Control and security for your AI-driven software supply chain
Cloudsmith is the artifact management platform and dependency firewall for your software supply chain. It checks every package, container, and ML model your developers pull for known vulnerabilities, malware, and license violations, blocks anything that fails your policy, and logs exactly what shipped where.
Artifact management
A single source of truth for every package and container
The foundation of any secure software supply chain is a single, observable home for all software artifacts. Cloudsmith is a universal, cloud-native, enterprise-grade artifact management solution.
Universal support for every artifact
Packages scattered across tool-specific registries lose you the full picture. Cloudsmith holds 30+ formats and raw files in one repository, so every artifact has one home.
Secure, cloud-native container registry
Containers living apart from the rest of your packages split your visibility. Our Docker-compatible, OCI-compliant registry keeps images alongside everything else.
Multi-format repositories
Rigid repository structures force workarounds. Flexible, multi-format repositories match how your teams actually work.
Proxy and cache public upstreams
Public registries are a single point of failure. Proxy and cache them to isolate your teams from outages and risk, while improving uptime.
Analytics, usage monitoring
Without visibility, you can't tell what's moving through your pipelines. Monitoring and logs show exactly what's happening in your supply chain.
Native package tools
Use language-native and OS-native tools to push and pull packages with zero friction.
Package insights
Extract license, dependency and quality metadata from packages to drive policies.
Best in class web app
Manage teams and artifacts via one data-driven, streamlined interface.
Log exports
Get down to the nitty gritty and feed your analysis projects with log file exports.
Package promotion workflows
Move or copy packages between repositories in line with your own rules.
Command-line interface
Use our command line interface to get super hands-on with your workspace.
Package signing
Sign your software artifacts to ensure they are what they say they are.
Thorough documentation
Complete, developer-first documentation to help you get the most from Cloudsmith.
Artifact management with Cloudsmith
Supply chain Security
Powerful tools to secure your software supply chain
Cloudsmith secures your enterprise by identifying threat signals, applying policies, and running your automations.
Continuous risk detection
Threats don't stop at upload, they surface later. Every package is scanned on upload and continuously after, catching malware, vulnerabilities and license risk before they spread.
Policy management
Manual review can't keep pace with modern velocity. Write policies in OPA Rego to govern what enters automatically, with exception workflows for the edge cases.
Package quarantine and promotion workflows
One bad package can move through before anyone notices. Quarantine suspect packages automatically and promote only what's approved.
SAML/SSO, SCIM provisioning
Manual access management can't track org changes. SAML/SSO and SCIM keep access automatically in sync with your org.
Full audit trail & logging
When something goes wrong, you need answers fast. Full logs and audit trails, in the browser, via API, or exported, give you the full picture.
Cooldown policies
Hold back newly published package versions until they clear a minimum age, giving malware and bad releases time to surface before they reach your pipelines.
OIDC tokens
Authenticate against other services using ephemeral tokens, not stored secrets.
Service accounts
Use service accounts and API keys to enable and monitor your pipelines.
Role-based access controls
Specify team and user privileges to control who can access your packages.
API-first
Use our comprehensive API to build your own customized Cloudsmith experience.
Package signing
Sign packages cryptographically so teams can verify artifacts haven't been tampered with.
License policy enforcement
Block disallowed licenses before they reach a build, keeping legal risk out of your pipelines.
Exception workflows
Let teams request time-boxed waivers for blocked packages, without weakening the policy itself.
Secure your software supply chain with Cloudsmith
Software Distribution
Software distribution built for global enterprises
Boost productivity and get software to customers fast using our global package distribution network.
Global Scale, zero hassle
Demand spikes unpredictably across regions. We auto-scale and serve from 600 points of presence worldwide, no extra work for you.
High availability
Downtime costs revenue and trust. Cloudsmith is built for high availability, with SLAs for Ultra customers.
Read-only distribution tokens
Sharing access often means sharing too much. Configurable entitlement tokens grant read-only access, nothing more.
Broadcasts
Getting software to customers usually means building your own delivery page. Broadcasts publish your software through a customizable interface, no extra build needed.
Happy distributed teams
Global teams need fast, reliable support across time zones. We're fast, friendly, and back it with thorough documentation.
600 global points of presence
Your packages are served via hundreds of POPS, positioned to minimize latency.
Edge caching
Intelligent edge caching means packages are served from nearest location.
Fault tolerance
If network issues occur, traffic is routed to the nearest available region.
End-to-end encryption
Packages are encrypted at rest and in transit to ensure your IP is protected.
Distribute your software with Cloudsmith
Observability and Governance
End to end visibility of your software supply chain
Streamline your operations and drive innovation with our suite of observability, provenance, logging and audit trail tools
Analytics & Usage Insights
Without visibility, you can't see who's pulling what, or why. Client logs show every request, so you know which teams and services drive demand, exportable for deeper analysis.
Audit Trail & Governance
Compliance needs proof, not promises. A complete audit trail tracks every config change, package move, and license decision.