JFrog's plugin for Claude Code: its MCP server plus skills for Artifactory, security audits, package curation and governed MCP installs.
by jfrog· SecurityUnclaimed · Yours? Claim it
4 images
About
JFrog's official plugin for Claude Code. It connects your agent to your JFrog Platform through JFrog's remote MCP server and adds JFrog's skills and hooks, so you can manage artifacts, check packages and run security audits from the chat, with your agent's installs kept inside your organization's governance. What's in it - The JFrog MCP server, attached to every session at your own platform's address, with OAuth sign-in and no API keys - A JFrog Platform skill: Artifactory repositories, builds, permissions, users, access tokens, projects, release bundles and administration through the JFrog CLI and APIs, plus security audits, CVE lookups and Advanced Security exposure queries - Package curation: check whether npm, Maven, PyPI, Go and other packages are safe and allowed, then download them through Artifactory - Agent Guard: discover, install, configure and remove the MCP servers your project has approved in the JFrog AI Catalog, and find, install and publish catalog skills and plugins - Package manager setup for Artifactory, and guidance on sizing and deploying the JFrog Platform from its reference architecture - Agent Package Resolution (preview): routes the packages your agent installs (npm, PyPI, Maven, Go, Docker, Helm and NuGet) through your organization's Artifactory - Skill Governance (preview): checks the skills Claude uses against your organization's JFrog policies and blocks the ones that break them How to install it In Claude Code, run /plugin install jfrog@claude-plugins-official. Then run /jfrog-init to set your JFrog host and finish setup, and restart Claude Code. Good to know - You need your JFrog Platform URL and an access token (set JFROG_URL and JFROG_ACCESS_TOKEN, and configure the JFrog CLI with jf config add), Node.js 18 or later, and the jf CLI, jq and curl for the skills. - Agent Guard needs the JFrog AI Catalog on your subscription and a JFrog project. - When an MCP server needs a secret, the agent gives you a command to run in your terminal, so secrets never appear in the chat.
Once it’s added
“List my Artifactory repositories.”
“Run a security audit on this project.”
“Show me details on CVE-2021-23337.”
“Is [email protected] safe to install?”
“Which MCP servers can I install?”
“Promote this release bundle to production.”
Before you add it
Reads only
Artifactory repositories, builds and artifacts · Security audits, CVE details and Advanced Security exposures · Whether a package is safe, curated and allowed · The MCP servers, skills and plugins your project has approved
Makes changes · your agent can ask first
Uploads builds and promotes release bundles · Creates access tokens and manages users, permissions and projects · Installs and removes approved MCP servers through Agent Guard · Can route the packages your agent installs through your Artifactory (preview)
From people who use it
Step by step
Nothing new reaches your agent until a person has looked at it.
No reviews yet. Used JFrog plugin? Say how it went.
Write a reviewRuns on your machine.
Runs on your machine.
/plugin marketplace add anthropics/claude-plugins-official /plugin install jfrog@claude-plugins-official
Scanned and passed · checked 6 h ago
Nobody has shared how they use JFrog plugin yet.
Plugins people install alongside JFrog plugin.
Scanned on every change, and again when our rules improve.
Claude CodeSupported
OpenClawSupportedTell us and a person on the trust team will look at it. Or email [email protected].
Plugins people install alongside JFrog plugin.
Anthropic's security review for Claude Code: flags injection, XSS, secrets and more as Claude edits, finishes a turn and commits.
Equips your coding agent with SAST, dependency scanning, a phased hardening workflow and STRIDE threat-modeling skills.
Alireza Rezvani's Claude Code hook that stops Claude before it writes common security anti-patterns, such as eval, pickle or SQL f-strings.
Microsoft's skills for Azure Data Explorer: build Kusto graphs, compose IRQL threat hunts and turn results into visual graphs.
Security scan
Passed
Safe to install in every agent it supports. Claude plugins.
