Jfrog MCP Server
JFrog Platform API access for repository management and build tracking.
Data last scanned last week · Reviewed last month
Overview
This experimental MCP server provides an interface to the JFrog Platform API, allowing AI assistants to perform tasks such as repository management, build tracking, and runtime monitoring. It includes capabilities for artifact searching via AQL, cataloging, and security scanning through Xray. Note that this repository is officially deprecated and is no longer maintained. It served as an experimental demonstration of MCP integration, but it does not receive updates, bug fixes, or security patches. Users are strongly advised to migrate to the official, supported JFrog MCP server.
Our verdict
This repository carries a high risk level with a security score of 45/100. The project is explicitly marked as deprecated and abandoned, and the lack of editorial review or official vendor maintenance means users have no support or security oversight. You should not use this server for any purpose; please utilize the official, vendor-supported JFrog MCP server instead.
- Uses Apache-2.0 open-source licensing
- Limited supply-chain footprint with 11 direct dependencies
- Explicitly marked as deprecated and abandoned by the publisher
- High security risk score due to lack of maintenance
- No official support or verification provided
Setup
{
"mcpServers": {
"mcp-jfrog": {
"args": [
"-y",
"mcp-jfrog"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| check_jfrog_availability | Check if JFrog platform is ready and functioning | low |
| create_local_repository | Create a new local repository in Artifactory | medium |
| create_remote_repository | Create a new remote repository in Artifactory to proxy external package registries | medium |
| create_virtual_repository | Create a new virtual repository in Artifactory that aggregates multiple repositories | medium |
| list_repositories | List all repositories in Artifactory with optional filtering | low |
| set_folder_property | Set properties on a folder in Artifactory, with optional recursive application | medium |
| execute_aql_query | Execute an Artifactory Query Language (AQL) query to search for artifacts, builds, or other entities in JFrog Artifactory | low |
| list_jfrog_builds | Return a list of all builds in the JFrog platform | low |
| get_specific_build | Get details for a specific build by name | low |
| list_jfrog_runtime_clusters | Return a list of all runtime clusters in the JFrog platform | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›Should I use this repository for my projects?
No, this project is deprecated and no longer maintained. You should not use it for new or existing integrations.
›Is there a recommended alternative?
Yes, you should use the official JFrog MCP Server provided by JFrog, which is secure, production-ready, and receives ongoing updates.
Alternatives
Badge
Maintain this server? Add the live badge to your README.