Cloudsmith review

Cloudsmith is a managed service for storing and distributing software artifacts: packages, dependencies, container images, and AI models. It runs as SaaS, so your team does not manage the storage and delivery infrastructure. The point is to bring multiple package formats into one place rather than operate separate repositories for each ecosystem.

It also reaches beyond storage. Cloudsmith can proxy public registries, apply security and access policies, scan for vulnerabilities, track licenses, quarantine packages, and sign and verify artifacts. Teams can manage it through the web platform and use its REST API, CLI, Terraform provider, or MCP support.

That makes it relevant when a company needs controlled internal distribution or wants to publish packages externally. It is more specialized than a general cloud drive, and its value depends on whether centralizing artifact access and policy is worth the ongoing cost.

Cloudsmith’s clearest advantage is breadth: it supports multiple package formats in a shared service, with security and access controls built around distribution. The listed features include vulnerability scanning, license tracking, package firewalls, quarantine, policy-as-code, dependency proxying, entitlement tokens, OIDC mapping, SAML SSO, SCIM, RBAC, and service accounts. Artifact signing and verification are included, with ECDSA X.509 signing for Swift packages.

There are practical controls for teams that need to trace or automate package activity, too. Cloudsmith offers download and package logs, audit histories, a REST API, CLI, Terraform provider, and MCP support. Its proxying can cache dependencies from public registries, which the product describes as a way to reduce exposure to outages or tampering.

The free options make it possible to start without a paid subscription, though they have different eligibility and caps. Core is listed at $0 with 500 MB of artifact data and 1 GB of package delivery. The Free Open-Source plan lists 50 GB and 200 GB, but requires a public repository and a valid open-source license. In a Reddit discussion, a Flutter and Dart developer favored Cloudsmith’s broader language coverage and entitlement tokens over a more specialized option.

The free Core plan is a small allowance for anything beyond evaluation or a light individual project: it includes 500 MB of artifact data and 1 GB of package delivery. Unlimited packages and repositories do not remove those storage and delivery caps. The larger Free Open-Source allowance is not a general free tier; repositories must be public and use a valid open-source license.

The listed paid entry point is Pro at $149 per month. It includes 5 GB of artifact data and 25 GB of package delivery, with additional data listed at $1.50 per GB. Usage is charged in blocks; the pricing information gives 1 GB as an example minimum block. Pro includes 30-day audit logs.

Ultra and Enterprise prices are not published, and both use custom data and delivery allowances. Policy-as-code and cooldown policies are paid add-ons for those plans, as are listed support and SLA options; their prices are not published. Annual invoice billing is listed, but annual prices and discounts are not published. That leaves larger buyers with less price certainty before a sales conversation.

Cloudsmith has free options, but the listed paid entry point is Pro at $149 per month. Core costs $0 and includes 500 MB of artifact data, 1 GB of package delivery, and one entitlement token. The free Open-Source plan offers 50 GB of artifact data and 200 GB of delivery, but requires a public repository and a valid open-source license.

Pro raises the caps to 5 GB of artifact data and 25 GB of delivery. Additional data is $1.50 per GB; usage is charged in blocks, with 1 GB given as the example minimum. That makes the move from Core to Pro a real cost jump for private projects that outgrow the free limits. Ultra and Enterprise have custom pricing, so the total cost is not published. Policy-as-code, cooldown policies, and several support and SLA options are add-ons for those plans, with prices not published. Prices are monthly; annual invoice billing is listed, but annual prices and discounts are not published. Billing is monthly by default.

Treat a move as an artifact migration, not just a billing change. Before switching, inventory the package formats you host, storage and delivery needs, access controls, and any security policies you rely on. Cloudsmith lists multi-format repositories, entitlement tokens, RBAC, signing, and policy controls, but the published material does not describe a migration service or provide data-export instructions. Confirm export options and destination compatibility with Cloudsmith before committing; those details are not published here.

Cloudsmith is managed SaaS, and its listed plan caps and custom-priced tiers can affect whether it still fits as usage grows. The published material also does not say how to export artifacts, logs, or policy configuration, so we can't assess lock-in beyond recommending that you verify those points before moving in. We don't have Reddit posts in the published material, so we can't responsibly report why users leave or how difficult they say migration is. Ask for export procedures, expected effort, and any applicable charges in writing before you switch.