Exploring AI and the future of the software supply chain

AI assistants will shape the future of the software supply chain, and today, we’re sharing a glimpse of a powerful idea in motion: 

 server that connects large language models (LLMs) like ChatGPT and Claude directly to your software supply chain using the emerging 

Imagine managing policies, surfacing security insights, or orchestrating package workflows with a simple natural language prompt. No dashboards, no scripting, just a simple question or instruction that delivers the right end result. If this sounds interesting, you should 

This isn’t a launched product (yet), but it’s a clear signal of where we think Cloudsmith is headed: toward 

 that make it easier to control your software supply chain.

is a standard way to make information available to LLMs. Similar to an API, MCP provides a documented, standardized way for a client to integrate services from external sources.

MCP enables AI assistants to query and interact with software supply chain data, so it creates a foundation for smarter workflows and more accessible control over artifact management.

In essence, adding MCP capabilities to Cloudsmith offers up an entirely new interface to your software supply chain, with AI agents and LLMs working together to achieve your goals. We're exited to see MCP becoming a flexible new point of integration between our customers' third-party services and Cloudsmith.

MCP server demo

Our MCP prototype leverages Cloudsmith’s API-first architecture to provide programmatic access to developers through their AI assistant. Through standardized MCP requests, you can ask questions about your software supply chain or take safe, controlled actions - like managing policies or promoting packages - directly within Cloudsmith. This opens up conversational workflows with the Cloudsmith platform.

For example, you might ask your AI assistant to identify what package is trending up in usage month over month or see all of the versions of a particular package in use across your workspace. In the future, your AI assistant will be able to review your organization’s compliance and security requirements and recommend or create a set of policies in Cloudsmith’s Enterprise Policy Manager based on that input.

Building this prototype was a good reminder of a few fundamentals. First, an API-first foundation makes it easier to experiment, so it’s good that Cloudsmith is built truly API-first. Second, the data running through platforms like Cloudsmith can offer valuable insights when it’s made accessible to clients in lots of different ways. We’re giving developers and AI assistants simpler ways to ask questions, take actions, and get things done.

There’s still plenty to figure out, but MCP is already making artifact management and software supply chain management more intuitive and straightforward, especially at enterprise scale.

 for select customers and partners. If you're exploring the intersection of DevOps, AI, and supply chain security, we’d love to work with you. 

Alison Sickelka

VP of Product

Prototyping an MCP Server

Your software artifacts are your intellectual property; that’s why Cloudsmith is built to put you in control. Cloudsmith provides a flexible, powerful permissions system and 

 to control authentication, team membership and manage your users' lifecycle.

Managing users across hundreds of applications and systems can be a painful process, though. And we want Cloudsmith to be the artifact management platform of choice for enterprise customers. So we are pleased to let you know that we are expanding on the System for Cross-domain Identity Management (SCIM) capabilities in Cloudsmith. By integrating Cloudsmith with your identity provider (IdP) via SCIM, you can automate provisioning and de-provisioning users in Cloudsmith, letting your IdP serve as your single point for managing user access in Cloudsmith.

What is the System for Cross-domain Identity Management (SCIM)?

SCIM, or System for Cross-domain Identity Management

, is an open standard designed to manage user identity information. SCIM communicates user identity data between IdPs such as 

, and service providers requiring user identity information (such as enterprise SaaS apps, like Cloudsmith). SCIM uses RESTful APIs to transfer user data between systems.

SAML is primarily used for single sign-on (SSO) authentication between applications and systems. SAML enables users to log in once to a single system, proving they are who they say they are, and then access multiple other systems without having to log in again.

Where SCIM differs is that it is API-based, not login-based. When changes to identities are made in the IdP, including create, update, and delete, they are automatically synced to the service providers (like Cloudsmith) according to the SCIM protocol. For end users, this means that they have seamless access to applications for which they’re assigned, with up-to-date profiles and permissions.

Get Early Access to SCIM on Cloudsmith Now

To demonstrate our commitment to providing enterprises with the control they need, we are offering early access to SCIM provisioning and de-provisioning capabilities. By participating in the early access program, you get an exclusive opportunity to explore these capabilities firsthand and shape the final release with your feedback.

To sign up for early access, please reach out to 

. We look forward to partnering with your enterprise on this journey of enhanced control and efficiency.

Thank you for choosing Cloudsmith as your trusted platform. Stay tuned for more updates as we continue to empower enterprises with cloud-native artifact management.

Take control of user management with Cloudsmith's new SCIM capabilities

CircleCI, a Continuous Integration/Continuous Delivery service, 

 that they were investigating a security incident that impacted their platform and customers. CircleCI included in the disclosure recommended actions all customers should take in response to the incident.

Cloudsmith leverage CircleCI as an orchestrator for our build and deployment processes, and when we became aware of the incident, we immediately followed the recommended set of actions.

Cloudsmith already has a policy to ensure secrets are rotated regularly. However, directly after the disclosure of the CircleCI incident, we rotated every secret held within the secure contexts of our pipelines. All access tokens, OAuth tokens, SSH keys, and PGP keys contained within these contexts were rotated.

As an additional measure, we have consulted with audit logs within CircleCI, our SCM service, and our internal services to verify that no unauthorized access attempts were made at any time. This has also been cross-referenced with our observability platforms.

Cloudsmith Blog

Prototyping an MCP Server

Take control of user management with Cloudsmith's new SCIM capabilities

Cloudsmith's response to CircleCI security incident