The Cloudsmith CLI now supports the Model Context Protocol (MCP), allowing you to bridge your package management workflow with AI assistants like Claude, Cursor, and VS Code. This integration eliminates the context-switching typically required to surface package metadata or security insights. By exposing Cloudsmith’s API as a set of executable tools for your LLM, you can now query vulnerabilities, list versions, and manage artifacts through a conversational interface, streamlining DevOps and engineering audits.

Key functionality

• Automated client configuration: A new CLI command simplifies setup for supported MCP clients including Claude Desktop, Cursor, VS Code (Copilot), and the Gemini CLI.
  • cloudsmith mcp configure (Default profile)
  • cloudsmith mcp configure -P [profile-name] (Specific profile)
• Secure authentication: The server utilizes your existing Cloudsmith CLI credentials. API keys are supported natively; for SSO environments, run cloudsmith auth login before initiating the MCP session.
• Multi-profile support: Users can configure and run distinct MCP server instances for different Cloudsmith profiles to maintain environment isolation - for example, if your organization has both a production and sandbox environment.

Implementation & scope

The MCP server runs as a local process, translating your LLM's requests into Cloudsmith actions. Please note the following current implementation details:

• Local execution: The server runs on your local machine; we currently don't provide a hosted remote MCP server.
• Feature availability: This initial release focuses on core repository and package management. Support for advanced workspace policies and usage metrics is currently in development and not yet exposed through the MCP interface.
• Extensibility: While the CLI automates setup for major clients, other MCP-compliant tools can be configured manually by pointing to the Cloudsmith CLI executable.