Maven Central Publish Gate

It reads a pom.xml and reports every line that the Maven Central Portal will reject at upload: the retired oss.sonatype.org endpoint, nexus-staging-maven-plugin, SNAPSHOT versions and SNAPSHOT dependencies, missing name, description, url, licenses, developers or scm blocks, missing gpg, sources and javadoc plugins, plain http repositories, and system-scoped dependencies. Sixteen rules, each with the fix on the same line.

Java and Kotlin library maintainers who publish to Maven Central from their own build rather than through a release platform. That means one-person open source projects, small platform teams shipping an internal SDK to Central, and anyone who inherited a pom.xml written when oss.sonatype.org still accepted releases and has not cut a release since.

mvn verify passes on a pom that Central rejects, because the Portal validates metadata that Maven itself never needs. A chatbot answers from training data that still describes the OSSRH staging flow Sonatype closed on 2025-06-30. The Portal itself only tells you after you upload, and only about the first thing it hits.

Free is complete for one file: open a pom.xml, get every blocker on it, fix them, ship. The licence key changes scope and ownership. It gates every pom.xml in a multi-module repository in one command, and writes the result to a REPORT.md file you keep and can attach to the release or a compliance record.

A freelance Java release engineer bills about $80 an hour. The real cost is not the review though, it is the round-trip: a rejected bundle means you retag, rebuild, re-sign and re-upload, and any version number you already burned on a failed release is gone from that repository forever.