I've rolled my own. The way it works is:

+ It parses source.txt files from quicklisp-projects and builds its own database. Then it can go out and fetch those projects directly [no curation] from their homepages over https/git/hg and so on.

  So, quicklisp-projects (https://github.com/quicklisp/quicklisp-projects)
  I find to be pretty useful as a centralized index of CL
  software, and my thing piggybacks on top of.

+ Alternatively, you give it a Github/Bitbucket/Gitlab/... URL and it will fetch and register the project for you.

Finally, for every project that it has installed/registered, either via following the source URLs from quicklisp-projects or directly, it can automatically check if upstream has been updated and fetch those updates with optional merge/rebase.

This matches the way I work, which is mainly on top of repos, and it also gives me direct access (no curation) to the projects without having to worry about Xach's curated repo being compromised or quicklisp client not doing HTTPS/certificate verification / checksum checks.