Which of our Cloudsmith packages have critical vulnerabilities, and who changed what?
Cloudsmith hosts your packages. Memtro reads workspaces, repositories with package counts, downloads, size and quarantined or policy-violating packages, and packages by name, format, version, tag or status with scan state and vulnerability counts. It also reads scan results, download metrics and the workspace audit log. When asked and granted, it can quarantine or release, tag, rescan, resync, copy, move or delete a package, create a repository, change a member's role and invite someone. Cloudsmith can tell Memtro when a package is processed, fails or is quarantined, and a job can start on it. Webhooks are added per repository in Cloudsmith.
Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right Cloudsmith tool, reads what it needs, and answers with the source cited.
These tools change something in Cloudsmith. The model is told to use them only when you ask for exactly that, and an administrator grants each one by name to the teams that may use it; a personal connection acts only after its owner allows it.
Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in Cloudsmith, choosing the same kinds; the tab shows Cloudsmith's own steps. Each event can start a job, with the event as its input. Cloudsmith signs every delivery, and one whose signature does not check out is refused before it is read.
Events and webhooksOnce Cloudsmith is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.
Which Cloudsmith packages in prod have critical vulnerabilities?
Which packages are quarantined right now?
How many downloads did the api repository serve last month?
Which packages were deleted this week, according to the audit log?
Tag my-app 2.4.1 as latest in staging.
Sarah Chen, a security engineer at BigCo, asked which packages in the prod repository had critical vulnerabilities. Memtro read the scan results, most severe first, and listed each affected package with its count and scan date.
Tom Reilly, a release manager at Acme Ltd, asked Memtro to copy my-app 3.1.0 from staging to production. Memtro copied it, so anyone with access to the production repository could install it, and that repository's webhooks fired.
The teams that lean on Cloudsmith most, a question each of them asks, and what they connect beside it.
A record in Cloudsmith is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.
Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.
UptimeRobot
Honeycomb
Cronitor
FireHydrant
StatusCake
GlitchTip
GLPI
Langfuse
LibreNMS
NetBox
Snipe-IT
Woodpecker CI
Zabbix
LangSmith
Helicone
GrowthBook
Drata
Intruder
GitGuardian
Secureframe
ilert
JumpCloud
ConfigCat
Split
Aikido Security
Astronomer
Comet Opik
CrowdStrike Falcon
Detectify
Domotz
LambdaTest
LangWatch
LlamaCloud
Logz.io
Lunary
NinjaOne
Northflank
Portkey
PromptLayer
PRTG Network Monitor
Raygun
Retell AI
Runpod
Shodan
Spike.sh
Squadcast
Tenable
UpGuard
Uptime.com
Vanta
Zenduty
Cortex
WorkOS
Kandji
Automox
Huntress
SimpleMDM
Healthchecks.io
Rapid7 InsightVM
ZenhubIn Cloudsmith, create a service account under Workspace → Services, limited to the repositories Memtro should see, and copy its key, which is shown once. A personal key acts as you.
In Memtro, open Connections → Cloudsmith and paste the API key and the Workspace slug from the address bar.
An administrator grants the package, repository and member actions by name to the teams that may use them. Events are turned on from the connection's Events tab, and the address is then added under Webhooks in each repository.
Ask which Cloudsmith packages in prod have critical vulnerabilities.
Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The Cloudsmith tools are the same everywhere.
Only when you ask, and only what it has been granted: quarantine a package, or release it from quarantine; add, replace, remove or clear a package's tags; schedule a security scan of a package; resync (reprocess) a package; copy a package to another repository; move a package to another repository; delete a package; create a repository; change a workspace member's role; invite someone to the workspace. Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.
A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.
Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.
API key and workspace. In Cloudsmith, create a service account under Workspace → Services, limited to the repositories Memtro should see, and copy its key, which is shown once. A personal key acts as you.
Yes. Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in Cloudsmith, choosing the same kinds; the tab shows Cloudsmith's own steps. A job set to start "When an event arrives" then runs once for each matching event, with the event as its input. The run treats the event as outside data, never as instructions, and anything the run remembers is kept as unverified.
Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.
Sign in, add a provider key, create an API key and point your tools at Memtro. It takes about five minutes.
7-day free trial · card on file, nothing charged until it ends · cancel any time
