Skip to content

Summary

JFrog's official remote MCP server: 100+ tools across Artifactory, Xray and Curation, hosted on JFrog Cloud with OAuth and no client install.

Features

  • Over 100 tools across Artifactory, Xray, Curation, Distribution, Evidence and AppTrust
  • Remote and hosted on JFrog Cloud; no client-side install or upgrades
  • OAuth authentication, no API keys to manage
  • Vulnerability, policy-violation and licence queries from the IDE
  • GA on JFrog Cloud (SaaS), self-managed option in beta, all licence types supported

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "JFrog MCP Server" tools will be available.
{
  "mcpServers": {
    "jfrog-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://<JFROG_PLATFORM_URL>/mcp"
      ]
    }
  }
}

Description

The official JFrog Model Context Protocol server, giving agents direct access to JFrog Platform services — the software supply chain layer most coding agents are otherwise blind to.

A remote server, not a package

The MCP server is hosted on JFrog Cloud and reached at https://<JFROG_PLATFORM_URL>/mcp. There is nothing to install or upgrade on the client side, and because the tool set evolves server-side you pick up new tools automatically. It is generally available on JFrog Cloud (SaaS), with a self-managed option in beta, and it is supported across all licence types.

Configuration
// VS Code
{ "mcp": { "servers": { "jfrog": { "url": "https://<JFROG_PLATFORM_URL>/mcp" } } } }

// Cursor
{ "mcpServers": { "jfrog": { "url": "https://<JFROG_PLATFORM_URL>/mcp" } } }

Authentication is OAuth — a browser prompt on first connect, and no API keys to mint, rotate or leak into a config file.

What the tools cover

Over 100 tools spanning Access, Artifactory, Security (Xray), Curation, Distribution, Grid, Workers, OneModel, Event, Evidence and AppTrust. In practice that means an agent can manage projects, repositories and components; find which build a package version landed in; check vulnerability scans and policy violations before recommending a dependency; and read catalogue information including licence requirements.

Who it is for

Platform and security engineering teams already on JFrog who want their coding assistants to answer supply-chain questions — is this version affected, where did it come from, does its licence pass policy — from inside VS Code, Cursor, Claude, Kiro or Codex rather than in a separate console.

Related MCP Servers

New

Qase test management over MCP: 36 task-oriented tools for cases, runs, results, defects and QQL search, hosted at mcp.qase.io or self-run with your own API token.

New

Arm's official MCP server for porting and tuning software on Arm — semantic docs search, codebase migration scanning, container architecture checks and LLVM-MCA assembly analysis.

New

Official AntV MCP server that turns a description of your data into a rendered chart — 26 visualization types from bar and line to sankey, mind-map, fishbone and geographic maps.

MCP: Headroom

by Headroom Labs

New

Context-compression MCP server that shrinks tool outputs, logs, files and RAG chunks before they reach the model, cutting 60-95% of tokens on JSON payloads.

Browse all MCP servers →