NuGetKeep
NuGetKeep vs BaGet and BaGetter
Both share the same NuGet v3 protocol. Here is what each one actually covers.
BaGetter is a good, free NuGet server, actively maintained — and NuGetKeep's own v3 routes are modeled on its structure. If a private feed is all you need, BaGetter is enough. What follows says precisely where it stops.
| Capability | BaGet / BaGetter | NuGetKeep |
|---|---|---|
| Upstream maintenance | BaGet (loic-sharma/BaGet) hasn't published a release since v0.4.0-preview2 on 2021-09-23. Verify source (checked 2026-07-29) → | NuGetKeep ships dated releases on its public distribution channel — nugetkeep-install v0.5.0 on 2026-06-12. Verify source (checked 2026-07-29) → |
| Supply-chain quarantine | Not provided | Every pushed package is scanned for known vulnerabilities via OSV; a version whose findings meet the configured severity threshold is quarantined — held back from search and restore — until an admin reviews it. Verify source (checked 2026-07-29) → |
| Keyless publishing (OIDC) | Not provided | CI exchanges a GitHub or GitLab OIDC token for a short-lived push key — nothing long-lived to store or leak. Verify source (checked 2026-07-29) → |
| SSO / OIDC and role-based access control | Not provided | Sign in via Entra ID, Okta, Google, Keycloak, or any OIDC-compliant provider, with role-based access control (Reader / Publisher / Admin). Verify source (checked 2026-07-29) → |
| Scoped API keys | BaGetter's ApiKeys array supports multiple keys — useful for multiple teams — but none can be restricted: every key grants the same, unscoped push access. Verify source (checked 2026-07-29) → | A key can be restricted to a package-name pattern and to specific operations (e.g. push-new-id vs. push-version) — least-privilege publishing. Verify source (checked 2026-07-29) → |
| Multiple isolated feeds | Not provided | Multiple isolated feeds, each with its own access control and v3 index — one feed per team, product, or environment without standing up separate servers. Verify source (checked 2026-07-29) → |
Every claim above about a third-party project links to the primary source it was checked against, and the date it was checked. Nothing here is asserted without one.
When a private feed isn't the whole job
Community is free to self-host, and already includes SSO/OIDC with role-based access control — the row above that matters most against BaGetter. Team adds the supply-chain quarantine and keyless publishing; Enterprise adds scoped API keys and multiple isolated feeds.
See pricing