How to integrate Cloudsmith MCP with Autogen

This guide walks you through connecting Cloudsmith to AutoGen using the Composio tool router. By the end, you'll have a working Cloudsmith agent that can list recent packages in production repository, delete failed package versions after review, check cloudsmith repository quota usage through natural language commands. This guide will help you understand how to give your AutoGen agent real control over a Cloudsmith account through Composio's Cloudsmith MCP server. Before we dive in, let's take a quick look at the key ideas and tools involved.

Get started for freeGet a demo
Cloudsmith logoCloudsmith
Api Key

Cloudsmith is a cloud-native artifact management platform for software packages, containers, and dependencies. It helps teams securely store, distribute, and govern packages across repositories and environments.

10 Tools

Introduction

This guide walks you through connecting Cloudsmith to AutoGen using the Composio tool router. By the end, you'll have a working Cloudsmith agent that can list recent packages in production repository, delete failed package versions after review, check cloudsmith repository quota usage through natural language commands.

This guide will help you understand how to give your AutoGen agent real control over a Cloudsmith account through Composio's Cloudsmith MCP server.

Before we dive in, let's take a quick look at the key ideas and tools involved.

Also integrate Cloudsmith with

OpenAI Agents SDKClaude Agent SDKClaude CodeClaude CoworkCodexOpenClawHermesCLIGoogle ADKLangChainVercel AI SDKMastra AILlamaIndexCrewAI

TL;DR

Here's what you'll learn:
  • Get and set up your OpenAI and Composio API keys
  • Install the required dependencies for Autogen and Composio
  • Initialize Composio and create a Tool Router session for Cloudsmith
  • Wire that MCP URL into Autogen using McpWorkbench and StreamableHttpServerParams
  • Configure an Autogen AssistantAgent that can call Cloudsmith tools
  • Run a live chat loop where you ask the agent to perform Cloudsmith operations

What is AutoGen?

Autogen is a framework for building multi-agent conversational AI systems from Microsoft. It enables you to create agents that can collaborate, use tools, and maintain complex workflows.

Key features include:

  • Multi-Agent Systems: Build collaborative agent workflows
  • MCP Workbench: Native support for Model Context Protocol tools
  • Streaming HTTP: Connect to external services through streamable HTTP
  • AssistantAgent: Pre-built agent class for tool-using assistants

What is the Cloudsmith MCP server, and what's possible with it?

The Cloudsmith MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Cloudsmith account. It provides structured and secure access to your organizations, repositories, packages, vulnerabilities, audit history, quotas, and rate limits, so your agent can discover organizations, inspect repositories, search packages, review security findings, and monitor account activity on your behalf.

  • Organization and account discovery: Have your agent confirm the connected Cloudsmith user and list the organizations available to that account.
  • Repository search and inspection: Let the agent find repositories within an organization and review their configuration, visibility, usage, and supported capabilities.
  • Package search and analysis: Direct your agent to search packages by name, version, format, architecture, distribution, filename, or status, then inspect package metadata, checksums, licensing, and security state.
  • Vulnerability review: Instruct your agent to list package vulnerability scan summaries for a repository so your team can identify security concerns.
  • Usage and activity monitoring: Have your agent check storage and bandwidth quotas, review current request limits, and search audit events by action, actor, or time.

What is the Composio tool router, and how does it fit here?

What is Composio SDK?

Composio's Composio SDK helps agents find the right tools for a task at runtime. You can plug in multiple toolkits (like Gmail, HubSpot, and GitHub), and the agent will identify the relevant app and action to complete multi-step workflows. This can reduce token usage and improve the reliability of tool calls. Read more here: Getting started with Composio SDK

The tool router generates a secure MCP URL that your agents can access to perform actions.

How the Composio SDK works

The Composio SDK follows a three-phase workflow:

  1. Discovery: Searches for tools matching your task and returns relevant toolkits with their details.
  2. Authentication: Checks for active connections. If missing, creates an auth config and returns a connection URL via Auth Link.
  3. Execution: Executes the action using the authenticated connection.

Step-by-step Guide

Step by step08 STEPS
1

Prerequisites

You will need:

  • A Composio API key
  • An OpenAI API key (used by Autogen's OpenAIChatCompletionClient)
  • A Cloudsmith account you can connect to Composio
  • Some basic familiarity with Autogen and Python async
2

Getting API Keys for OpenAI and Composio

OpenAI API Key
  • Go to the OpenAI dashboard and create an API key. You'll need credits to use the models, or you can connect to another model provider.
  • Keep the API key safe.
Composio API Key
  • Log in to the Composio dashboard.
  • Navigate to your API settings and generate a new API key.
  • Store this key securely as you'll need it for authentication.
3

Install dependencies

bash
pip install composio python-dotenv
pip install autogen-agentchat autogen-ext-openai autogen-ext-tools

Install Composio, Autogen extensions, and dotenv.

What's happening:

  • composio connects your agent to Cloudsmith via MCP
  • autogen-agentchat provides the AssistantAgent class
  • autogen-ext-openai provides the OpenAI model client
  • autogen-ext-tools provides MCP workbench support

4

Set up environment variables

bash
COMPOSIO_API_KEY=your-composio-api-key
OPENAI_API_KEY=your-openai-api-key
USER_ID=your-user-identifier@example.com

Create a .env file in your project folder.

What's happening:

  • COMPOSIO_API_KEY is required to talk to Composio
  • OPENAI_API_KEY is used by Autogen's OpenAI client
  • USER_ID is how Composio identifies which user's Cloudsmith connections to use
5

Import dependencies and create Tool Router session

python
import asyncio
import os
from dotenv import load_dotenv
from composio import Composio

from autogen_agentchat.agents import AssistantAgent
from autogen_ext.models.openai import OpenAIChatCompletionClient
from autogen_ext.tools.mcp import McpWorkbench, StreamableHttpServerParams

load_dotenv()

async def main():
    # Initialize Composio and create a Cloudsmith session
    composio = Composio(api_key=os.getenv("COMPOSIO_API_KEY"))
    session = composio.create(
        user_id=os.getenv("USER_ID"),
        toolkits=["cloudsmith"]
    )
    url = session.mcp.url
What's happening:
  • load_dotenv() reads your .env file
  • Composio(api_key=...) initializes the SDK
  • create(...) creates a Tool Router session that exposes Cloudsmith tools
  • session.mcp.url is the MCP endpoint that Autogen will connect to
6

Configure MCP parameters for Autogen

python
# Configure MCP server parameters for Streamable HTTP
server_params = StreamableHttpServerParams(
    url=url,
    timeout=30.0,
    sse_read_timeout=300.0,
    terminate_on_close=True,
    headers={"x-api-key": os.getenv("COMPOSIO_API_KEY")}
)

Autogen expects parameters describing how to talk to the MCP server. That is what StreamableHttpServerParams is for.

What's happening:

  • url points to the Tool Router MCP endpoint from Composio
  • timeout is the HTTP timeout for requests
  • sse_read_timeout controls how long to wait when streaming responses
  • terminate_on_close=True cleans up the MCP server process when the workbench is closed
7

Create the model client and agent

python
# Create model client
model_client = OpenAIChatCompletionClient(
    model="gpt-5",
    api_key=os.getenv("OPENAI_API_KEY")
)

# Use McpWorkbench as context manager
async with McpWorkbench(server_params) as workbench:
    # Create Cloudsmith assistant agent with MCP tools
    agent = AssistantAgent(
        name="cloudsmith_assistant",
        description="An AI assistant that helps with Cloudsmith operations.",
        model_client=model_client,
        workbench=workbench,
        model_client_stream=True,
        max_tool_iterations=10
    )

What's happening:

  • OpenAIChatCompletionClient wraps the OpenAI model for Autogen
  • McpWorkbench connects the agent to the MCP tools
  • AssistantAgent is configured with the Cloudsmith tools from the workbench
8

Run the interactive chat loop

python
print("Chat started! Type 'exit' or 'quit' to end the conversation.\n")
print("Ask any Cloudsmith related question or task to the agent.\n")

# Conversation loop
while True:
    user_input = input("You: ").strip()

    if user_input.lower() in ["exit", "quit", "bye"]:
        print("\nGoodbye!")
        break

    if not user_input:
        continue

    print("\nAgent is thinking...\n")

    # Run the agent with streaming
    try:
        response_text = ""
        async for message in agent.run_stream(task=user_input):
            if hasattr(message, "content") and message.content:
                response_text = message.content

        # Print the final response
        if response_text:
            print(f"Agent: {response_text}\n")
        else:
            print("Agent: I encountered an issue processing your request.\n")

    except Exception as e:
        print(f"Agent: Sorry, I encountered an error: {str(e)}\n")
What's happening:
  • The script prompts you in a loop with You:
  • Autogen passes your input to the model, which decides which Cloudsmith tools to call via MCP
  • agent.run_stream(...) yields streaming messages as the agent thinks and calls tools
  • Typing exit, quit, or bye ends the loop

Complete Code

Here's the complete code to get you started with Cloudsmith and AutoGen:

python
import asyncio
import os
from dotenv import load_dotenv
from composio import Composio

from autogen_agentchat.agents import AssistantAgent
from autogen_ext.models.openai import OpenAIChatCompletionClient
from autogen_ext.tools.mcp import McpWorkbench, StreamableHttpServerParams

load_dotenv()

async def main():
    # Initialize Composio and create a Cloudsmith session
    composio = Composio(api_key=os.getenv("COMPOSIO_API_KEY"))
    session = composio.create(
        user_id=os.getenv("USER_ID"),
        toolkits=["cloudsmith"]
    )
    url = session.mcp.url

    # Configure MCP server parameters for Streamable HTTP
    server_params = StreamableHttpServerParams(
        url=url,
        timeout=30.0,
        sse_read_timeout=300.0,
        terminate_on_close=True,
        headers={"x-api-key": os.getenv("COMPOSIO_API_KEY")}
    )

    # Create model client
    model_client = OpenAIChatCompletionClient(
        model="gpt-5",
        api_key=os.getenv("OPENAI_API_KEY")
    )

    # Use McpWorkbench as context manager
    async with McpWorkbench(server_params) as workbench:
        # Create Cloudsmith assistant agent with MCP tools
        agent = AssistantAgent(
            name="cloudsmith_assistant",
            description="An AI assistant that helps with Cloudsmith operations.",
            model_client=model_client,
            workbench=workbench,
            model_client_stream=True,
            max_tool_iterations=10
        )

        print("Chat started! Type 'exit' or 'quit' to end the conversation.\n")
        print("Ask any Cloudsmith related question or task to the agent.\n")

        # Conversation loop
        while True:
            user_input = input("You: ").strip()

            if user_input.lower() in ['exit', 'quit', 'bye']:
                print("\nGoodbye!")
                break

            if not user_input:
                continue

            print("\nAgent is thinking...\n")

            # Run the agent with streaming
            try:
                response_text = ""
                async for message in agent.run_stream(task=user_input):
                    if hasattr(message, 'content') and message.content:
                        response_text = message.content

                # Print the final response
                if response_text:
                    print(f"Agent: {response_text}\n")
                else:
                    print("Agent: I encountered an issue processing your request.\n")

            except Exception as e:
                print(f"Agent: Sorry, I encountered an error: {str(e)}\n")

if __name__ == "__main__":
    asyncio.run(main())

Conclusion

You now have an Autogen assistant wired into Cloudsmith through Composio's Tool Router and MCP. From here you can:
  • Add more toolkits to the toolkits list, for example notion or hubspot
  • Refine the agent description to point it at specific workflows
  • Wrap this script behind a UI, Slack bot, or internal tool
Once the pattern is clear for Cloudsmith, you can reuse the same structure for other MCP-enabled apps with minimal code changes.
TOOLS

Supported Tools

Every Cloudsmith action and event your agent gets out of the box.

Get Current User

Return the identity authenticated by the connected Cloudsmith API key.

Get Package

Get metadata, status, checksums, licensing, and security state for one package in a Cloudsmith repository.

Get Quota

Return current storage and bandwidth usage and allowances for a Cloudsmith namespace without inferring a billing plan name.

Get Rate Limits

Return Cloudsmith's current per-resource request limits, remaining counts, intervals, and throttling state for the authenticated principal.

Get Repository

Get configuration, visibility, usage, and capability details for one Cloudsmith repository without returning repository signing keys or certificates.

List Organizations

List Cloudsmith organizations associated with the authenticated principal so an agent can discover namespace slugs for later calls.

List Repository Vulnerabilities

List vulnerability scan summaries for packages in a Cloudsmith repository.

Search Audit Log

Search paginated audit events for a Cloudsmith namespace by event, actor, or timestamp text.

Search Packages

Search packages in a Cloudsmith repository by name, filename, version, distribution, architecture, format, or status.

Search Repositories

Search and list repositories within a Cloudsmith namespace, returning identifiers and summary state without repository signing keys.

FRAMEWORKS

How to build Cloudsmith MCP Agent with another framework

OpenAI Agents SDK logo

OpenAI Agents SDK

Use Cloudsmith MCP with OpenAI Agents SDK

Claude Agent SDK logo

Claude Agent SDK

Use Cloudsmith MCP with Claude Agent SDK

Claude Code logo

Claude Code

Use Cloudsmith MCP with Claude Code

Claude Cowork logo

Claude Cowork

Use Cloudsmith MCP with Claude Cowork

Codex logo

Codex

Use Cloudsmith MCP with Codex

OpenClaw logo

OpenClaw

Use Cloudsmith MCP with OpenClaw

Hermes logo

Hermes

Use Cloudsmith MCP with Hermes

CLI logo

CLI

Use Cloudsmith MCP with CLI

Google ADK logo

Google ADK

Use Cloudsmith MCP with Google ADK

LangChain logo

LangChain

Use Cloudsmith MCP with LangChain

Vercel AI SDK logo

Vercel AI SDK

Use Cloudsmith MCP with Vercel AI SDK

Mastra AI logo

Mastra AI

Use Cloudsmith MCP with Mastra AI

LlamaIndex logo

LlamaIndex

Use Cloudsmith MCP with LlamaIndex

CrewAI logo

CrewAI

Use Cloudsmith MCP with CrewAI

FAQ

Frequently asked questions

With a standalone Cloudsmith MCP server, the agents and LLMs can only access a fixed set of Cloudsmith tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Cloudsmith and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. Autogen fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Cloudsmith tools.

Yes, absolutely. You can configure which Cloudsmith scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Cloudsmith data and credentials are handled as safely as possible.

Start with Cloudsmith.It takes 30 seconds.

Managed auth, hosted MCP servers, and every Cloudsmith tool your agent needs.Free to start.

Start building
Customer stories

Teams ship real agents on Composio

GET STARTED FOR FREEBOOK A DEMO
agent.aiZoomLettaGleanHubSpotAWSWabi

Karan skipped his own birthday party to fix our critical issue. It was 10pm and he diverted his Waymo to help us instead. This really sets the bar — it shows the commitment you need when users rely on your software.

Harsha Gaddipati
Harsha Gaddipati
Co-founder, Slashy

A lot of students tell us that the moment their connected tools start talking to each other inside Opennote feels almost magical. The agent just knows them, and it's immensely helped keep new users on the platform.

Abhi Arya
Abhi Arya
Co-founder, Opennote

We chose Composio over Pipedream because it delivered depth where it mattered — niche tools and tricky edge cases other platforms simply ignored. That gave us confidence to scale without compromising.

Nirman Dave
Nirman Dave
CEO, Zams

As a solo builder, shipping fast is life or death. The only way I can outcompete incumbents is by outmanoeuvring them. Getting bogged down managing agent auth would have been a death sentence.

Ryan Yu
Ryan Yu
Founder, Extra Thursday

Before Composio, adding tool integrations was slow and resource-intensive. Each one could take weeks of engineering time, and maintaining them meant constantly keeping up with API changes.

Tomisin Jenrola
Tomisin Jenrola
Founder & CEO, SwarmZero

With hands-on help from their founder, we integrated Gmail and Google Drive in just 30 minutes. This level of personal support and commitment is exactly what startups should strive for.

Jerome Leclanche
Jerome Leclanche
Co-Founder, Ingram Technologies