jfrog — Agent Skill

JFrog Plugin for Claude Code

JFrog plugin for Claude Code: artifact management, security scanning, and supply-chain best practices, and Agent Guard.

Features

The JFrog plugin provides the following capabilities, grouped by component:

| Component | Feature | Description | | --- | --- | --- | | MCP | JFrog MCP server | Remote JFrog MCP server auto-attached to every session via .mcp.json (OAuth, no API keys). Run /jfrog-init to set the host. | | Skill | JFrog Platform | Interact with Artifactory repositories, builds, permissions, users, access tokens, projects, release bundles, and platform administration via the JFrog CLI and REST/GraphQL APIs. Also covers security audits, CVE lookups, and Advanced Security exposure queries. | | Skill | Package curation | Check whether npm, Maven, PyPI, Go, and other packages are safe, curated, or allowed, then download them through Artifactory remote caches or curation-aware package managers. | | Hook + Skill | Agent Package Resolution (Preview) | Automatically route packages installed by the AI agent through your organization's JFrog Artifactory, keeping agent-driven installs inside your Curation, Xray, and governance perimeter. | | Hook | Plugin MCP rewrite | On SessionStart / FileChanged, rewrite discovered installed-plugin .mcp.json files through Agent Guard (--rewrite-mcp-json) so stdio MCP entries launch via @jfrog/agent-guard. | | Hook | Skill Governance (Preview) | Evaluates the skills Claude invokes against your organization's JFrog skill governance policies, and blocks the ones that violate them — showing which policies were violated and the command to request a waiver. Enforcement runs in the JFrog Agent Guard; the hook only carries the event to it. | | Skill | Agent Guard | Claude manages MCPs through the JFrog Agent Guard. Through the Agent Guard you can discover, install, configure, update, and remove MCP servers from the JFrog AI Catalog approved for your project, and authenticate to remote HTTP MCPs via OAuth, API key, or bearer token. |

[!IMPORTANT] Skill Governance blocks on policy, not on infrastructure. Three outcomes, and they are distinct: - Your JFrog policies deny the skill — blocked, naming the policies it violated and the command to request a waiver. - The Agent Guard runs, but cannot reach a verdict in time — blocked. It got as far as the check and could not answer, so it does not guess. - **The Agent Guard cannot be *run at all* — `npx` missing, the registry unreachable, no JFrog server configured — allowed**. A machine that cannot run the guard is not governed by it, and blocking there would stop work without enforcing anything. A user who is entitled to nothing is unaffected either way: the Agent Guard returns "allow" for an unconfigured or unentitled user, so no setup is needed to opt out of the feature.

Prerequisites

Before installing, make sure you have:

• JFrog host URL and access token — Your JFrog platform URL and a valid access token.
• Claude Code CLI (≥ 1.0) — The Claude Code CLI.
• Node.js (≥ 18) — with npx on your PATH (used by the Agent Guard). Without it Skill Governance cannot run, and governed actions are allowed unchecked.
• Git Bash on Windows — the Skill Governance hook runs as a Bash command so that it behaves identically on every platform. Install Git for Windows; without it the hook cannot run and governed actions are allowed unchecked. Not needed on macOS or Linux.
• Skill runtime requirements — jf CLI, jq, and curl on PATH, plus a configured JFrog instance. For the minimum versions, see the upstream skills `Requirements`. Configure the CLI with jf config add — see Authentication.
• JFrog AI Catalog (optional) — If you want to use the Agent Guard feature, your JFrog subscription needs to include the AI Catalog entitlement. Contact your JFrog account team if you're unsure whether it's enabled.
• JFrog CLI ≥ 2.105.0 (optional) — If you want the Agent Guard to auto-resolve the credentials/server ID from the JFrog CLI configuration. Older CLIs don't support the --format flag used by jf config show for this.
• JFrog project (optional) — If you want to use the Agent Guard feature.

Installation

Install the Claude plugin

From the official Anthropic marketplace, inside Claude Code: