied at the gateway scales with that. A pull request checklist does not.
The record still says who, and what
Aquila tells an agent's credential apart from a developer's. The audit record shows a person, or an agent and the team it was acting for, so a review can separate what somebody chose from what something generated.
An agent is assembled from artifacts as well, the MCP servers it connects to and the model weights it loads. Both are on the roadmap as artifact types and neither is supported today. They are listed in the limits below.
The defining capability
A registry that feels normal, on a network that cannot reach the internet.
Connected
A connected Aquila fetches, filters, and scans on the outside, then packs approved artifacts into signed, tamper evident bundles that travel across your existing cross domain tooling.
Enclave
An internal Aquila, provably incapable of reaching the internet, imports them and serves your developers a normal registry, with a request workflow, approvals on both sides, and a full audit trail for every artifact in the enclave.
Accreditation
Three questions a security officer should be able to answer about any artifact in the building.
Where did this come from?
The upstream source, the fetch time, and the digest, recorded at the moment of retrieval.
Who approved it?
The requester, the approver, and the decision, on both sides of the gap.
What did we know about it when it arrived?
The policy result and the advisories known at the time, kept alongside what is known now.
Aquila is built so those answers come from the record, not from memory.
{
"artifact": "npm:lodash@4.17.21",
"digest": "sha512:0e0e2f...",
"upstream": "registry.npmjs.org",
"fetched": "2026-03-04T09:12:44Z",
"principal": { "type": "agent", "id": "ci-refactor-01",
"on_behalf_of": "team-payments" },
"policy_result": "pass",
"advisories_at_fetch": []
} Illustrative audit record, to be confirmed against the shipped schema.
Deployment
One binary. On premise first.
- Form
- single binary
- Platform
- Linux, Kubernetes ready
- Ecosystems today
- npm, PyPI, Docker Hub, Go modules
- Artifact types next
- see what Aquila does not do yet
- Air gap
- paired collector and enclave deployment
- Data residency
- artifacts and records stay on your infrastructure
- Outbound network from the enclave instance
- none
Availability
Free for small teams.
Aquila will be free to run, self hosted, for small teams. Not a trial, not a time limit, not a feature that disappears after thirty days. Larger deployments and air gapped pairs will be commercial.
If you are a small platform team, a university group, or a single programme wanting to see whether this fits, that is what the free tier is for. Pricing above it is not settled and we are not going to invent a number for a website.
Join the waitlistLimits
What Aquila does not do yet.
Everything below is planned and none of it ships today. It is listed here so that nobody discovers it during an accreditation review.
Licence policy
Allow and block lists apply to packages today. Blocking on the declared licence of a package is planned and not yet enforced.
Signature verification
Verifying upstream package signatures and provenance attestations before serving is planned. Aquila does not check them today.
Malware heuristics
Scanning package contents for malware indicators beyond known advisories is planned. It is not part of the policy check today.
Artifact types not covered yet
MAVEN NUGET CARGO HOMEBREW CHOCOLATEY VS CODE EXTENSIONS MCP SERVERS MODEL WEIGHTS
The list runs past build dependencies on purpose. The same point of control should cover what lands on a developer's machine, and what an agent is assembled from.
Waitlist
Tell us about your environment.
Aquila is in private beta. Joining the waitlist puts you in front of the people building it, and we will get in touch when there is something worth your time. Free for small teams when it is available.
What you get
A note when the private beta opens, and a short conversation about the environment you described.
When you will hear
When there is something worth your time. We will not email to say we have nothing to say.
What you will not get
No newsletter, no drip sequence, no sales sequence.
You are on the list.
We will email when Aquila is available.