# Depsilo

> Open-source, self-hosted dependency proxy and shared cache for development machines, servers, and CI. This entrypoint describes stable v0.11.0.

Canonical URL: https://depsilo.com/llms.txt
Alias: https://depsilo.com/llm.txt
Website: https://depsilo.com/ (Chinese), https://depsilo.com/en/ (English)
Source and releases: https://github.com/depsilo/depsilo

Depsilo sits between existing package managers and upstream registries. It reuses downloaded dependencies, records requests, and can apply configured package policies before delivery. It is not AI-powered: an AI assistant helps install or configure it, while optional MCP tools provide read-only diagnostics.

## Choose the user's starting point

- A web-reading assistant can explain the setup steps. Applying commands or editing this project requires an agent with access to the target terminal and repository. Identify that environment before executing; a local or container URL may refer to a different machine.
- If an instance already exists, reuse its client-reachable URL and configure the current project. Do not create a second service unnecessarily.
- If there is no instance, determine the target operating system, available installation tools, and whether clients run locally or on another machine. Use the documented Docker or binary installation for that environment.
- Read the relevant linked guide before changing settings. Prefer project-level package-manager configuration, preserve lockfiles and integrity checks, and report the files changed and the verification results.
- First-run setup is completed by the user in the Portal. Do not ask them to paste bootstrap tokens, administrator passwords, or API tokens into the AI conversation.
- If this entrypoint or a linked guide cannot be read, ask the user to provide its content rather than inventing commands or endpoints.

## Decide whether a shared cache helps

Local package caches avoid requests on their own machine; CI caches restore selected saved files. Depsilo provides an additional shared dependency endpoint for multiple machines and fresh runners. An install already satisfied by a local cache may send no request to Depsilo. Benefits depend on actual repeated downloads, network paths, and the cost of running a persistent service.

- [Local, CI, and shared dependency caches](https://depsilo.com/en/docs/shared-cache/)

## Start a new instance

The Docker quick start pins the current documented release and persists state:

```sh
docker run -d --name depsilo -p 23333:23333 \
  -v depsilo-state:/root/.depsilo \
  ghcr.io/depsilo/depsilo:0.11.0
```

The named volume contains configuration, SQLite, and the local cache under /root/.depsilo. For an existing installation, follow its upgrade instructions rather than replacing or deleting its state.

For Linux or macOS without Docker, use the binary installation guide. It selects the appropriate v0.11.0 release archive, verifies its SHA-256, installs under ~/.local/bin, and documents foreground startup. Windows archives are linked from the release page. The official Homebrew formula has not been published; use Docker or the binary installer instead.

- [Docker quick start](https://depsilo.com/en/docs/get-started/)
- [Binary installation](https://depsilo.com/en/docs/deployment/#binary)
- [Deployment, persistence, and recovery](https://depsilo.com/en/docs/deployment/)
- [HTTPS and reverse proxy](https://depsilo.com/en/docs/deployment/#https)
- [Stable release v0.11.0](https://github.com/depsilo/depsilo/releases/tag/v0.11.0)

## Complete setup, then verify a request

1. Have the user read the one-time bootstrap token from the service's startup log. For the Docker command above, the log command is `docker logs depsilo`; a foreground binary prints its log in that terminal.
2. Open http://localhost:23333 on the machine running Depsilo. The user enters the token and creates the first administrator. There is no default administrator password.
3. After setup, check readiness:

```sh
curl -fsS http://127.0.0.1:23333/ready
```

4. Send a real metadata request independently of any package manager's local cache:

```sh
curl -fsS --max-time 30 \
  http://127.0.0.1:23333/npm/is-number \
  -o /dev/null -w 'HTTP %{http_code}\n'
```

5. After HTTP 200, find the npm is-number request at the matching time in Admin → Access logs (/admin/logs). This confirms routing of that metadata request; it does not by itself prove artifact cache reuse.
6. Follow the cache-verification guide to request the same artifact twice and inspect the recorded cache results. A successful package installation can reuse a client-local cache without sending any request to Depsilo.

Here localhost and 127.0.0.1 refer to the machine running the service. For other clients, use an address reachable from their environment. The local check uses HTTP; configure HTTPS for the intended remote access path using the deployment guide.

- [Verify cache reuse and download savings](https://depsilo.com/en/docs/verify-cache/)
- [Request diagnosis](https://depsilo.com/en/docs/troubleshooting/)

## Connect a project or agent

Choose the package manager actually used by the project and read its matching guide. Portal-generated instructions use the current instance address; the Portal does not edit client files automatically. Likewise, `depsilo init-agent` generates reviewable project instructions and read-only MCP tools do not configure package managers automatically.

- [ccache and sccache compiler-cache setup](https://depsilo.com/en/docs/compile-cache/)
- [Package-manager configuration and coverage](https://depsilo.com/en/docs/package-managers/)
- [AI setup prompts](https://depsilo.com/en/docs/ai-setup/)
- [Agents and read-only MCP](https://depsilo.com/en/docs/agents-mcp/)
- [Package policies and ecosystem-specific limits](https://depsilo.com/en/docs/supply-chain/)

## Product boundaries

- Core proxy caching, package rules, release-age policy, audit logs, and webhooks are MIT licensed. Multi-project workspaces and runtime project SBOM export are optional Pro features; see https://depsilo.com/en/docs/pro/.
- Run one instance per state store. SQLite metadata remains local even when artifacts use S3; shared-database multi-instance deployment and multi-node HA are not supported.
- Coverage differs across 14 standard package ecosystems plus Docker OCI. Docker and Hugging Face need additional server configuration in this release; proxy support does not imply identical policy coverage.
- Homepage screenshots may show a labeled development build with example data. Do not treat their counters as measured performance, or an unrecorded policy decision as an allowed outcome.

## 中文文档

- [开发机与 CI 共享依赖缓存](https://depsilo.com/docs/shared-cache/)
- [ccache 与 sccache 编译缓存](https://depsilo.com/docs/compile-cache/)
- [快速开始](https://depsilo.com/docs/get-started/)
- [二进制安装](https://depsilo.com/docs/deployment/#binary)
- [HTTPS 与反向代理](https://depsilo.com/docs/deployment/#https)
- [包管理器接入](https://depsilo.com/docs/package-managers/)
- [验证缓存效果](https://depsilo.com/docs/verify-cache/)
- [用 AI 部署与接入](https://depsilo.com/docs/ai-setup/)
- [Agent 与只读 MCP](https://depsilo.com/docs/agents-mcp/)