---
title: "PackageMaze — every package, one feed, your rules"
description: "Private npm and PyPI feeds that host your packages, front the public registries, and enforce your rules — with a record of every package PackageMaze delivered, attributed to a human or agent."
canonical: https://www.packagemaze.com/
---

> Documentation index: https://www.packagemaze.com/llms.txt

# Host, control, and track every package

Your private packages and the public registries behind one Feed. Every install follows the rules you set, and every version is on record.

PackageMaze is a hosted package registry for an Organization's npm and Python packages. A Feed is one registry address under pkg.packagemaze.com that serves the packages you publish and the public packages your policy allows from npmjs.com or pypi.org, so npm, pnpm, pip, uv, Poetry, CI jobs, and coding agents install through one URL and existing lockfiles stay valid.

Policy runs before delivery: a Minimum Age Policy holds new upstream releases (24 hours by default), and License, Install Scripts, Distribution Format, and Reserved Package Namespace rules decide what a Feed serves. Every delivered version is recorded with who requested it, a person, a CI run, or an agent.

People sign in with GitHub. GitHub Actions and CircleCI exchange OIDC identity for short-lived Feed access instead of stored secrets. Any MCP-capable agent connects at https://api.packagemaze.com/mcp with OAuth consent scoped to one Organization and its Feeds; connected agents do not count as seats.

## Every install takes the same path

Upstream registries and your own publishes arrive at one Feed. Policy decides what passes, and the address your clients use never changes.

1. **Upstream**: npm and PyPI, plus anything you publish yourself
2. **Policy**: Release age, licences, allowlist, one version per package
3. **Your Feed**: One address for every package your team can install
4. **Install**: Developers, CI, and agents, all through the same Feed

## Agents install through the same Feed

An agent gets the versions your policy allows and nothing else. A release held for review is held for a coding agent too, and every version it takes is recorded under its own name.

Works with Claude Code, Codex, Cursor, GitHub Copilot, GitHub Actions, and CircleCI.

Connect an agent over MCP: [Connect your agent](https://www.packagemaze.com/docs/connect-your-agent/). Point an agent at this site: [Agent quickstart](https://www.packagemaze.com/docs/agent-quickstart/).

## Three steps to your first install

No cluster to run and no migration. Developers keep typing the commands they already type.

### 1. Create a Feed

Sign in with GitHub. PackageMaze picks up your Organization, and each Feed gets its own address.

```
https://pkg.packagemaze.com/acme/npm
```

### 2. Point your client at it

One registry line in the repository's .npmrc, or your client's equivalent. Lockfiles stay valid, and nothing else changes.

```
registry=https://pkg.packagemaze.com/acme/npm/
```

### 3. Install

The Feed serves your private packages and the upstream ones your policy allows, from the same address.

```
npm install
```

In GitHub Actions, add `uses: packagemaze/setup-maze@v0.0.5` instead of storing a Token. The step exchanges GitHub’s OIDC token for short-lived Feed access.

## Connect your GitHub Organization

Access is free while pricing is being settled, and joining now sets your price for later.

- [Request access](https://www.packagemaze.com/login)
- [Talk to the founder](mailto:support@packagemaze.com?subject=PackageMaze%20setup%20conversation)