A cursor plugin for JFrog
概览
JFrog plugin for Cursor: artifact management, security scanning, supply-chain best practices, and Agent Guard. - A hook checks the skills you invoke against your JFrog governance policy and blocks the ones it disallows. See Skills governance. - A hook automatically routes the packages your AI agent installs through your JFrog Artifactory instead of public registries. See Agent Package Resolution. - New jfrog-ai-catalog skill to discover, install, update, and publish agent skills hosted in the JFrog AI Catalog. The JFrog plugin provides the following capabilities, grouped by component: - — Your JFrog platform URL and a valid access token. - — Installed with AI features enabled. - (≥ 18) — with npx on your PATH. - — jf CLI, jq, and curl on PATH, plus a configured JFrog instance. For the minimum versions, see the upstream skills Requirements. Configure the CLI with jf config add — see Authentication.
README
以下为原文 README 节选，完整内容请查看原文。
JFrog Plugin for Cursor
JFrog plugin for Cursor: artifact management, security scanning, supply-chain best practices, and Agent Guard.
What’s new
- Skills governance. A hook checks the skills you invoke against your JFrog governance policy and blocks the ones it disallows. See Skills governance.
- Agent Package Resolution (Preview). A hook automatically routes the packages your AI agent installs through your JFrog Artifactory instead of public registries. See Agent Package Resolution.
- AI Catalog skill. New
jfrog-ai-catalogskill to discover, install, update, and publish agent skills hosted in the JFrog AI Catalog.
Features
The JFrog plugin provides the following capabilities, grouped by component:
| Component | Feature | Description |
|---|---|---|
| MCP | JFrog MCP server | Remote JFrog MCP server auto-attached to every session via mcp.json at https://${JFROG_PLATFORM_URL}/mcp (OAuth, no API keys). |
| Skill | JFrog Platform | Interact with Artifactory repositories, builds, permissions, users, access tokens, projects, release bundles, and platform administration via the JFrog CLI and REST/GraphQL APIs. Also covers security audits, CVE lookups, and Advanced Security exposure queries. |
| Skill | Package curation | Check whether npm, Maven, PyPI, Go, and other packages are safe, curated, or allowed, then download them through Artifactory remote caches or curation-aware package managers. |
| Hook + Skill | Agent Package Resolution (Preview) | Automatically route packages installed by the AI agent through your organization’s JFrog Artifactory, keeping agent-driven installs inside your Curation, Xray, and governance perimeter. |
| Hook | Agent Guard | Cursor manage MCPs through the JFrog Agent Guard. Through the Agent Guard you can discover, install, configure, update, and remove MCP servers from the JFrog AI Catalog approved for your project, and authenticate to remote HTTP MCPs via OAuth, API key, or bearer token. |
| Hook | Skills governance | When a skill is invoked, the plugin checks it against your JFrog governance policy and blocks disallowed or unscanned skills before they run. Covers the two entry points that carry a skill’s identity: skills you run with /, and any read of a SKILL.md (how a skill’s body reaches the model, since Cursor has no dedicated Skill tool). Content that reaches the model without a Read tool call is outside both — see Skills governance. Enforced only when your account is entitled to AI Catalog skills governance. |
Prerequisites
Before installing, make sure you have:
- JFrog host URL and access token — Your JFrog platform URL and a valid access token.
- Cursor — Installed with AI features enabled.
- Node.js (≥ 18) — with
npxon yourPATH.
推荐工具
换一个关键词，或者移除筛选条件。
安装
npx skillfish add jfrog/cursor-plugin