Git hosting, CI/CD, container & package registries, supply chain security, and governed AI-agent access — one Go binary on your infrastructure. Ready for your regulators. Ready for your agents.
One binary + PostgreSQL. docker compose up and you're hosting.
Why now
Where your code lives used to be a tooling preference. In 2026 it's a regulatory question, a security question, and an AI question — all at once.
GDPR, NIS2, DORA, and data-residency regimes across the EU and APAC are pushing regulated teams off US-hosted code platforms — while cloud pricing climbs and enterprises grow uneasy about source code sitting near third-party AI training pipelines.
The EU Cyber Resilience Act, US EO 14028, and CMMC 2.0 are turning SBOMs and build provenance into procurement requirements. Most platforms sell that capability as a premium tier. Auditors don't care what tier you bought.
Coding agents now pick up issues, open merge requests, and run pipelines. Every one needs access to your code — and an ungoverned agent endpoint is the new unvetted dependency. Someone has to hold the keys and keep the log.
The platform
git push and production. One binary.Vetrix serves the git transports, the web API, the OCI and package registries, and the CI/CD control plane from a single Go binary against PostgreSQL. No microservice sprawl. No 8 GB-RAM minimums. No bolt-on runners to babysit.
The collaboration layer your team already knows — without leaving your network.
Pipelines trigger in-process on push and run in Docker-isolated workers. Artifacts land in the built-in OCI and package registries — no Jenkins to maintain, no external registry bill, no glue code between five vendors.
Branch-order promotion chains gate merges on the pipeline of the previous stage, so dev → staging → main is enforced by the platform, not by convention.
Supply chain security
Elsewhere, provenance and SBOMs are an "Ultimate tier" line item. In Vetrix they're what the default install does.
The regulatory clock
SBOMs baked into US federal procurement. Selling to government means proving what's in your software.
Vulnerability and incident reporting obligations take effect for products with digital elements on the EU market.
Remaining obligations — including SBOM readiness — land. Teams that wired provenance into the build years earlier will barely notice.
Built for the agent era
Claude Code, Codex, Copilot — whichever agents your team runs, they connect to a native Model Context Protocol endpoint that inherits the platform's permission model. Not a community plugin. Not a sidecar. A platform primitive.
Every repository exposes a streaming MCP endpoint. Every tool call an agent makes passes through the exact same chain as a human request:
When the security review asks "what can the agents touch, and where's the log?" — you open a page instead of a war room.
The honest comparison
Lightweight alternatives are thin on compliance. Heavyweight platforms gate security behind their top tier. Vetrix ships the whole factory, standard.
| Capability | Vetrix | GitHub Enterprise | GitLab | Gitea / Forgejo |
|---|---|---|---|---|
| Self-hosted footprint | Single binary + Postgres | Appliance, enterprise pricing | Heavy (4–8 GB RAM min.) | Lightweight |
| License & source access | Source available (PolyForm Shield 1.0.0)full source; commercial license available | Proprietary, closed source | Open core, paid tiers | MIT / GPL |
| Integrated CI/CD + deploy environments | Built in, incl. blue/green | Actions | Built in | Actions-compatible, thinner |
| OCI + npm / PyPI / Go registries | Built in, same binary | Included | Included | Included |
| SLSA attestation + SBOM + scan policy | Standard, default install | Advanced Security add-on | Ultimate tier | Not built in |
| Secret scanning at pre-receive | Standard | Add-on | Higher tiers | Limited |
| Native MCP server, ACL-scoped & audited | Every repo, out of the boxauth → ACL → audit → rate-limit | Separate MCP offering | Via integrations | Community efforts |
Competitor capabilities and tiers as generally available mid-2026; verify current vendor packaging for your evaluation.
Who runs Vetrix
25–500 developers under CRA, NIS2, DORA, or CMMC pressure. You need self-hosting and provenance without an Ultimate-tier invoice or a dedicated team just to keep the platform alive.
You're rolling out Claude Code or Codex across the org and the CISO wants one answer to "how do agents access code?" Vetrix is that answer: scoped, audited, rate-limited, on your hardware.
One VM, one binary, and you've replaced your git host, your CI vendor, your container registry, and your package registry — under your own domain, at your own cost curve.
Get started
Clone it, bin/dockerbuild, and create your admin account — the whole factory is running before your coffee cools. Free for commercial use under the PolyForm Shield License; a commercial license is only needed to build a competing product.
Questions
Go binary (or the Docker image), PostgreSQL 16+, and optionally Redis and Docker for CI workers. The main service runs comfortably on a small VM — this is a single Go process, not a fleet of microservices.
Vetrix is made available under the PolyForm Shield License 1.0.0. The full source is available to read, audit, and self-host, and use is free for any purpose — personal projects, commercial deployments, education, research, and evaluation alike. Only building a product that competes with Vetrix requires a commercial license; contact us for pricing. There is no feature split: every deployment runs the same complete platform, including the supply chain security features and the MCP server.
Agent requests travel the same middleware chain as human requests: authentication, per-repo ACL resolution on every tool call, the shared audit log, and rate limiting. Toolsets (repo, issues, search) are selectable per session, and permission is re-resolved on every call — no long-lived session privileges.
Vetrix generates the artifacts those regimes ask about — SBOMs, signed SLSA attestations, scan results, and audit logs — as part of the normal build. Compliance is ultimately about your whole organization, so treat the platform as the evidence engine, and confirm your specific obligations with your compliance counsel.
Yes — repository mirroring handles code (with credentials encrypted at rest), and the migration guides cover issues and CI translation. Vetrix CI uses the GitHub Actions workflow format, so most pipelines port with minimal changes.
Self-hosting is the flagship path and always will be. If you'd rather not operate it yourself, contact us about managed deployments.