Skip to content
Cloudsmith MCP

Cloudsmith MCP

by Cloudsmith
Released
Docs
Developer Tools

Summary

Cloudsmith's official MCP server, built into its CLI: manage artifact repositories, packages and policies through an agent, with write operations off by default.

Features

  • Built into the Cloudsmith CLI — no separate service to deploy
  • Tools generated dynamically from Cloudsmith's OpenAPI spec, so coverage tracks the API
  • Write-heavy operations (uploads, webhooks, signing keys, upstream settings) disabled by default
  • Per-tool and per-group allowlists in ~/.cloudsmith/config.ini
  • Reuses existing CLI credentials; no second secret to manage
  • One-command client setup for Claude Desktop, Cursor, VS Code and Gemini CLI

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "Cloudsmith MCP" tools will be available.
{
  "mcpServers": {
    "cloudsmith-mcp": {
      "command": "cloudsmith",
      "args": [
        "mcp",
        "start"
      ]
    }
  }
}

Description

An artifact registry is exactly the kind of system where an agent is useful and where a careless write is expensive. Cloudsmith ships its MCP server inside the Cloudsmith CLI rather than as a separate service, and the design reflects that tension: broad read access, and the genuinely consequential operations disabled unless you turn them on.

Setup

The server needs the Cloudsmith CLI (Python 3.10+). Auto-configuration writes the client config for you:

cloudsmith mcp configure
cloudsmith mcp configure -P my-profile   # a specific profile

Claude Desktop, Cursor, VS Code (Copilot) and Gemini CLI are supported for automated setup; any other client can be pointed at cloudsmith mcp start manually.

Authentication

It reuses your existing CLI credentials, so there is no second secret to manage. API keys already configured are picked up automatically. SSO users must run `cloudsmith auth` before starting the server — an MCP client cannot trigger the SSO flow once the server is running, so an unauthenticated start simply fails later.

Tools, and what is switched off

Tools are generated dynamically from Cloudsmith's OpenAPI specification, so coverage tracks the platform's API rather than a hand-maintained list. Enumerate what is available with:

cloudsmith mcp list_tools -a
cloudsmith mcp list_groups -a

Disabled by default: package uploads and validation, webhooks, signing keys, upstream settings, broadcasts, rates, and several administrative groups. Re-enable per tool or per group in ~/.cloudsmith/config.ini:

[default]
mcp_allowed_tools=workspaces_policies_simulate_list
mcp_allowed_tool_groups=metrics

That allowlist model is the main reason to prefer this over a generic API wrapper — the blast radius is a config decision you make deliberately, not a default you inherit.

Useful for asking where a vulnerable package version is still being consumed, auditing repository and policy configuration, and pulling usage metrics without leaving the assistant.

Related MCP Servers

MCP: Headroom

by Headroom Labs

New

Context-compression MCP server that shrinks tool outputs, logs, files and RAG chunks before they reach the model, cutting 60-95% of tokens on JSON payloads.

Developer Tools
2 views

MCP: Engram

by Gentleman Programming

New

Persistent memory for coding agents as a single Go binary — SQLite and FTS5 behind MCP, an HTTP API, a CLI and a TUI, with no Node, Python or Docker required.

Developer Tools
2 views

MCP: agent-device

by Callstack

New

Give a coding agent a live feedback loop on real mobile, TV and desktop apps — inspect, tap, type and capture evidence on iOS, Android and HarmonyOS over MCP or a CLI.

Developer Tools
3 views

MCP: Weights & Biases MCP Server

by Weights & Biases

New

The official W&B MCP server: query experiment runs, Weave LLM traces, artifacts and registries in natural language, and write findings back as a W&B report.

Developer Tools
3 views
Browse all MCP servers →