jdx · jdx · May 2, 2026 · May 2, 2026 · May 2, 2026 · May 2, 2026
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -38,7 +38,17 @@ Before touching `registry/`, ALWAYS do the following:
 5. **If the tool is borderline or numbers are low, warn the user clearly** that the PR is likely to be rejected without reason, and ask if they still want to proceed. Do not soften this — users have repeatedly been surprised when their PR was closed, and the agent should have warned them up front.
 6. **Suggest the alternative:** users can install any tool themselves via explicit backend syntax (`mise use aqua:owner/repo`, `mise use github:owner/repo`, `mise use cargo:name`, `mise use npm:name`, etc.) or by writing a [tool plugin](https://mise.en.dev/tool-plugin-development.html). The registry is *only* for shorthand convenience for popular tools — not for enabling installation.
 
-New asdf plugins are also not accepted; use aqua/github backends.
+### Backend choice: aqua (preferred) or github
+
+For registry entries, **only `aqua:` and `github:` are routinely accepted.** Every other backend (`vfox:`, `asdf:`, `npm:`, `pipx:`, `cargo:`, `gem:`, `go:`, `ubi:`, etc.) has an **extremely high** bar — these are rarely accepted into the registry and submitting one without prior agreement from @jdx is almost certain to be rejected.
-For registry entries, **only `aqua:` and `github:` are routinely accepted.** Every other backend (`vfox:`, `asdf:`, `npm:`, `pipx:`, `cargo:`, `gem:`, `go:`, `ubi:`, etc.) has an **extremely high** bar — these are rarely accepted into the registry and submitting one without prior agreement from @jdx is almost certain to be rejected.
+For registry entries, **only `aqua:` and `github:` are routinely accepted.** Every other backend (`vfox:`, `asdf:`, `npm:`, `pipx:`, `cargo:`, `gem:`, `go:`, etc.) has an **extremely high** bar — these are rarely accepted into the registry and submitting one without prior agreement from @jdx is almost certain to be rejected.
-For registry entries, **only `aqua:` and `github:` are routinely accepted.** Every other backend (`vfox:`, `asdf:`, `npm:`, `pipx:`, `cargo:`, `gem:`, `go:`, `ubi:`, etc.) has an **extremely high** bar — these are rarely accepted into the registry and submitting one without prior agreement from @jdx is almost certain to be rejected.
+For registry entries, **only `aqua:` and `github:` are routinely accepted.** Every other backend (`vfox:`, `asdf:`, `npm:`, `pipx:`, `cargo:`, `gem:`, `go:`, etc.) has an **extremely high** bar — these are rarely accepted into the registry and submitting one without prior agreement from @jdx is almost certain to be rejected.
+
+- **Prefer `aqua:`** when the tool is in the [aqua registry](https://github.com/aquaproj/aqua-registry). It has better UX, SLSA verification, and per-version logic. This is the recommended default.
+- **Use `github:`** when the tool isn't in the aqua registry but ships GitHub releases.
+- **New `asdf:` plugins are not accepted** — supply-chain security. Use aqua/github instead.
+- **New `vfox:` plugins are not accepted either** — same reason. Use aqua/github instead.
+- **`ubi:` is deprecated and will not be accepted** under any circumstances. Use aqua/github instead.
+- **Do not reach for `npm:`/`pipx:`/`cargo:`/`go:`/etc.** for a registry PR unless the user has explicitly confirmed @jdx wants it that way for this specific tool. Even very popular tools have been rejected when proposed with one of these backends.
+- Users can still install via any backend themselves with explicit syntax (`mise use vfox:...`, `mise use cargo:...`, etc.) — they just don't get a registry shorthand for it.
 
 ## Development Commands
 

diff --git a/docs/asdf-legacy-plugins.md b/docs/asdf-legacy-plugins.md
@@ -1,7 +1,9 @@
 # asdf (Legacy) Plugins
 
 ::: warning
-asdf plugins are considered legacy. For new tools, prefer [vfox plugins](/dev-tools/backends/vfox.html) which are written in Lua, work cross-platform (including Windows), and have access to built-in modules. See the [feature comparison](/dev-tools/backends/asdf.html#feature-comparison-asdf-vs-vfox) and [hook migration table](/dev-tools/backends/asdf.html#hook-migration-asdf-to-vfox) for details.
+asdf plugins are considered legacy. **New asdf and vfox plugins are not accepted into the [mise registry](https://github.com/jdx/mise/blob/main/registry/) for supply-chain security reasons** — for registry submissions use the [aqua](/dev-tools/backends/aqua.html) (preferred) or [github](/dev-tools/backends/github.html) backend instead.
+
+If you are writing a private/custom plugin (not for registry submission), prefer [vfox plugins](/dev-tools/backends/vfox.html) over asdf — they're written in Lua, work cross-platform (including Windows), and have access to built-in modules. See the [feature comparison](/dev-tools/backends/asdf.html#feature-comparison-asdf-vs-vfox) and [hook migration table](/dev-tools/backends/asdf.html#hook-migration-asdf-to-vfox) for details.
 :::
 
 mise maintains compatibility with the asdf plugin ecosystem through its asdf backend. These plugins are considered legacy because they have limitations compared to mise's modern plugin system.

diff --git a/docs/contributing.md b/docs/contributing.md
@@ -624,13 +624,21 @@ of the full backend specification.
 When adding a new tool, the following requirements apply (automatically
 enforced by [GitHub Actions workflow](https://github.com/jdx/mise/blob/main/.github/workflows/registry_comment.yml)):
 
-- **New asdf plugins are not accepted** - Use aqua/github instead
+- **New asdf and vfox plugins are not accepted** - Use [aqua](dev-tools/backends/aqua.md)
+  (preferred) or [github](dev-tools/backends/github.md) instead. This is a supply-chain
- **New asdf and vfox plugins are not accepted** - Use [aqua](dev-tools/backends/aqua.md)
-  (preferred) or [github](dev-tools/backends/github.md) instead. This is a supply-chain
+- **New asdf and vfox plugins are not accepted** - Use [aqua](/dev-tools/backends/aqua.html)
+  (preferred) or [github](/dev-tools/backends/github.html) instead. This is a supply-chain
- **New asdf and vfox plugins are not accepted** - Use [aqua](dev-tools/backends/aqua.md)
-  (preferred) or [github](dev-tools/backends/github.md) instead. This is a supply-chain
+- **New asdf and vfox plugins are not accepted** - Use [aqua](/dev-tools/backends/aqua.html)
+  (preferred) or [github](/dev-tools/backends/github.html) instead. This is a supply-chain
+  security policy.
+- **The `ubi` backend is deprecated and will not be accepted** for new registry entries.
+  Use aqua/github instead.
-  Use aqua/github instead.
+  Use [aqua](/dev-tools/backends/aqua.html) or [github](/dev-tools/backends/github.html) instead.
-  Use aqua/github instead.
+  Use [aqua](/dev-tools/backends/aqua.html) or [github](/dev-tools/backends/github.html) instead.
+- **Other backends (`npm`, `pipx`, `cargo`, `gem`, `go`, `dotnet`, etc.) have a very high
+  bar** for new registry entries. They are accepted only when no aqua/github option exists
+  and the tool is widely used. Discuss with @jdx before submitting.
 - **A test is required in `registry/`** - Must include a `test` field to
   verify installation
 - **Tools may be rejected if they are not notable** - The tool should be
   reasonably popular and well-maintained. There are no specific guidelines for this and
   a lot of factors are taken into account. @jdx won't explain why a given tool wasn't
-  accepted.
+  accepted. Include a brief popularity summary (stars, downloads, recent release date) in
+  the PR description so the policy can be applied without re-doing the research.
 
 ### Registry Format
 

diff --git a/docs/dev-tools/backends/asdf.md b/docs/dev-tools/backends/asdf.md
@@ -1,7 +1,9 @@
 # asdf Backend
 
 ::: warning
-asdf plugins are considered legacy. For new tools, prefer [vfox plugins](/dev-tools/backends/vfox.html) which are written in Lua, work cross-platform (including Windows), and have access to built-in modules for HTTP, JSON, HTML parsing, and more.
+asdf plugins are considered legacy. **New asdf and vfox plugins are not accepted into the [mise registry](https://github.com/jdx/mise/blob/main/registry/) for supply-chain security reasons** — for registry submissions use the [aqua](/dev-tools/backends/aqua.html) (preferred) or [github](/dev-tools/backends/github.html) backend instead.
+
+If you are writing a private/custom plugin (not for registry submission), prefer [vfox plugins](/dev-tools/backends/vfox.html) over asdf — they're written in Lua, work cross-platform (including Windows), and have access to built-in modules for HTTP, JSON, HTML parsing, and more.
 :::
 
 `asdf` is the original backend for mise.

diff --git a/docs/registry.md b/docs/registry.md
@@ -39,7 +39,7 @@ In general, the preferred [backend](/dev-tools/backends/) to use for new tools i
 - [cargo](./dev-tools/backends/cargo.html) - only for rust tools, requires rust to be installed to compile. Because rust tools can be distributed as a single binary, aqua/github are definitely preferred.
 - [dotnet](./dev-tools/backends/dotnet.html) - only for dotnet tools, requires dotnet to be installed to compile. Because dotnet tools can be distributed as a single binary, aqua/github are definitely preferred.
 
-New vfox and asdf tools are almost never accepted for supply-chain security reasons.
+New `vfox` and `asdf` tools are not accepted for supply-chain security reasons — use `aqua` (preferred) or `github` instead. The `ubi` backend is deprecated and is not accepted for new registry entries.
-New `vfox` and `asdf` tools are not accepted for supply-chain security reasons — use `aqua` (preferred) or `github` instead. The `ubi` backend is deprecated and is not accepted for new registry entries.
+New `vfox` and `asdf` tools are not accepted for supply-chain security reasons — use [aqua](./dev-tools/backends/aqua.html) (preferred) or [github](./dev-tools/backends/github.html) instead. The `ubi` backend is deprecated and is not accepted for new registry entries.
-New `vfox` and `asdf` tools are not accepted for supply-chain security reasons — use `aqua` (preferred) or `github` instead. The `ubi` backend is deprecated and is not accepted for new registry entries.
+New `vfox` and `asdf` tools are not accepted for supply-chain security reasons — use [aqua](./dev-tools/backends/aqua.html) (preferred) or [github](./dev-tools/backends/github.html) instead. The `ubi` backend is deprecated and is not accepted for new registry entries.
 
 ### Backends Priority