Cloudsmith review

Cloudsmith is a fully managed SaaS artifact management and package distribution platform. It is not a library or a self-hosted server: Cloudsmith operates the underlying service, and teams connect build systems and package clients to it. It sits between CI/CD pipelines that publish artifacts and developers, services or customers that retrieve them.

The platform stores and distributes dependencies, application packages, container images and AI models. It supports more than 30 formats, including Docker/OCI, npm, PyPI, Maven, NuGet, Helm, Go, Cargo and Hugging Face models. Different ecosystems can share a repository rather than requiring format-segregated storage.

Cloudsmith also acts as a control layer for package access and supply-chain security. Features include upstream dependency proxying and caching, vulnerability scanning, license controls, quarantine, signing and policy enforcement. Teams can use entitlement tokens, OIDC, SAML SSO, SCIM, RBAC and service accounts to control access. The service removes the need to operate registry infrastructure, but it also makes the registry a hosted dependency.

Cloudsmith provides a REST API, an official CLI, a Terraform provider and Model Context Protocol (MCP) support. Its documented integration surface also includes GitHub Actions, GitLab CI/CD, CircleCI, Jenkins, Azure DevOps, Bitbucket, Buildkite, ArgoCD and other CI/CD tools. Terraform, Ansible, Chef and Puppet are listed for infrastructure automation; VS Code, Cursor IDE, Dependabot, Renovate and Postman are among the developer-tool integrations.

That gives teams several ways to automate repository creation, package publishing and consumption within existing pipelines. The homepage names the REST API, CLI and Terraform provider, but not language-specific SDKs. Confirm SDK availability and support for your chosen language in Cloudsmith's docs before designing an integration around one. The listed API is REST; do not assume a particular SDK, webhook surface or client library without checking the vendor documentation.

The integration list is broad, but it does not remove the need to configure credentials, repository access and package-client behavior for each pipeline. Evaluate those details alongside the docs for the package formats your builds actually use.

Core costs $0 per month and includes 500 MB of artifact data, 1 GB of package delivery, unlimited packages and repositories, one entitlement token and 50,000 requests per five minutes. Qualifying public open-source projects can use Free Open-Source at $0, with 50 GB of artifact data and 200 GB of delivery; a public repository and valid open-source license are required.

Pro costs $149 per month. It includes 5 GB of artifact data, 25 GB of delivery, two service accounts and 100 entitlement tokens. The pricing page lists additional data at $1.50 per GB. It does not publish other on-demand rates here, so ask how delivery beyond the allowance is charged before estimating a production bill.

Ultra and Enterprise have custom pricing and custom data or delivery allowances. Ultra lists 1,000 entitlement tokens, 90-day audit and client logs, and enhanced rate limits; Enterprise lists custom token, retention and rate limits. Policy-as-code, cooldown policies, support and SLA options are listed as add-ons for both. Plans bill monthly; annual invoice billing is listed, but annual prices are not published.

Cloudsmith is proprietary software delivered as a fully managed SaaS service. There is no self-hosted, on-premises or downloadable edition, so teams that require infrastructure under their own control should rule it out. The Free Open-Source plan is a free hosting option for qualifying projects, not an open-source version of the platform. It requires a public repository and a valid open-source license.

Cloudsmith does not publish data-export terms here. Before adopting it, ask about bulk export formats, package metadata, audit and client logs, and any costs or limits involved. Moving away would also mean changing package-client and CI/CD configuration, replacing Cloudsmith-specific access controls and recreating policies in another system. Standard package formats may help with artifact compatibility, but they do not guarantee a complete migration of repository settings or history. Treat portability as a procurement question, not an assumption.

Cloudsmith lists vulnerability scanning, license controls, quarantine, signing, policy enforcement and access controls that can support a production supply-chain workflow. Its global edge CDN architecture is designed for package delivery. The pricing page lists up to a 99.95% uptime SLA as an add-on for Ultra and Enterprise; confirm the exact commitment, exclusions and support terms before making it a dependency for release pipelines.

Check storage and delivery allowances, request limits, log retention and rate limits against expected build volume. Core lists 50,000 requests per five minutes; Ultra offers enhanced rate limits, while Enterprise rates are custom. The vendor's pricing page lists 90-day audit and client logs for Ultra, with custom retention for Enterprise. Ask what happens when limits are reached and what delivery beyond plan allowances costs.

Reddit discussion reflects both the value of a universal registry and concern about price. One commenter questioned the case versus a private GitHub repository; another said the pricing surprised colleagues. The available comments are not a substitute for production reliability evidence, so verify SLA and escalation terms directly.