Semgrep
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
CCCXGBCUPi
Jfrog
Use the JFrog Platform from Claude Code: Artifactory repos and artifacts, security findings and exposures, Catalog package safety and downloads, workflows across the SDLC, and platform administration.
- GitHub
- jfrog/claude-plugin ↗
- Stars
- ★ 6
- Last updated
- Hands-on tests
- Tested ✓ in 2 of 5
Install
Tested ✓✓ Verified from docsOfficial docs ↗
/plugin install jfrog@claude-plugins-officialTested ✓ on 2026-10-16: installed and loaded in a throwaway sandbox with no credentials.
Log excerpt
Installing plugin "jfrog@claude-plugins-official"...✔ Successfully installed plugin: jfrog@claude-plugins-official (scope: user)
$ verify:
❯ jfrog@claude-plugins-official
Status: ✔ enabled1 run, latest 2026-10-16
Not yet tested
No official Codex instructions yet. We haven't found docs saying this works in Codex.
Know it works? Tell us →Tested ✓✓ Verified from docsOfficial docs ↗
Auto-loaded from your Claude Code plugins (no extra setup per xAI docs)Tested ✓ on 2026-10-16: installed and loaded in a throwaway sandbox with no credentials.
Log excerpt
Installed 1 plugin(s) from claude-plugins-official: jfrog $ verify: claude-plugin-85fe3aad: jfrog [git: https://github.com/jfrog/claude-plugin.git] (claude-plugins-official)
1 run, latest 2026-10-16
Not yet tested
No official Cursor instructions yet. We haven't found docs saying this works in Cursor.
Know it works? Tell us →Not yet tested
No official Pi instructions yet. We haven't found docs saying this works in Pi.
Know it works? Tell us →README
View on GitHub ↗JFrog Plugin for Claude Code
JFrog plugin for Claude Code: artifact management, security scanning, and supply-chain best practices, and Agent Guard.
Features
The JFrog plugin provides the following capabilities, grouped by component:
| Component | Feature | Description |
|---|---|---|
| MCP | JFrog MCP server | Remote JFrog MCP server auto-attached to every session via .mcp.json (OAuth, no API keys). Run /jfrog-init to set the host. |
| Skill | JFrog Platform | Interact with Artifactory repositories, builds, permissions, users, access tokens, projects, release bundles, and platform administration via the JFrog CLI and REST/GraphQL APIs. Also covers security audits, CVE lookups, and Advanced Security exposure queries. |
| Skill | Package curation | Check whether npm, Maven, PyPI, Go, and other packages are safe, curated, or allowed, then download them through Artifactory remote caches or curation-aware package managers. |
| Hook + Skill | Agent Package Resolution (Preview) | Automatically route packages installed by the AI agent through your organization's JFrog Artifactory, keeping agent-driven installs inside your Curation, Xray, and governance perimeter. |
| Hook | Plugin MCP rewrite | On SessionStart / FileChanged, rewrite discovered installed-plugin .mcp.json files through Agent Guard (--rewrite-mcp-json) so stdio MCP entries launch via @jfrog/agent-guard. |
| Hook | Skill Governance (Preview) | Evaluates the skills Claude invokes against your organization's JFrog skill governance policies, and blocks the ones that violate them — showing which policies were violated and the command to request a waiver. Enforcement runs in the JFrog Agent Guard; the hook only carries the event to it. |
| Skill | Agent Guard | Claude manages MCPs through the JFrog Agent Guard. Through the Agent Guard you can discover, install, configure, update, and remove MCP servers from the JFrog AI Catalog approved for your project, and authenticate to remote HTTP MCPs via OAuth, API key, or bearer token. |
[!IMPORTANT] Skill Governance blocks on policy, not on infrastructure. Three outcomes, and they are distinct:
- Your JFrog policies deny the skill — blocked, naming the policies it violated and the command to request a waiver.
- The Agent Guard runs, but cannot reach a verdict in time — blocked. It got as far as the check and could not answer, so it does not guess.
- The Agent Guard cannot be run at all —
npxmissing, the registry unreachable, no JFrog server configured — allowed. A machine that cannot run the guard is not governed by it, and blocking there would stop work without enforcing anything.A user who is entitled to nothing is unaffected either way: the Agent Guard returns "allow" for an unconfigured or unentitled user, so no setup is needed to opt out of the feature.
Preview from the source repo. Images are removed.
Similar alternatives
Crowdstrike Falcon Foundry
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform....
CCCXGBCUPi
Stackhawk Hawkscan
Configure, run, and interpret HawkScan DAST results inside Claude Code. Generates stackhawk.yml configs, runs...
CCCXGBCUPi
Vanta
The Vanta plugin connects Claude Code to Vanta's security and compliance platform through the Vanta MCP...
CCCXGBCUPi