Admin Dashboard

Vein ships a separate vein-admin binary - a web dashboard for the package catalog, quarantine review, and SBOM inspection.

Running it

cargo run -p vein-admin -- --config vein.toml --bind 127.0.0.1 --port 9400
# or
make admin

Then browse to http://127.0.0.1:9400.

Catalog

Browse cached packages, versions, and platforms across all ecosystems, backed by the same SQLite/PostgreSQL metadata store the proxy uses.

Quarantine review

/quarantine shows quarantine stats and lets you approve or block versions without touching the CLI. See Quarantine for the policy this controls.

CycloneDX SBOM access

Scope today: SBOMs are generated for cached RubyGems. The roadmap extends generation to crates.io and npm.

• Admin dashboard: browse to http://127.0.0.1:9400/catalog/<gem>?version=<version> to preview the generated SBOM and download the JSON.

• Proxy endpoint: fetch it directly from the running proxy without the admin UI:

  GET /.well-known/vein/sbom?name=<gem>&version=<version>[&platform=<platform>]

  Returns a CycloneDX 1.5 document (Content-Type: application/json) with a download-friendly filename. Omit platform for the default ruby build; supply it for native variants (e.g. arm64-darwin).

SBOMs are generated automatically the first time a gem is cached, and refreshed whenever the gem is re-fetched.