JFrog MCP Server

The JFrog MCP Server connects AI assistants to the JFrog Platform. If you manage packages, container images and build outputs in Artifactory and check open-source dependencies with Xray or Curation, you can query that data straight from your editor and handle admin tasks from a prompt. MCP, the Model Context Protocol, is an open standard through which an assistant such as Claude Code, Cursor or Codex calls external tools. JFrog runs the server itself: according to the documentation it is generally available for JFrog Cloud, maintained by JFrog and continuously extended with new tools, with nothing for you to install or upgrade.

How the server is provided

Unlike many MCP servers, the JFrog MCP Server does not live at one central address but directly on your own platform instance. The address follows the pattern https://your-company.jfrog.io/mcp, meaning the base URL of your JFrog Platform Deployment (JPD) with /mcp appended. Before anyone can use it, a Platform Admin has to enable the server once under Integrations; that switch then applies to every user on the subscription. During setup you can optionally tick Enable Beta Tools to expose additional experimental tools. Without that option, only generally available tools are offered.

For self-hosted platforms there is a separate variant, which the installation guide still labels as beta and which requires accepting a beta agreement. There the wingman service serves the MCP server, installed with Helm or Docker Compose next to the existing platform and, by default, with a bundled PostgreSQL database. The older open-source project jfrog/mcp-jfrog on GitHub is now marked as deprecated; the hosted server is the one to use.

Signing in with OAuth

According to the documentation, sign-in uses OAuth: you add the address to your client, and on first use the assistant signs in with your JFrog account. You do not have to create access tokens by hand or store them in configuration files. In principle the assistant can therefore see whatever your account can see. JFrog recommends granting rights on a least-privilege basis and turning on human approval in the client, so that any tool that creates, updates or deletes something in the platform only runs after you confirm it.

What can the JFrog MCP Server do?

The tool list is organised by area. For Artifactory there are tools to list, create and update repositories, to look up package versions along with install instructions, to read builds and build runs, and to check the status of federated repositories. In the Access area the assistant manages projects, roles, project members and groups, lists users and can create an OIDC configuration. In the Security area, Xray returns summaries, violations and the security status of individual artifacts; through the Catalog you look up vulnerabilities and versions of open-source packages, for example before adding a new dependency.

Further areas target teams that use the platform more broadly: Curation checks whether a package from a remote repository complies with policy, shows blocked downloads and handles waiver requests. Distribution ships release bundles, AppTrust creates, promotes, releases or rolls back application versions, and Evidence reads and creates evidence records for artifacts. On top of that there are tools for Workers, event subscriptions and an AI Catalog that lets you approve or restrict MCP servers per project. According to the documentation, many tools need a minimum version of the respective product.

Costs and subscription tiers

According to the documentation, the MCP server itself costs nothing extra and is included at every subscription level. It does, however, require an active JFrog Cloud subscription, and the Curation and Catalog tools additionally need the Unified Security or Ultimate Security bundle. The pricing page lists the cloud plans Pro, Enterprise X and Enterprise+, self-hosted plans, and security and MLOps bundles; it does not show a permanently free tier. Current terms are on JFrog's pricing page.

Who is the JFrog MCP Server for?

It is most useful for platform and DevOps teams that already rely on Artifactory as their central package source. Typical questions such as "Is this version of lodash affected by a critical vulnerability?", "Which repository holds this package?" or "Which builds failed yesterday?" get answered by the assistant without anyone digging through the web interface. Routine jobs such as creating a new project with repositories and roles turn into a short prompt as well. If you do not use JFrog, it offers you nothing; for plain vulnerability lookups without a JFrog subscription, other services are a better fit. Because many tools write data and can promote or roll back releases, have every write action confirmed and start out with read-only queries.

An active JFrog Cloud subscription on which a Platform Admin has enabled the JFrog MCP Server, a JFrog account for OAuth sign-in, and an MCP client with HTTP transport and OAuth, such as Claude Code, Cursor, VS Code or Codex. Curation and Catalog tools also need Unified Security or Ultimate Security.

With the JFrog MCP Server, an AI assistant queries repositories, builds and vulnerabilities straight from the JFrog Platform. This guide takes you from enabling the server to your first query.

Step 1: Prerequisites

You need an active JFrog Cloud subscription, a JFrog account and an MCP client that supports HTTP servers with OAuth, such as Claude Code, Cursor, VS Code or Codex. Only a Platform Admin may enable the server. Curation and Catalog tools additionally need Unified Security or Ultimate Security.

Step 2: Enable the server in the platform

As a Platform Admin, open the Integrations section in the Platform module, choose JFrog MCP Server and click Set Up. Optionally tick Enable Beta Tools to expose experimental tools; when starting out it is wise to leave this off. The dialog shows the address in the format https://your-company.jfrog.io/mcp. Copy it; the setting then applies to every user on the subscription.

Step 3: Connect it to Claude Code

The command is claude mcp add --transport http jfrog https://your-company.jfrog.io/mcp. Alternatively, add an entry named jfrog under mcpServers in the configuration file with "type": "http" and the address. On first use, the OAuth sign-in to your JFrog instance opens. Then check with /mcp that the tools have loaded.

claude mcp add --transport http jfrog https://your-company.jfrog.io/mcp

Cursor, VS Code and Codex

In Cursor, Kiro and Codex, an entry under mcpServers named jfrog with a url field is enough. VS Code expects the configuration in .vscode/mcp.json with a servers object; according to JFrog, an administrator may have disabled MCP in VS Code, though. Sign-in uses OAuth in every case.

Step 4: First queries

Start with read-only questions, for example: "Which versions of express are in our repositories, and is any of them affected by a critical vulnerability?" The assistant uses Artifactory and Catalog tools for this. You can also list recent build runs or fetch the install instructions for a package in your repository.

Secure write actions

Many tools create repositories, projects or roles, distribute release bundles or roll back application versions. JFrog recommends turning on human approval in the client so that every create, update or delete action only runs after you confirm it, and giving the account only the rights it needs. Enable Beta Tools such as creating access tokens only deliberately.

OAuth with your JFrog account via your own platform instance; no manually created tokens are needed in the client configuration.

Read: repositories, package versions, builds, projects, users and groups, Xray results, Catalog vulnerabilities, Curation events, release bundles and evidence. Write: create or update repositories, projects and roles, distribute release bundles, promote, release or roll back application versions, create Workers, decide waiver requests. What succeeds depends on the rights of the signed-in account.

The server runs on your own JFrog Cloud instance. Retrieved data such as package lists, vulnerabilities, build information and user data enters the AI client context and therefore reaches the model provider, whose terms apply according to JFrog.

Write tools can change repositories and roles, distribute or roll back releases and approve exceptions to security policy. Beta Tools add, for example, creating access tokens and running Workers. Package metadata from third-party sources can carry prompt injection. JFrog recommends least privilege and confirming every write action in the client.