JFrog is introducing a series of new features designed to keep AI coding agents under control. The company is linking AI assets directly to its platform and adding an AgentSecOps workflow. With this, JFrog aims to become the single point of record for everything agents fetch or deliver.
Coding agents write code and pull in software. Dependencies, skills, context files, MCP servers: agents choose where to source these themselves, without anyone looking over their shoulder. According to JFrog, that’s exactly where the problem lies.
“The DevSecOps controls we built over a decade assumed a human developer was at the keyboard. Today, that assumption has broken – a software supply chain run by agents doesn’t stop for reviews,” says Co-Founder and CTO Yoav Landman. A supply chain run by agents doesn’t stop for reviews.
What agents are allowed to consume
The new capabilities fall into two categories. On the consumption side, there’s AI Asset Scanning, which indexes and blocks models, MCPs, skills, and plugins. JFrog semantically scans Markdown files, skill scripts, and instruction sets even before they reach a workstation. An Agent Plugins Registry and Agent Guard then restrict which plugins and assets agents can use in Claude Code, Cursor, and VS Code.
Notable is the inclusion of the Agent Package Manager in Artifactory. This Microsoft-led, open-source standard functions as a sort of package.json for AI agents: prompts, skills, and MCP servers are defined in an apm.yml file and rolled out with fixed versions.
Network layer as the final piece
On the build side, the JFrog Agent Plugin and Agent Package Resolution ensure that agents retrieve dependencies exclusively via Artifactory. Traffic Controller, together with SASE partners Cloudflare, Netskope, and Zscaler, blocks calls to public registries at the network level.
JFrog is thus building on previous steps. Last year, the company introduced shadow AI detection to the platform and launched its own MCP server for AI-driven development workflows.
All features are available immediately.