What is Cloudsmith?
Cloudsmith is a hosted artifact management and software supply chain platform from Cloudsmith Ltd, a company that describes itself as made in Belfast. It stores and serves software packages, container images, raw files and AI models in one cloud-native service, so build systems, developers and automated agents pull from a single controlled source instead of directly from public registries.
The platform covers three jobs. Artifact management provides private and public repositories, multi-format repositories, and upstream proxying and caching of public registries. Supply chain security adds continuous risk detection, policy as code, quarantine, cooldown policies and package signing. Software distribution delivers packages to customers through an edge network, entitlement tokens and branded Broadcast portals.
The formats page lists more than 30 supported formats, among them npm, Python, Maven, Gradle, NuGet, Docker and other OCI images, Helm, Debian, Red Hat RPM, Alpine, Go, Cargo, RubyGems, Terraform and Hugging Face models. Developers keep using the native client of each ecosystem, and pushes can also be made through the Cloudsmith CLI, the REST API or the official Terraform provider.
Cloudsmith is a managed service, not self-hosted software. Its security policy states that the service runs on Amazon Web Services in Europe West, US East, US West and Australia, and the changelog lists Mumbai as an added storage region. The product is closed source. The CLI and several integrations are published on the cloudsmith-io GitHub organization, which is why the listing carries no repository link for the platform itself.
On its press page the company announced a $72M Series C led by TCV and Insight Partners on April 23, 2026, and its changelog shows frequent releases. Recent entries cover cooldown policy exemptions, EPSS scores on vulnerability records, the deprecation of Trivy scanning in favour of OSV.dev-based continuous risk detection, npm provenance verification and a password login deprecation in the CLI taking effect on November 20, 2026. Plans and limits were read from the pricing page.
Cloudsmith screenshots
Explore the interface. Open a screenshot to view it at full size.
Official Cloudsmith changelog screenshot of a package Compliance view with vulnerability counts, severity filters and EPSS percentiles.
Official screenshot of the policy template picker: allowlist exemption, blocklist, high-risk vulnerability block, license compliance, malware block and cooldown period.
Official screenshot of upstream configuration, including an ActiveState Curated Catalog source for npm, Maven and generic packages.
Official screenshot of workspace usage limits with exact GB inputs and an open-source overage switch.
Official screenshot of an inline exemption that lets a named package and version skip the cooldown period.
Source: official Cloudsmith project page.
Key capabilities
- Multi-format repositories One repository can hold several package types, and the format list exceeds 30 entries across language, operating system, container and AI model categories. Teams can group artifacts by product or environment rather than by ecosystem. Private and public repositories are both available on every plan, according to the pricing table.
- Container registry The registry is described as Docker-compatible and OCI-compliant, and it sits beside packages in the same workspace. Images can be scanned, signed and promoted with the same tools as other artifacts. Cloudsmith also lists hardened container image sources among its upstream options.
- Upstream proxy and cache Upstreams proxy and cache public registries such as npm, PyPI or Maven Central, so every pull passes through your policies and cached copies keep builds running during upstream outages. The upstream dialog also offers a manual mode with any custom proxy URL and pre-configured sources, including an ActiveState Curated Catalog option for npm, Maven and generic packages.
- Continuous risk detection Packages are scanned on upload and checked again as new vulnerability data arrives, covering malware, known vulnerabilities and license risk. The changelog says this detection is powered by the OSV.dev database and replaces the deprecated Trivy scanning. Findings appear in a compliance view that lists CVE identifiers, severity and a recommended version to update to.
- EPSS-based prioritisation Vulnerability records show an Exploit Prediction Scoring System value, the estimated probability of exploitation within 30 days, next to CVSS severity. This lets a team order a long list of High and Critical findings by likelihood of attack instead of by score alone.
- Policy as code Policies are written in OPA Rego and decide what may enter or be promoted. The policy dialog offers managed templates: exact allowlist exemption, exact blocklist, high-risk vulnerability block, license compliance for copyleft licenses, malware block and cooldown period. The pricing table marks policy as code and cooldown policies as add-ons on the Ultra and Enterprise plans, so confirm availability for your plan.
- Cooldown policies A cooldown window holds newly published package versions until they clear policy checks, which reduces exposure to freshly published malicious releases. The security page lists npm, Python, Go, Maven and NuGet support and says resolution falls back to the latest compliant version. Inline exemptions let a named package, optionally a single version, skip the cooldown.
- Quarantine and promotion A package that a policy flags is quarantined, and only approved packages are promoted onward. Promotion can be automated by moving or copying packages between repositories, for example from a staging repository to a release repository.
- Package signing and SBOMs Cloudsmith supports package signing, Sigstore cosign, custom signing keys, hosted SBOMs and SBOM generation for containers. For npm, the client support serves attestation and signing key endpoints, so provenance verification works through Cloudsmith as it does against the upstream registry.
- Access control and identity Teams, service accounts, workspace RBAC and privileges control who can read or write a repository. Single sign-on through SAML, SAML groups and SCIM provisioning are listed, as are OpenID Connect and API key policies. Service accounts are limited to 2 on the Pro plan.
- Audit logs and log exports Audit logs record administrative and package activity, with a 30-day window on Pro and 90 days on Ultra. An audit logs API and log exports let you move events into your own analysis tools. Client logs and usage statistics show who pulled what, which supports incident review.
- Global distribution and Broadcasts Packages are served through an edge network with intelligent caching, and uploads do not count toward package delivery usage. Entitlement tokens, custom EULA enforcement and Broadcasts let a vendor distribute software to customers through a themed portal. Token counts per plan are 1 on Core, 100 on Pro and 1000 on Ultra.
- Custom domains and storage regions Custom domains are listed on all plans, and custom storage regions and geo or IP restrictions are listed as access-control features. Region choice matters for data residency, so check the regions offered for your plan when you sign up.
- CLI and automation The Cloudsmith CLI installs as a standalone binary for Linux, macOS and Windows, or as a Python package from PyPI that requires Python 3.11 or later. It uses API keys, and password login with cloudsmith login or cloudsmith token stops working on November 20, 2026. Official integrations cover GitHub Actions, Azure DevOps and CircleCI.
- Integrations and webhooks The integrations page lists CI/CD systems such as Jenkins, GitLab CI/CD, GitHub Actions, CircleCI and Octopus Deploy, identity providers such as Okta, Azure AD and Google, and tools such as Datadog, Slack and Zapier. Webhooks and a VS Code extension are also listed. Terraform users can manage resources with the cloudsmith-io provider.
- Package insights and MCP server License, dependency and quality metadata feed the policy engine and a package view with files, dependencies, versions, logs and compliance tabs. The home page states that a Cloudsmith MCP server gives AI agents access to package data so they can choose compliant packages.
- Usage limits and billing controls Usage is measured as artifact data stored and package delivery in outgoing bytes, and workspace owners set limits in Settings with exact numeric values. Overage is charged on demand in blocks, so 0.1 GB is billed as 1 GB according to the pricing FAQ. A usage cap defaults to 200 percent of the base plan allowance.
Where Cloudsmith fits
Replacing a self-managed artifact server
Teams running their own repository server can move packages and container images to Cloudsmith and point build tooling at the new endpoints. Cloudsmith publishes migration pages for JFrog Artifactory, Sonatype Nexus, GitHub Packages and AWS CodeArtifact. Inventory formats and retention needs first, then migrate one repository and compare download results before cutting over CI.
Gating public dependencies with an upstream proxy
Configure an upstream for each public registry your developers use, then make the Cloudsmith repository the only configured source in package manager settings and CI. Add a vulnerability, license or malware policy and a cooldown for new releases. Test that a known-bad package is blocked and that a legitimate emergency fix can pass through an exemption.
Controlling what AI coding agents install
Coding agents add dependencies faster than people review them. Pointing agent environments at a Cloudsmith repository applies the same policy checks to every pull, and logs record what was fetched. Check that the agent's package manager cannot fall back to the public registry when a package is blocked.
Promoting artifacts across environments
Use separate repositories for development, staging and production, and promote artifacts by copy or move after tests pass. Quarantine takes effect when a policy flags a package. Verify that production credentials can read only the release repository and that promotion actions appear in the audit log.
Distributing commercial software to customers
Vendors can publish packages in private repositories and give each customer an entitlement token, optionally with a custom EULA and a branded Broadcast portal. Plan token counts against your customer numbers, since the Core, Pro and Ultra plans list 1, 100 and 1000 tokens. Test revocation of a token and a download by an unentitled client.
Open-source package hosting
Maintainers of public projects can host packages for their users. The pricing page describes a free Open-Source plan with 50 GB of artifact data and 200 GB of package delivery for public repositories with a valid open-source license, offered on request. Confirm eligibility with Cloudsmith before relying on it.
Install
python3 -m pip install --upgrade cloudsmith-cliReviews of Cloudsmith
Be the first to share your experience with Cloudsmith.
Write a review
Loading review form…
Alternatives to Cloudsmith
JFrogJFrog's platform centers on Artifactory, a private registry for binaries and AI artifacts, with Xray scanning, on SaaS or self-managed plans.
GiteaGitea is an MIT-licensed, self-hosted Git platform written in Go. It combines repositories, pull requests, issues, projects, 20+ package registries and Gitea Actions CI/CD, with optional Cloud and Enterprise plans.
DockerDocker makes Docker Engine (open source), Docker Desktop for macOS, Windows and Linux, the Docker Hub registry, Docker Scout, Hardened Images, Build Cloud and Model Runner. Desktop is free for small businesses and personal use; larger organizations need a paid plan.