Nexus One Platform

What it does

Nexus One Platform is a software supply chain management platform that controls which open source components and AI models enter enterprise software. It unifies the Nexus Repository artifact manager, Lifecycle Software Composition Analysis (SCA), Firewall malware blocking, Guide dependency intelligence, and SBOM Manager modules on shared Sonatype component intelligence data. The distinctive mechanism is enforcement at the repository layer, applying policy where developers and AI coding agents actually pull dependencies rather than only scanning after the fact.

How it works

The platform sits between public ecosystems and development teams. Nexus Repository proxies and stores components and AI models across 20+ formats, while Firewall evaluates newly published packages and automatically quarantines malicious or suspicious ones before download. Lifecycle resolves direct and transitive dependencies, applies a policy engine with 18 default policies and over 30 customizable constraints, and opens golden pull requests that upgrade components to safe versions without breaking builds. SBOM Manager ingests, generates, and monitors CycloneDX and SPDX SBOMs with Vulnerability Exploitability eXchange (VEX) annotations, and Guide exposes component health scores to AI coding assistants through an MCP server.

Credentials and traction

SOC 2 Type II attested, with the Sonatype Cloud service also ISO 27001 certified. Sonatype was named a Leader in the 2026 Gartner Magic Quadrant for Software Supply Chain Security and a Leader in the 2024 Forrester Wave for Software Composition Analysis (SCA). The maintainer of Maven Central, Sonatype serves nearly 2,000 organizations, including 70% of the Fortune 100, targeting enterprise engineering and platform teams.