Cloudsmith
Control and security for your AI-driven software supply chain
About Cloudsmith
Cloudsmith is a cloud-native artifact management platform that stores packages, containers, and ML models in one place across 30+ formats. It scans every artifact for vulnerabilities, malware, and license violations, blocks anything that fails your policies, and distributes software globally through an edge-cached delivery network.
Pros & Cons
Pros
- Supports 30+ package formats and containers in a single fully managed SaaS, so teams can retire self-hosted registries
- Built-in vulnerability, malware, and license scanning with quarantine and policy enforcement
- Upstream proxying and caching protect builds from public registry outages
- Edge-cached global distribution with entitlement tokens suits vendors shipping software to customers
- Users on G2 consistently praise responsive support and an intuitive web UI
- Free Core tier and a free open-source plan (50 GB storage, 200 GB delivery) for public projects
Cons
- Pro starts at $149/month, and reviewers frequently cite cost as a drawback
- Usage-based overages on storage and delivery can make bills harder to predict
- SAML SSO, SCIM, and longer log retention require the custom-priced Ultra or Enterprise plans
- Policy as code and cooldown policies are paid add-ons below Enterprise
- Some users report setup complexity and occasional issues proxying Maven Central
Key Features
Universal artifact repositories
Host 30+ package formats (npm, Maven, PyPI, Docker, Helm, Debian, RPM, Swift, Ruby Gems and more) plus raw files in multi-format private or public repositories.
OCI container registry
Fully Docker-compatible, OCI-compliant registry that keeps container images next to your other packages.
Upstream proxy and caching
Proxy and cache public registries so builds keep working when upstreams go down and every pulled dependency is recorded.
Continuous risk detection
Scans packages for CVEs, malicious code, and license issues, with quarantine and deny policies to block risky artifacts.
Policy as code and cooldown policies
Define supply chain rules in code, including cooldown windows that hold back newly published upstream versions (add-on on Pro and Ultra).
Package signing and SBOMs
Sign artifacts with Sigstore cosign or custom keys, host SBOMs, and generate SBOMs for containers.
Global software distribution
Deliver packages to customers through a global distribution network with edge caching, entitlement tokens, and custom domains.
Promotion workflows and integrations
Move packages between repositories by rule and integrate via CLI, REST API, Terraform provider, GitHub Action, CircleCI orb, and webhooks.
Access control and audit
Teams, service accounts, OpenID Connect, SAML SSO, SCIM, audit logs, and log exports for governance and visibility.
Pricing
- 500 MB artifact data
- 1 GB package delivery
- Unlimited packages and repositories
- 30+ formats, private and public repositories
- Upstream proxy and caching
- 1 entitlement token
- 5 GB artifact data
- 25 GB package delivery
- Additional data at $1.50/GB
- 2 service accounts
- 30-day audit logs
- 100 entitlement tokens
- Policy as code and cooldown policies as add-ons
- Custom data and delivery allowances
- 90-day audit logs and client logs
- SAML SSO and SCIM
- Priority support and standard uptime SLA
- Enhanced rate limits
- 1,000 entitlement tokens
- Bespoke allowances
- Custom storage regions
- Geographic and IP restrictions
- Enterprise support and custom SLA
- Custom MSA and committed-usage pricing
Best For
Replacing self-hosted Artifactory or Nexus
Teams moving off JFrog or Sonatype consolidate all package formats and containers into one managed, highly available service.
Securing open-source dependencies
Proxy public registries through Cloudsmith to scan, quarantine, and block malicious or vulnerable packages before developers pull them.
Distributing software to customers
Software vendors publish private packages and images behind entitlement tokens and serve them globally from edge caches.
CI/CD artifact pipelines
Push build outputs from GitHub Actions, CircleCI, or Buildkite and promote them between dev, staging, and production repositories.
Open-source project hosting
Public projects with a valid OSS license host and distribute packages on the free open-source plan.
Similar Tools
Vultr
High-performance cloud compute, GPU, and bare metal across 32 global data centers
CapRover
Scalable, free, and self-hosted PaaS — Heroku on steroids
ChatWithCloud
Talk to your AWS Cloud using natural language
Claude Code
Build, debug, and ship from your terminal, IDE, or browser
CloudQuery
Cloud ops, without the chaos
Datadog
Monitor, secure, and analyze your entire stack in one place