Unified tools for Mercurial, Git and Subversion.
RhodeCode is an open source repository management platform. It provides unified security and team collaboration across Git, Subversion, and Mercurial. Developers get unified code review and automation with a common set of tool integrations across all repositories.
- 01 Repository management CE
- 02 Pull requests & inline review CE
- 03 Reviewer rules EE
- 04 Fine-grained permissions CE
- 05 Enterprise authentication EE
- 06 Indexed code search EE
- 07 Web file editor & snippets CE
- 08 REST API, hooks & rcextensions CE
- 09 Prebuilt integrations EE
- 10 RCstack deployment CE
Technical specification
RC-PLAT · rev 5.14.0What it speaks, what it runs on and what it will hold — the questions an architect asks before a feature list matters.
Full requirements and tuning guidance in the system administration docs.
Fits the toolchain you already paid for
Integrate an existing code base with new tools and issue trackers. Automate your workflow to implement faster.
- 01 Commit git commit -m "fixes #PAY-142"
- 02 RhodeCode The push matches the fixes pattern
- 03 Jira PAY-142 moves to Resolved
- 01 Commit hg commit -m "fixes #812"
- 02 RhodeCode The push matches the fixes pattern
- 03 Redmine Issue #812 is resolved
- 01 Pull request Opened, or updated with new commits
- 02 RhodeCode Triggers the job with the pull request's shadow URL
- 03 Jenkins A post-build script reports the result on the pull request — approved or rejected
- 01 Push Commits land on a branch
- 02 RhodeCode The CI integration calls Bamboo's trigger URL as a generic webhook
- 03 Bamboo Builds the branch head
- 01 Event A push, or pull request activity
- 02 RhodeCode Posts to the channel's incoming webhook
- 03 Slack The team sees it in the channel
- 01 Push Commits pushed to the repository
- 02 RhodeCode Renders the pushed commits into a message
- 03 Inbox Recipients get the commit list by email
- 01 Event A push, or pull request activity
- 02 RhodeCode POSTs the event as JSON to your URL
- 03 Your service Reacts however you wrote it to
- 01 Script Calls the API with a user's auth token
- 02 RhodeCode Runs it with that user's permissions — repos, users, pull requests
- 03 Result Returned as JSON
Capability dossiers
One review workflow, whichever VCS the team chose.
Reviewer rules pick the right people from the paths a changeset touches, then hold the merge until policy is satisfied — identically on all three systems.
- Path-based reviewer rules with required approval counts
- Split and unified diffs with per-file review tracking
- Built-in review chat beside the diff, not in another tool
- Signed-commit and branch-protection enforcement
- Scope
- All three VCS
- Rules
- Glob paths → owner groups
- Gate
- Blocks merge until met
Control access without compromising, at any granularity.
Grant at five levels; inheritance flows down and explicit denies always win. Bind subjects to IP ranges so a leaked credential is not enough.
- Path-based permissions, including inside Mercurial repositories
- Per-subject IP restrictions and VPN-only access
- Access simulation before a change is committed
- Immutable audit log with 7-year default retention
- Levels
- Global → group → repo → user
- Conflicts
- Explicit deny wins
- Auth
- LDAP · AD · SAML · CAS · OAuth · 2FA
Find code across everything you own.
Indexed full-text search across every repository, commit, comment and snippet — always filtered through the searcher's own permissions.
- Indexed search, not repository-by-repository grep
- Results filtered by the searcher's own permissions
- Searches inside comments, gists and artifacts
- Jump-to navigation from anywhere with one shortcut
- Index
- Whole-instance, incremental
- Latency
- Sub-100 ms typical
- Scope
- Code · commits · comments · gists
Fits the toolchain you already paid for.
Ready-made integrations for the enterprise stack, event hooks for everything else, and a REST API that covers the whole platform.
- Jira, Redmine and third-party issue trackers
- Jenkins, Bamboo and generic CI via webhooks
- Slack and email notification routing
- Full REST API plus server-side event hooks
- Trackers
- Jira · Redmine · custom
- CI
- Jenkins · Bamboo · webhooks
- Hooks
- Pre/post push, pull, merge
Installable, upgradable, yours.
RCstack installs and upgrades in containers, so host OS changes never break your instance. Scales out, or runs fully air-gapped.
- One command to install, upgrade or roll back
- High availability with parallel instances and shared storage
- Multi-node horizontal scaling for large deployments
- Fully offline installation for classified networks
- Installer
- RCstack, containerised
- Databases
- PostgreSQL · MySQL · SQLite
- HA
- Parallel instances + LB
Small changes without a clone.
Edit files in the browser with syntax support and land the result in a policy-compliant pull request — no clone for a one-line fix.
- Syntax-aware editing in the browser
- Commits land in a pull request, not straight to a branch
- Same reviewer rules and protections apply
- Snippets and gists for shareable fragments
- Scope
- All three VCS
- Output
- Pull request, policy-checked
- Extras
- Snippets · artifact store
Permission resolver
Choose a subject and a target. The resolver evaluates the same order the product does: global default, then repository group inheritance, then the repository grant, then path rules, then explicit deny, then the IP restriction. Deny always wins.
- 01 Global defaultRegistered users get read on organisation-open repositories. read
- 02 Repository groupInherited from the parent group grant. write
- 03 Repository grantGrant set directly on the repository overrides inheritance. admin
- 04 Path ruleGuarded path, but no path restriction for this subject. admin
- 05 Explicit denyNo explicit deny recorded. admin
- 06 IP restrictionRequest originates inside 10.20.0.0/16. allowed
Administrative access on the repository, inherited grant superseded by a direct grant.
- Subject
- Payments Owners
- Repository
- payments/ledger-api
- Path
- src/settlement/ledger.py
- IP binding
- 10.20.0.0/16
- Audit entry
- access.admin
The product ships this as access simulation — run it against a real user before you commit a permission change, and again afterwards to prove what changed.