JFrog MCP

JFrog runs the binary side of a software supply chain. Artifactory stores packages and build artifacts, Xray scans them for vulnerabilities and license violations, and Curation blocks risky open source before it ever lands in a repository. The official MCP server exposes that platform to an AI assistant as a set of search and read tools, so an agent can answer supply chain questions without a human paging through the web UI. An agent can list and filter repositories across package types, search for a specific package or artifact and read its metadata and properties, and browse builds together with the dependencies and artifacts each build produced. On the security side it pulls Xray findings for a given artifact, build, or release bundle, including vulnerability identifiers, severity, fix status, and the affected component path. Because scan results and package data sit behind the same interface, an assistant can trace a flagged component back to the builds and images that ship it, or explain why a package request was blocked by a curation policy. Access uses a JFrog platform access token, so results are limited to the repositories and projects that token can already see. It is aimed at DevSecOps and platform engineers who spend their time triaging scan output, validating a promotion, and proving which artifacts are affected by a newly disclosed vulnerability.