Toran Proxy was a PHP-based Composer proxy created by Jordi Boggiano, the creator of Composer itself. It cached packages from packagist.org for faster installs and hosted private packages via VCS repositories. It was beloved by PHP teams for giving them control over their dependency pipeline.
Toran was discontinued in 2020. Its license server went offline, it never received Composer v2 support, and existing installations have gone unpatched for years. Many teams moved to Private Packagist (cloud-only, pay-per-user) or went back to Satis (no proxy, manual rebuilds).
Cargoman fills the gap Toran left behind — with a modern Rust runtime, built-in supply chain security, and features Toran never had.
Everything Toran did, plus everything it didn't
| Feature | Toran Proxy | Cargoman |
|---|---|---|
| Status | Discontinued (2020) | Actively maintained |
| Language | PHP | Rust (single binary, ~20MB RAM) |
| Packagist Proxy | Cache + mirror | Cache + mirror with LRU eviction |
| Private Packages | Basic VCS hosting | Full registry with webhook sync |
| Version Freezing | Not available | Time Machine: freeze any version permanently |
| Supply Chain Security | None | Force-push detection with SHA mismatch alerts |
| Vulnerability Scanning | None | Built-in (Pro+) |
| UI / Dashboard | Basic web interface | Full admin dashboard with analytics |
| Authentication | HTTP basic auth | Token-based with RBAC, SSO/LDAP, scoped tokens |
| Git Providers | GitHub, Bitbucket | GitHub, GitLab, Bitbucket + GitHub App |
| Customer Management | None | Full customer lifecycle (suspend, freeze, expire) |
| API | None | REST + GraphQL |
| Multi-Tenant | Single instance | Full multi-tenant with isolation |
| Composer Protocol | v1 | Full v2 support |
| Deployment | Self-hosted only (PHP stack) | Self-hosted (single binary) or fully managed Cloud |
| Cost | Was $55/year (personal) or $250/year (business) | Free tier available, Pro from $29/mo |
The features senior PHP developers wished Toran had
Toran Proxy ran on PHP-FPM and needed a full LAMP/LEMP stack. Cargoman is a single Rust binary that uses ~20MB of RAM. No PHP runtime, no Nginx, no Composer dependencies. Download it, run it, done.
Freeze any package version permanently. Frozen versions never expire, never get evicted from cache, and are always available — even if the upstream removes them. Lock down your production dependencies with confidence.
Cargoman detects when upstream package archives change unexpectedly (force-push, tag rewrites). You get alerts on SHA mismatches before malicious code reaches your CI/CD pipeline. Plus built-in vulnerability scanning on Pro.
If you still have a Toran Proxy instance running, switching is straightforward
Run the Docker image or download the binary. Configure your Packagist proxy settings. Cargoman starts caching immediately.
Add your Git repository URLs to Cargoman. Webhooks auto-sync all tags and branches. No manual satis-style rebuilds.
Swap the Toran repository URL for your Cargoman URL. Generate auth tokens for your team. Your composer.lock stays valid.
Toran was ahead of its time. We built on its best ideas.
Toran understood that depending on packagist.org for every composer install was a fragility. Local caching gave teams faster builds and outage resilience. Cargoman continues this philosophy.
Toran combined a Packagist proxy with private package hosting in a single tool. This made it the only registry most teams needed. Cargoman follows the same unified approach.
Toran was self-hosted, giving teams full control over their dependency infrastructure. Cargoman offers the same with self-hosted Pro, plus a managed Cloud option for teams who prefer zero ops.
Toran Proxy was discontinued in 2020 by its creator Jordi Boggiano (also the creator of Composer). The project stopped receiving updates and its license server went offline. Existing installations still work but receive no security patches or Composer v2 support.
Yes. Cargoman implements the full Composer v2 repository protocol and includes a Packagist proxy with caching — the same core functionality that made Toran popular. You change the repository URL in your composer.json, configure auth tokens, and your workflow continues unchanged.
Yes. The Packagist proxy caches both metadata and ZIP archives with configurable TTLs. It uses LRU eviction to stay within your storage limits and supports freezing specific versions permanently via the Time Machine feature.
Absolutely. The free Community edition includes the Packagist proxy. You can use Cargoman purely as a caching proxy for faster CI/CD installs and Packagist outage protection, with no private packages required.
Time Machine lets you freeze specific package versions in your local cache. Frozen versions are pinned permanently — they survive cache eviction, TTL expiry, and upstream deletions. This guarantees your builds always have access to the exact versions you depend on.
Yes. Unlike Toran Proxy which only supported Composer v1, Cargoman fully implements the Composer v2 metadata protocol for faster dependency resolution and smaller metadata payloads.
Cache packagist.org, host private packages, freeze versions permanently. All in a single Rust binary that starts in milliseconds.