Cloudsmith

@cloudsmith list all vulnerabilities in our production npm repository and group them by severity

Scanning the production-npm repository under your organization namespace. Found 14 vulnerabilities across 8 packages: 3 critical (all in lodash@4.17.19, CVE-2020-8203 and related), 6 high-severity issues in older React dependencies, and 5 medium-severity findings in dev tooling. The critical vulnerabilities have patches available in lodash@4.17.21. Two high-severity React issues remain unpatched upstream. This summary reflects the most recent scan timestamp; package metadata includes CVSS scores and remediation guidance where available.

Demonstrates read access to Cloudsmith's vulnerability scanning data. Requires the API key to have read permissions on the target repository. Vulnerability data freshness depends on Cloudsmith's scan schedule—this example assumes scans have run. The MCP does not trigger new scans, only reports existing results.

@cloudsmith check our current bandwidth usage and tell me if we're approaching our monthly limit

Your organization namespace has consumed 847 GB of bandwidth this billing period, with a monthly allowance of 1,000 GB. You have 153 GB remaining (15.3% of quota). Storage usage is at 42 GB of 100 GB allocated. Based on current consumption, you are on track to exceed bandwidth limits in approximately 6 days if download patterns continue. The quota endpoint does not return billing plan details, but these figures reflect your account's active limits as of this request.

Showcases the Get Quota tool's ability to surface resource consumption without requiring admin-level access to billing systems. Useful for capacity planning before hitting hard limits. The MCP reports current state only—it cannot predict future usage or modify quotas. Rate limit awareness: quota checks count against the authenticated principal's request budget.

@cloudsmith search our audit log for any package deletions in the last 7 days and summarize who deleted what

Searched audit events for package deletion actions in your namespace over the past week. Found 3 deletion events: user alice@example.com deleted webpack@5.88.0 from staging-npm on May 14 at 09:23 UTC (reason: 'duplicate upload'), user bob@example.com removed an outdated Docker image (app-backend:pr-1847) from dev-containers on May 16, and an automated service account purged 12 expired Maven snapshots from ci-artifacts on May 17. All deletions were logged with actor identity, timestamp, and target resource identifiers. This is a text-based search; complex filtering may require multiple queries.

Pairs Cloudsmith's audit log search with AI reasoning to extract deletion patterns and actor attribution. The Search Audit Log tool is paginated and text-match based—filtering by event type or actor requires crafting the right query terms. This example assumes the API key has audit-read scope on the namespace. Side-effect: none, this is read-only forensic data.

When Cloudsmith MCP wins for pre-deploy vulnerability checks

A 6-person platform team ships Docker images to production every two weeks and needs to verify no critical CVEs slipped into dependencies before the deploy window. The Cloudsmith MCP gives your AI agent direct read access to vulnerability scan summaries and package metadata without leaving the chat. An agent can list repository vulnerabilities, filter by severity, and cross-reference the audit log to see who published the flagged package. This works cleanly when your team already uses Cloudsmith as the artifact registry and the repository count stays under 20—beyond that, you'll spend more time teaching the agent which repo to check than you save. If your release checklist includes "scan the registry for highs and criticals," wire this MCP into your deploy runbook and let the agent surface blockers in Slack.

Why this MCP matters for bandwidth-constrained artifact hosting

A 3-person startup on a fixed Cloudsmith tier publishes npm packages for a SaaS product and needs to avoid surprise overage bills when a customer's CI pipeline hammers the registry. The Get Quota and Get Rate Limits tools let an agent track storage and bandwidth burn in real time and flag when usage crosses 80 percent of the plan allowance. You can wire this into a daily standup prompt or a weekly finance review without writing a custom integration. The trade-off: if your team spans multiple Cloudsmith organizations or you need historical trend data, the MCP won't aggregate across namespaces or store time-series—you'll need a separate monitoring stack. If your artifact hosting bill is a line item you watch and you want conversational access to current usage, add this MCP and ask your agent to check quota every Monday morning.

When Cloudsmith MCP speeds up artifact forensics during outages

A 10-person SRE team gets paged at 2 a.m. because a service is crashing on startup and the logs point to a corrupted Helm chart. The Cloudsmith MCP lets an on-call engineer ask an agent to pull package metadata, checksums, and the audit log entry for the suspect artifact without opening the web console or remembering API syntax. The agent can verify the checksum matches the build pipeline output, identify who published the package, and confirm the repository visibility settings in under a minute. This scenario works when your team already uses Cloudsmith for Helm, Docker, or Maven artifacts and the incident involves a single package—if you need to diff two package versions or trace a dependency tree, the MCP's 10 tools won't cover it. If your runbooks include "verify the artifact wasn't tampered with," connect this MCP and let the agent handle the lookup while you focus on the rollback.