Add a mirror to settings.xml with mirrorOf set to an asterisk, pointing at your repository manager. Maven then sends every repository request there, including ones declared inside dependency POMs. The manager proxies Central and holds your own artifacts, giving you one place to log, filter and block.
Why one door matters
Without a mirror, each POM can add repositories, and Maven will try them. Every extra source is another place an artifact might come from. Maven's own mirror guide lists reasons to use a mirror, including replacing a repository with an internal one you control and running a repository manager as a local cache. Route all of it through one URL and you have a single place to apply rules.
The setting
In the user settings file at settings.xml in the .m2 folder of your home directory, or in a shared settings file for CI:
<settings>
<mirrors>
<mirror>
<id>internal-repository</id>
<name>Repository manager</name>
<url>https://repo.mycompany.com/proxy</url>
<mirrorOf>*</mirrorOf>
</mirror>
</mirrors>
</settings>
The guide notes that this works well when the manager proxies the external repositories and the repository must contain all desired artifacts or be able to proxy them. Use an HTTPS URL, which also avoids the block described in why Maven blocks HTTP repositories.
Advanced selectors
| Value | Matches |
|---|---|
| star | All repository ids |
| external:star | All repositories except localhost or file based ones |
| external:http:star | External repositories using HTTP, except localhost |
| id1,id2 | A comma separated list of ids |
| !repo1,star | Everything except repo1 |
The guide warns about whitespace. A mirrorOf value with extra spaces, such as an exclamation mark, repo1, comma, space, star, will not mirror anything, while the same list without spaces mirrors everything except repo1. One stray space silently removes the control you thought you had.
Pitfalls to check
- One mirror per repository. Maven does not aggregate several mirrors that share the same mirrorOf, it picks the first match. For a combined view of several sources, use a repository manager.
- Declaration order matters with multiple mirrors. Maven first checks for a mirror whose mirrorOf exactly matches the repository id, then falls back to the first matching wildcard declaration.
- Settings files are per machine. Developers and CI must all use the same one, or you have a gap. Ship a settings file in your build image and document the developer setup.
- Credentials belong in the servers section of settings, not in the URL.
A rollout checklist
- Stand up or pick a repository manager that proxies Central.
- Add the mirror to CI settings first, since CI builds are what you ship.
- Block direct outbound access to public repositories from CI agents so a missing mirror fails loudly.
- Roll the settings file out to developers.
- Turn on logging in the manager so you can answer what version was fetched and when.
Pair it with scanning
A mirror controls where artifacts come from. It does not tell you whether they have vulnerabilities. Safeguard scans the dependencies your Maven builds resolve and can gate pull requests on policy. Free scan: gold.safeguard.sh/scan.
Quick check
Does mirrorOf star also cover repositories declared in dependency POMs?
Yes. A star matches all repository ids, so requests from those declarations are redirected to your mirror too.
Can I list two mirrors for Central for failover?
Maven will not aggregate them. It picks the first match. Use a repository manager for combined or redundant sources.
Sources
Last reviewed: 19 October 2026.
