docker run -p 8080:8080 registry.mcp-registry.de/mirror:stableRun the container, give it a storage path and an upstream URL, and point one client at it. The defaults assume a single node with local disk, which is adequate well past the point most teams expect. Multi-node deployments share an S3-compatible bucket and need no coordination service between them.
Each supported ecosystem has its own prefix path. Clients are pointed at that prefix and otherwise behave normally, including authentication, scopes and lockfiles. Nothing about your existing dependency files has to change.
Tokens are per project and carry the namespaces that project may reach. A token that attempts an artefact outside its allow list gets a 403 and an audit entry. Tokens can be rotated without a restart, and the previous token stays valid for a configurable grace period.
The provenance API answers two questions that come up during incident response: which artefacts did this project pull, and which projects pulled this artefact. Both are answerable for the full retention period, not just for what is currently in cache.
The export command walks a lockfile, collects every artefact it references, and writes a signed bundle. Import verifies the signature and populates the store. Builds on the disconnected side then run without any upstream access at all.