The server itself exposes 114 tools, and some of them can write to your JFrog account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches JFrog.

How is this different from connecting JFrog MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the JFrog MCP API changes?

We track the JFrog MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different JFrog tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in JFrog?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the JFrog MCP server myself?

No. TrustGate connects to the JFrog MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to JFrog directly.

Connect JFrog MCP to your AI agents, securely.

One secured endpoint for every JFrog call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try JFrog MCP now

What your agents can ask once JFrog MCP is connected.

Select the tools your AI agents can call

114 tools from the JFrog MCP schema.

Showing 114 tools

access_tokens_createhigh riskCreates a new access token, optionally non-expirable and scoped to a project. Beta.
access_tokens_listreadLists access tokens with filters for username, description, token ID and refreshable status. Beta.
access_oidc_create_configurationhigh riskCreates an OIDC identity provider configuration, defining a new trusted token issuer.
access_projects_createwriteCreates a new Access project with its admin privileges and storage quota.
access_projects_getreadGets the details of an Access project.
access_projects_updatewriteUpdates an Access project's name, description, privileges or quota.
access_projects_create_rolewriteCreates a custom project role with its environments and allowed actions.
access_projects_update_rolewriteUpdates a project role. Only CUSTOM roles can be updated.
access_projects_get_userreadGets a user's membership in a project.
access_projects_upsert_userhigh riskAdds or updates a user in a project. The roles given replace all existing roles.
access_projects_list_groupsreadLists the groups assigned to a project.
access_projects_upsert_groupwriteAdds or updates a group in a project. The roles given replace all existing roles.
access_projects_get_repositoryreadGets a repository's project status.
access_projects_move_repository_to_projectwriteMoves a repository into a project, optionally forcing past validation checks.
access_projects_share_repository_with_allhigh riskShares a repository with every project on the platform, optionally read-only.
access_projects_listreadLists all JFrog projects.
access_roles_create_global_rolehigh riskCreates a custom global role with platform-wide permissions. Access 7.77 and later.
access_roles_update_global_rolewriteUpdates an existing custom global role. Access 7.77 and later.
access_stages_list_global_stagesreadLists the global stages configured in the platform, filterable by project, scope and category.
access_users_listreadLists platform users, filterable by status, username, admin-only or project.
access_users_getreadGets the details of a user by username.
access_groups_listreadLists all groups in the platform.
access_groups_getreadGets the details of a group by name.
artifactory_repositories_createwriteCreates a local, remote, virtual or federated repository.
artifactory_repositories_getreadRetrieves the configuration of a single repository by key.
artifactory_repositories_listreadLists repositories, filterable by type, package type and project.
artifactory_repositories_updatewriteUpdates an existing repository's configuration, including Xray indexing and inclusion patterns.
artifactory_packages_get_versionsreadLists the versions of a package stored in Artifactory with summary information. Artifactory 7.146.0 and later.
artifactory_packages_get_version_repositoriesreadFinds which repositories hold a specific package version. Artifactory 7.146.0 and later.
artifactory_packages_get_install_instructionsreadGets the native client commands for installing a specific package version. Artifactory 7.133.3 and later.
artifactory_builds_list_buildsreadLists builds using AQL, returning names, numbers and timestamps. The query must use builds.find() and include a limit.
artifactory_builds_list_build_runsreadLists all runs of a named build, newest first.
artifactory_builds_get_inforeadGets the full build info for a run: metadata, modules, artifacts, dependencies and CI/VCS information, optionally diffed against an older build.
artifactory_federation_get_statusreadGets the health status of federated repositories.
artifactory_federation_get_conflictsreadFinds federated repositories with configuration conflicts.
artifactory_federation_update_repo_configwriteSynchronizes a federated repository's configuration to its members.
artifactory_storage_artifact_inforeadRetrieves storage information about a file or folder, with optional deep listing, download statistics, properties and permissions. Artifactory 7.135 and later.
xray_artifact_get_summaryreadGets the Xray security summary of one or more artifacts by path or checksum.
xray_artifact_get_violationsreadGets Xray policy violation counts for one artifact across one or more versions.
xray_artifact_security_statusreadGets the Xray indexing and download-block status of a single artifact. Xray 3.147.2 and later.
xray_sbom_search_impacted_resourcesreadSearches impacted resources by vulnerability, package, package version or SaaS service.
catalog_vulnerabilities_getreadGets vulnerability information for a CVE, including affected packages and versions.
catalog_packages_versions_vulnerabilitiesreadLists the known vulnerabilities for a specific package version.
catalog_packages_list_versionsreadLists versions of a publicly available package, filterable by vulnerability status.
catalog_packages_getreadGets public information about a software package.
jfs_curation_check_remote_package_compliancereadChecks Curation compliance for a third-party package before installing or recommending it. Xray 3.147.2 and later.
jfs_curation_query_audit_eventsreadSearches blocked Curation package audit events. Covers policy blocks only, not approved or dry-run events.
jfs_curation_query_cvs_audit_eventsreadSearches Compliant Version Selection audit events: which versions were approved or blocked and the policies involved. Xray 3.153.0 and later.
jfs_curation_get_cvs_audit_version_detailreadGets the full policy explanation and remediation for one package version evaluated by CVS.
jfs_curation_get_audit_event_policiesreadGets the policies, explanation and remediation behind one download-time Curation block.
jfs_curation_create_waiver_requestwriteCreates a waiver request for a package blocked by a Curation policy. Xray 3.148.0 and later.
jfs_curation_query_waiver_requestsreadSearches and checks the status of Curation waiver requests.
jfs_curation_decide_waiver_requesthigh riskApproves or rejects a pending waiver request, unblocking a package the policy rejected. Xray 3.149.0 and later.
distribution_release_bundles_distributehigh riskStarts a Release Bundle v2 distribution to one or more edge nodes. Can bypass the Xray scan block and auto-create missing repositories.
distribution_release_bundles_abortwriteAborts an in-progress distribution. Does not roll back already-transferred files.
distribution_release_bundles_get_path_mappingreadGets the applied path mapping and ATW flag for a release bundle version.
distribution_trackers_listreadLists the distribution trackers for a release bundle version.
distribution_trackers_get_by_idreadGets per-edge progress for a specific distribution tracker.
distribution_signing_keys_get_for_bundlereadGets the signing keys associated with a release bundle version.
distribution_signing_keys_get_publicreadRetrieves the public part of a Distribution signing key as PEM.
distribution_signing_keys_propagatehigh riskPushes a public signing key to every edge node.
distribution_edges_list_for_bundlereadLists the edge nodes eligible for a release bundle distribution or deletion.
aicatalog_skills_listreadLists the skills published in the JFrog AI Catalog.
aicatalog_agent_plugins_listreadLists the agent plugins published in the JFrog AI Catalog.
aicatalog_mcps_listreadLists the MCP servers the AI Catalog has approved for a project.
aicatalog_mcps_allowhigh riskApproves an MCP server for use in a project, widening what every agent there can reach.
aicatalog_mcps_restrictwriteRemoves an MCP server's approval for a project.
grid_jpds_listreadLists the JPDs known to Mission Control for Grid topology membership.
grid_topology_listreadLists all Grid topologies with their member sites and connection status.
grid_topology_getreadGets one Grid topology by key, including member sites and connection status.
grid_monitoring_summarize_entitiesreadGets aggregated entity-sync counts per type for a Grid topology.
grid_monitoring_list_entitiesreadLists entity IDs and sync status for one entity type in a Grid topology.
grid_monitoring_get_entityreadGets per-target sync detail for one entity, including failure descriptions.
worker_list_allreadLists the JFrog Workers on the platform.
worker_get_specificreadRetrieves the full details of a single Worker by key.
worker_executehigh riskExecutes a GENERIC_EVENT Worker by key with a custom JSON payload. Beta.
worker_list_actionsreadLists the Worker trigger actions available.
worker_get_instructions_for_code_generationreadReturns a code template, type definitions, PlatformContext typings and best-practice instructions for implementing Worker code.
worker_createhigh riskCreates a Worker from full TS/JS source, with its secrets and properties. The Worker is created disabled.
worker_updatehigh riskUpdates an existing Worker, including its code, secrets and enabled state. Beta.
worker_get_execution_historyreadRetrieves the execution history for Workers, optionally including test runs.
onemodel_graphql_query_introspectreadDescribes the OneModel schema for one or more entities so a query can be built. Beta, OneModel 1.109.0 and later.
onemodel_graphql_query_executereadRuns a GraphQL query against the OneModel unified data endpoint. Beta.
event_domains_listreadLists the webhook domain and event type catalog on the Event service.
event_subscriptions_listreadLists the webhook subscriptions the caller can read.
event_subscriptions_getreadGets one webhook subscription by key.
event_subscriptions_createhigh riskCreates a webhook subscription that delivers platform events to an external handler URL.
event_subscriptions_updatewriteUpdates a webhook subscription as a full replace. Beta.
event_troubleshooting_statusreadChecks whether webhook delivery recording and the troubleshooting data API are available.
event_troubleshooting_listreadLists the latest webhook delivery attempt per subscription.
event_troubleshooting_countreadCounts webhook delivery records and errors since a troubleshooting stream start ID.
evidence_config_getreadRetrieves the Evidence service configuration exposed to clients. Evidence 7.277 and later.
evidence_config_get_categoriesreadRetrieves the full Evidence category configuration.
evidence_config_update_categorieswriteReplaces the Evidence categories configuration. Beta.
evidence_categories_listreadLists the predicate categories supported by JFrog Evidence.
evidence_categories_get_predicate_typesreadRetrieves all predicate type URIs belonging to a specific Evidence category.
evidence_records_searchreadSearches evidence records by repository, subject path, subject name or SHA-256.
evidence_records_get_by_subjectreadLists all evidence records attached to a specific subject.
evidence_records_get_by_idreadRetrieves a single evidence record by its unique ID.
evidence_records_get_markdown_by_idreadRetrieves the human-readable Markdown rendering of a single evidence record. Evidence 7.289 and later.
evidence_records_prepare_statementreadPrepares a ready-to-sign in-toto statement for an artifact, build, package, release bundle or application version.
evidence_records_create_by_subjectwriteUploads an already-signed DSSE envelope as evidence and attaches it to a subject.
apptrust_create_applicationwriteCreates a new AppTrust application with its maturity level, criticality, labels and owners.
apptrust_get_application_summaryreadGets the details of an AppTrust application.
apptrust_list_applicationsreadLists AppTrust applications with filters for project, name, criticality, maturity, labels and owners.
apptrust_create_application_versionwriteCreates a new version of an application from builds, packages, artifacts, release bundles, AQL or other app versions.
apptrust_list_versionsreadLists the versions of an application, filterable by release status and tag.
apptrust_get_application_version_statusreadGets the release status for a specific application version.
apptrust_get_lifecycle_overviewreadGets the lifecycle stages configuration for a project.
apptrust_promote_versionhigh riskPromotes an application version to a lifecycle stage. Supports dry_run as a promotion type.
apptrust_get_version_promotion_historyreadGets all promotions for a specific application version.
apptrust_release_versionhigh riskReleases an application version to the PROD stage.
apptrust_rollback_versionhigh riskRolls back the latest promotion of an application version from a given stage.
apptrust_get_activity_logsreadGets activity log events from AppTrust, filterable by application, project, time range and creator.

What JFrog MCP exposes

JFrog MCP groups its 114 tools into 12 categories, each with a suggested starting policy.

All 114 tools as JSON, ready to paste.

Category	Covers	Access	Suggested policy
Access	Access tokens, OIDC identity providers, projects with their roles, members and repository assignment, global roles, stages, users and groups	Read / Write	The highest-privilege surface on the server: token creation, OIDC config and global roles all change who can do what
Artifactory	Repository configuration, package versions and install commands, builds and build info, federation health and artifact storage metadata	Read / Write	Builds are queried with AQL and require a .limit(N); cap result sizes
AppTrust	Application lifecycle, versioning, lifecycle stages, promotion, release and rollback	Read / Write	Promotion and release move software toward production; require approval and prefer dry_run first
Evidence	Evidence service configuration, predicate categories, and evidence record search, retrieval, preparation and creation	Read / Write	Evidence is signed supply-chain attestation; creation uploads a DSSE envelope
Distribution	Release Bundle v2 distribution to edge nodes, trackers, signing keys and edge eligibility	Read / Write	Distribution can bypass the Xray block; aborting does not roll back transferred files
Security	Xray artifact summaries, policy violations, indexing status, impacted-resource search and Catalog vulnerability lookups	Read	Read-only; findings are sensitive, restrict to the security team
Curation	Third-party package compliance checks, download-block and Compliant Version Selection audit events, and waiver requests	Read / Write	Deciding a waiver unblocks a package the policy rejected; keep a human on it
Workers	JFrog Workers listing, creation, update, execution and execution history	Read / Write	Workers are arbitrary TS/JS that run on the platform and can hold secrets; treat creation and execution as code deployment
Event	The webhook domain and event-type catalog, subscription management and delivery troubleshooting	Read / Write	A subscription sends platform events to an external URL; force skips handler verification
Platform Federation (Grid)	Grid topology, JPD inventory and entity sync monitoring	Read	Read-only topology and sync status
AI Catalog	Published skills, agent plugins, and governance of which MCP servers are approved per project	Read / Write	Approving an MCP server widens what every agent in that project can reach
OneModel	Schema introspection and GraphQL execution against the JFrog OneModel unified data endpoint	Read	Introspect first, then execute; queries can reach across the whole platform

Connect JFrog MCP to your AI agent

Four steps, under ten minutes.

01
Sign in to NeuralTrust
Open the NeuralTrust platform, sign in and go to Getting started, then Connect your tools.
02
Choose your agent
When asked which agent you use, pick Claude Code, Codex, Cursor, Windsurf, Copilot or your own code.
03
Connect JFrog
Find JFrog in the tool list and connect it.
04
Connect your agent
Follow the steps on screen to add the config to your agent, then send the test prompt.

Permissions down to the single tool

You do not allow JFrog MCP or block it. You allow the exact tools each agent can call, one by one.

JFrog MCP	114 TOOLS AVAILABLE
Code review agent	4 tools, read only
Issue triage bot	9 tools
Platform team assistant	all 114 tools

Tool by toolConnecting the server is not the unit of access. Each tool is granted on its own.
Default denyA tool you have not enabled is never exposed to the agent.
Approval on writesTools that change or delete things can require a human to confirm.

Is JFrog MCP secure?

One endpoint instead of raw credentials. Every call is checked against policy and logged.

AI agentsConnect through your MCP client configuration.	NeuralTrustApply controls based on your configuration.	JFrog MCP114 documented tools across 23 toolsets.
Coding assistants	Connection & credentialsper user	Access23 tools
Internal copilots	Tool access policiesdeny by default	Artifactory14 tools
Workflow automations	Request & response inspectioninline	AppTrust12 tools
Compatible MCP clients	Activity monitoringalerts and logs	All other tools65 tools