SOFTWARE SUPPLY CHAIN OBSERVABILITY

End to end visibility of your software supply chain

Govern and observe every dependency your teams and AI agents pull, with policy guardrails, detailed logging and a complete audit trail.

See every dependency your developers and AI agents request, with detailed logs and analytics

  • Client logs give you detailed information about every package request from developers, pipelines and AI agents
  • Understand what packages and versions are in use
  • Monitor the teams, services and agents driving demand
  • Track down outliers and look for ways to streamline your operations
  • Export log files to feed into analysis workflows
  • Use our logs API to integrate data with third-party software
Cloudsmith has transformed how we manage software, making our entire delivery process more secure and efficient.

Toshio Kenyon

Engineering Manager

Before

Diligent’s processes for managing, storing, and delivering software artifacts securely were becoming cumbersome. They needed to increase visibility, and ensure security and compliance across all their repositories.

With Cloudsmith
  • Global distribution out of the box
  • Secure artifact management
  • Usage insights & full audit trail
Results
  • Faster release cycles
  • Reliable pipeline stability
  • Scaling and replication headaches eliminated

Make Cloudsmith the source of truth for OSS, for developers and AI agents alike. Proxy and cache dependencies via Cloudsmith.

  • Point developers' and AI agents' package managers at Cloudsmith instead of public registries
  • Generate log data for each and every request for OSS dependencies, whoever or whatever makes it
  • Apply policies and checks before packages reach users, pipelines and AI agents

Build a complete audit trail for every dependency, whether a developer or an AI agent asked for it

  • Monitor user, service and API-based access to your software artifacts
  • Track configuration changes made to your workspace
  • Understand which policy rules matched, and why a package was released or held

Powerful Features. Simple Control.

Track software licenses used by your dependencies and avoid costly remediation

  • Our license compliance dashboard gives you a breakdown of software licenses in use across your teams
  • Identify license that can’t be used in commercial software
  • Create license policies that automatically flag or hold packages before developers and AI agents can use them
  • Keep incompatible software licenses out of your commercial software

Take control, gain clarity. Use Cloudsmith as the universal home for all your packages, containers, models and datasets

  • Centralize access to 30+ package formats
  • Use our fully Docker-compatible container registry to control images
  • Govern access to your machine learning models and datasets
  • Generate data and derive insight at each stage of your software life cycle

Explore your Cloudsmith data using AI agents

  • Connect Cloudsmith with AI agents like Claude using our MCP server
  • Gain insights via natural language

Software distribution built for global enterprises

Boost productivity and get software to teams and customers using Cloudsmith’s global package distribution network
graph-distribute

Every package, container, pipeline, and team

Gain complete control over every package, container and software asset used across your business, including those requested by AI agents. Cloudsmith is the single source of truth for all of it.
security-scanning
Related resources

Observability, governance and AI on the Cloudsmith blog

blog

Introducing Cloudsmith’s Advanced Observability Suite for Enterprise Artifact Management

As software complexity advances, understanding what’s happening across every part of your software supply chain becomes crucial. You need to see where artifacts are used, how secure they are, and whether they meet compliance standards. The ability to capture this is known as observability. Observability goes beyond data collection to provide essential insights that help teams understand, troubleshoot, and enhance complex systems. It enables engineers to ask critical questions, anticipate issues, and respond proactively—fostering resilience and reliability. Overcoming the Challenges of Limited Observability Without good observability, teams are often left in the dark, relying on incomplete data and reactive troubleshooting when issues arise. This can lead to longer downtime, unexpected costs, and missed security risks, as there’s no clear visibility into where problems occur or why. The lack of insights also makes it harder to anticipate trends, manage resources efficiently, and ensure compliance, ultimately compromising system reliability and customer trust. Knowing this, we wanted to take a step forward and create a solution that provided a quick turnaround on insights that drive immediate corrective action. As a result, Cloudsmith has launched an advanced observability suite, offering enterprises unparalleled insights into their software supply chain. With a fully redesigned user experience, customers can now make data-driven decisions more effectively, managing artifacts with greater precision and control. Enhanced Observability for Usage Management Cloudsmith’s advanced observability features give engineering managers and DevOps teams the insights needed to monitor and manage artifact quality and usage across their systems. These tools are built to handle complex, large-scale environments, helping teams track trends, accurately attribute costs, and proactively address risks—essential for maintaining control over a dynamic software supply chain. "Cloudsmith's analytics and alerts are instrumental in helping us manage our usage more effectively and plan for increases in demand for software artifacts,...We can catch unexpected spikes in artifact consumption, improving our security posture and avoid usage surprises at the end of the month" Dave Bresci, Senior Manager, SRE, PagerDuty. Cloudsmith’s new observability suite offers several key features geared to upgrading observability: Detailed Usage Analytics: Granular dashboards and reports provide a clear view of consumption patterns over time, enabling informed resource management. Security and Compliance Insights: A centralized dashboard for policy violations, vulnerability data, and license tracking offers a straightforward way to assess and address organizational risks. Monitoring Alerts: Real-time notifications ensure that critical information on usage and policy adherence reaches the right teams when it’s needed most. These features equip teams with the context and control required to navigate complex, large-scale environments effectively. The new suite comes with a fully redesigned user experience, featuring streamlined navigation, enhanced performance, and a data-rich interface packed with deeper insights. Cloudsmith has tailored these improvements to ensure smooth, efficient access to critical data, making it well-suited for large-scale enterprise operations. With this suite, organizations are empowered to navigate challenges confidently, drive smarter decision-making, and ensure their software supply chain remains both agile and secure.This isn’t just a tool - it’s a strategic advantage. Unlock the full potential of your software supply chain with Cloudsmith’s advanced observability suite. See firsthand how our powerful analytics and real-time insights can help you optimize artifact usage, anticipate risks, and maintain compliance across your systems. Schedule a demo today to explore how Cloudsmith can give your team the visibility and control needed to drive smarter, data-driven decisions. Book a Demo Today and discover how Cloudsmith’s observability suite can transform your software management process and help you stay ahead of potential issues in your supply chain.

Frequently asked questions

  1. Configure your AI agents and developers' package managers to point at Cloudsmith. Every dependency they request then flows through Cloudsmith, which proxies OSS registries through upstreams and applies your policies and checks before a package is made available.

  2. You define policies in Rego, specifying which packages can and can't flow to agents and developers. You can quarantine or block packages above a CVE threshold, hold packages with prohibited licenses for inspection, tag poorly maintained packages, and hold very new versions for a set period before release.

  3. Yes. Client logs give you detailed information about every package request, so you can see which packages and versions are in use and which teams and services drive demand.

  4. Cloudsmith records user, service and API-based access to your artifacts, configuration changes made to your workspace, and the policy rules that matched along with why they matched.

  5. Policies, logs and the audit trail apply to every request that flows through Cloudsmith. Make Cloudsmith the only configured source of dependencies for your agents and package managers, so each request is governed and recorded.

  6. Yes. You can export log files to feed analysis workflows, and use the logs API to integrate Cloudsmith data with third-party software.

Get started with Cloudsmith