- Home
- Artifact repository software
- Cloudsmith
Cloudsmith
Belfast, United Kingdom
What it is
Cloudsmith is a cloud-hosted artifact management platform that gives teams a central place to store and distribute software artifacts. It supports more than 30 package formats and raw files, including Docker, Python, Maven, npm, Helm, and ML models. The service can check packages, containers, and models for known vulnerabilities, malware, and license violations, block items that fail policy, and record where artifacts are shipped. Its Docker-compatible, OCI-compliant registry can hold multiple formats and proxy and cache public upstream registries. Policy controls include CVE, license, and malicious-package rules, OPA/Rego policy as code, and configurable cooldowns. Access governance includes team controls, service accounts, SSO, SCIM, and API-key policies. Developer tools include a CLI, REST API, webhooks, OpenAPI bindings, and a VS Code extension. Cloudsmith offers a free open-source plan with 50 GB artifact data and 200 GB package delivery for projects with a valid open-source license. Pro costs $149 a month and includes 5 GB artifact data and 25 GB package delivery. Cloudsmith is not self-hosted.
For and against
For
- Supports more than 30 package formats and raw files.
- Can block packages that fail policy checks.
- Provides upstream registry proxying and caching.
- Includes CLI, REST API, and VS Code extension.
- Free plan includes 50 GB artifact data.
Against
- Cloud-hosted only; self-hosted deployment is unavailable.
- Pro includes 5 GB artifact data and 25 GB delivery.
- Free plan requires a valid open-source license.
The verdict
Cloudsmith centralizes artifact storage and distribution with package checks, policy controls, and developer interfaces. The free plan is limited to qualifying open-source projects, while Pro costs $149 a month.
Who it suits
Cloudsmith suits organizations managing software artifacts, securing software supply chains, or distributing packages to developers. It supports teams from solo users through enterprise organizations.
Plans and prices
Free Open-Source
50 GB artifact data · 200 GB package delivery · public repository · valid Open-Source license
Read 28 Sep 2026 · cloudsmith.com
Pro
5 GB artifact data · 25 GB package delivery · $1.50/GB additional data
Read 28 Sep 2026 · cloudsmith.com
Core
500 MB artifact data · 1 GB package delivery · additional data N/A
Read 28 Sep 2026 · cloudsmith.com
Enterprise
Custom artifact data · Custom package delivery · Custom additional data · Enterprise support
Read 28 Sep 2026 · cloudsmith.com
Ultra
Custom artifact data · Custom package delivery · Custom additional data · Priority support
Read 28 Sep 2026 · cloudsmith.com
On the record
- Access governance
- Cloudsmith provides team-based controls, service accounts, OpenID Connect, SAML SSO, SAML groups, SCIM and API-key policies.cloudsmith.com · read 28 Sep 2026
- API limits
- The documented baseline API limit is 5,400 requests per hour for authenticated Core users and 50,000 requests per five minutes for Pro, Ultra and Enterprise users.docs.cloudsmith.com · read 28 Sep 2026
- Artifact management
- Its container registry is Docker-compatible and OCI-compliant, repositories can hold multiple formats, and public upstream registries can be proxied and cached.cloudsmith.com · read 28 Sep 2026
- CLI platforms
- The standalone Cloudsmith CLI is available for Linux, macOS and Windows, and can also be installed as a Python package, Homebrew package or Docker image.docs.cloudsmith.com · read 28 Sep 2026
- Company size fit
- solo, small, mid market, enterprisecloudsmith.com · read 22 Sep 2026
- Compliance
- iso27001, sso saml, two factorcloudsmith.com · read 22 Sep 2026
- Deployment
- cloudcloudsmith.com · read 22 Sep 2026
- Developer interfaces
- Cloudsmith offers a CLI, REST API, OpenAPI bindings for Go/Java/Python/Ruby, webhooks and a VS Code extension.cloudsmith.com · read 28 Sep 2026
- Global delivery
- Cloudsmith says its package delivery network serves packages from 600 points of presence worldwide with edge caching and regional fault tolerance.cloudsmith.com · read 28 Sep 2026
- Integrations
- Listed integrations include GitHub Actions, GitLab CI/CD, Jenkins, Azure DevOps, CircleCI, Buildkite, Argo CD, Terraform, Slack, Microsoft Teams, Datadog, Aikido, Zapier and VS Code.docs.cloudsmith.com · read 28 Sep 2026
- Intended users
- Cloudsmith is designed for organizations moving from on-premises registries, securing software supply chains, adopting AI artifacts, improving developer workflows or distributing software globally.docs.cloudsmith.com · read 28 Sep 2026
- Policy controls
- Security features include continuous risk detection, built-in CVE/license/malicious-package policies, OPA/Rego policy as code and configurable cooldown policies.cloudsmith.com · read 28 Sep 2026
- Security assurance
- Cloudsmith reports independent verification against ASVS 4.0 Level 2 and ISO 27001:2022 certification, with encryption in transit and at rest.docs.cloudsmith.com · read 28 Sep 2026
- Supply-chain checks
- Cloudsmith checks packages, containers and ML models for known vulnerabilities, malware and license violations, blocks items that fail policy, and logs what shipped where.cloudsmith.com · read 28 Sep 2026
- Support channels
- email, docscloudsmith.com · read 22 Sep 2026
- Supported artifacts
- Cloudsmith supports 30+ package formats plus raw files of any type, including Docker, Python, Maven, npm, Helm and ML models.cloudsmith.com · read 28 Sep 2026
- Support tiers
- The pricing table lists no support tier for Core and Pro, Priority support for Ultra, and Enterprise support for Enterprise.cloudsmith.com · read 28 Sep 2026
- What it does
- Cloudsmith is a fully managed, cloud-native artifact management platform serving as a single source of truth for software artifacts.docs.cloudsmith.com · read 28 Sep 2026
