- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Sonatype
The people who run Maven Central, selling the repository, the firewall and the SCA— with a free edition to start and published prices for most of the rest. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Three intel pages. One repository at the centre.
What a new buyer can purchase from Sonatype today — every linked card is a full intel page, from the repository to the SCA that replaced Lifecycle.
Sonatype Nexus Repository
From the people who run Maven Central.
20+ formats from Maven and npm to Docker and Hugging Face, self-hosted or cloud. The free Community Edition is capped; Pro is not.
Sonatype Repository Firewall
Stops a malicious package before a build pulls it.
Quarantines risky open-source packages at the proxy. Firewall Pro guards non-Nexus repositories; self-hosted goes air-gapped.
Sonatype Guide
Dependency intelligence where the code is written.
SCA for AI-assisted coding: an MCP server steers assistants to safe versions, with Enterprise governance and SBOMs replacing Lifecycle.
Sonatype sells across 3 of the products TechBag carries in DevOps. The DevOps guide shows how the category splits and which part is yours. →
Why “Maven Central” is the whole story
Most software is assembled from open-source components pulled from public registries, and the registry is where malicious packages arrive. Sonatype bet on owning the point where components enter— the repository, the firewall in front of it and the intelligence behind both — from the company that has maintained Maven Central since 2008.
Maven Central
Sonatype maintains the largest Java open-source repository, and moved all publishing to the Central Publisher Portal in 2025.
Nexus One
The umbrella launched in November 2025 over Repository, Firewall and Guide — a name for the platform, not a separate licence.
Intelligence
Sonatype's vulnerability and malware research feeds the firewall's block decisions and Guide's version advice alike.
SAGE
A bundle of the self-hosted products plus a data service for networks with no internet — how regulated estates run it.
Start with Nexus Repository; the Firewall guards what it proxies and Guide governs what you ship.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Leader — Software Supply Chain Security
the first edition, 18 June 2026
Leader — SCA Software Wave
also a Leader in Q2 2023
Steward
the largest Java open-source repository
70% of the Fortune 100
Sonatype's own figure at the time
Hyderabad Innovation Center
opened June 2025, 200+ staff
Vista Equity Partners
since 2019; revenue not disclosed
The company in six figures
See the platform, hear the pitch
How to Migrate Nexus Repository OSS to Community Edition
From the old OSS edition to Community Edition.
Secure Your Containers with Sonatype Repository Firewall
The firewall on container images.
Where Sonatype sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Sonatype Across Its Solution Areas
Each dot is a Sonatype solution area: competitive position vs category momentum.
Nexus Repository; free edition to Pro.
Repository Depth × Supply-Chain Controls
How deep the repository is vs how much supply-chain control — blocking, SCA, policy — sits on top of it.
Repository plus firewall plus SCA, Maven Central roots.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Sonatype?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is forcing the decision?
2. Who is asking for it?
3. What do you already run?
What a repository manager is for
One cache of every package your builds pull — repeatable builds and one place to apply policy.
Read →Community Edition or Pro?
The free edition pauses new components past 40,000. Know your count before you rely on it.
Read →Firewall vs scanning
The firewall stops a malicious package being downloaded; scanning finds it after it arrived.
Read →Why Guide replaced Lifecycle
New buyers get SCA, policy and SBOMs through Guide; Lifecycle is for existing customers.
Read →Which analyst reports, which year
Gartner SSCS Leader, June 2026. Forrester SCA Leader, Q4 2024 — not a later Wave.
Read →Hyderabad office, and where data sits
Mumbai and Hyderabad appear in the cloud docs; confirm storage for your tenant in writing.
Read →The acronym decoder
Every term on these pages, in one place- Sonatype
- Software supply chain company in Fulton, Maryland; steward of Maven Central.
- Maven Central
- The largest Java open-source repository, maintained by Sonatype.
- Nexus Repository
- Sonatype's repository manager, free Community Edition or Pro.
- Community Edition
- The free, self-hosted Nexus Repository, capped at 40,000 components.
- Proxy repository
- A cached copy of a public registry such as npm or Maven Central.
- Repository Firewall
- Blocks or quarantines risky packages at the proxy, before download.
- SCA
- Software composition analysis: finding risk in open-source dependencies.
- Sonatype Guide
- Sonatype's SCA product for new buyers, including AI assistant integration.
- Lifecycle
- Sonatype's former SCA product; existing customers only.
- SBOM
- Software bill of materials — the list of components inside a release.
- MCP
- Model Context Protocol: how Guide feeds package advice to AI coding assistants.
- SAGE
- Sonatype's air-gapped bundle for networks with no internet access.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Count components before relying on free
Community Edition pauses new components past 40,000 or 100,000 requests a day. Measure your estate before building on it.
Choose cloud or self-hosted Pro
Pro Cloud is $1,950 a year plus consumption over 25 GB; Pro Self-Hosted is $7,500 a year with 50K components included.
Place the firewall where downloads happen
On non-Nexus repositories, Firewall Pro handles npm, Maven, PyPI and NuGet; the self-hosted edition covers more and runs air-gapped.
Buy Guide, not Lifecycle
New customers purchase Sonatype Guide for SCA, policy and SBOMs. Lifecycle is for existing customers adding licences.
Get storage in writing
Sonatype's docs list Mumbai and Hyderabad storage regions for Nexus Repository Cloud. Confirm them for your tenant, in the contract.
Price the platform together
Repository, Firewall and Guide share one intelligence source. TechBag models the mix and quotes in INR with GST.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Nexus Repository | Free edition, or Pro per year | Pro Cloud $1,950/yr + usage · $7,500/yr self-hosted | One package cache |
| Repository Firewall | Per year; self-hosted by quote | Firewall Pro $4,800/year | Block malicious packages |
| Sonatype Guide | Credits per year; Enterprise quote | Free · Pro $1,200/year | SCA for new buyers |
Annual tiers with published prices for most products; Enterprise and self-hosted Firewall by quote — TechBag models the mix and quotes in INR with GST.
Five pitfalls that cost buyers quarters
Building on the free edition's old limits
Community Edition's caps fell to 40,000 components and 100,000 requests a day in December 2025. Past them, new components pause.
Buying Lifecycle as a new customer
Sonatype sells SCA to new buyers as Guide. A quote for Lifecycle means an existing contract, or an out-of-date one.
Putting Firewall Pro in front of Nexus
Firewall Pro is built for repositories other than Nexus. Nexus estates, or air-gapped ones, need the self-hosted Firewall.
Reading a region as residency
Mumbai and Hyderabad appear in Sonatype's cloud storage docs. That is not a written commitment — put storage in the contract.
Mixing up the analyst years
Gartner SSCS Leader is 2026; the Forrester SCA Wave Leader is Q4 2024. Neither report says more than 'a Leader'.
The evaluation kit
Each intel page carries an 8-question vendor checklist and a value calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Four trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**TechBag’s illustrative estimate, not a quoted analyst figure. The takeaway: supply chain security is where new budget is going — which is why the firewall and Guide are worth pricing early.
Malicious packages outpace CVEs
Sonatype counts over 1.2 million malicious OSS packages.
What it means for you
Blocking at download joins scanning after.
AI assistants pick dependencies
Coding agents choose package versions themselves.
What it means for you
Hence Guide's MCP server steering them to safe ones.
Registries meter heavy users
Maven Central limits high-volume publishers from October 2026.
What it means for you
A local repository cache matters more.
Supply chain security gets its own MQ
Gartner published the first one in June 2026.
What it means for you
The category now has its own budget line.
Questions buyers ask about Sonatype
Ready to shortlist Sonatype?
Open any of the three intel pages for the deep dive, or let a TechBag advisor build the case with you — component counts, edition and firewall scoping, quotes, trials, GST invoicing and lifecycle support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.