by jfrog
Model Context Protocol (MCP) Server for the JFrog Platform API, enabling repository management, build tracking, release lifecycle management, and more.
# Add to your Claude Code skills
git clone https://github.com/jfrog/mcp-jfrogGuides for using mcp servers skills like mcp-jfrog.
Last scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"severity": "high"
},
{
"type": "npm-audit",
"message": "body-parser: body-parser is vulnerable to denial of service when url encoding is used",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion Regular Expression Denial of Service vulnerability",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
"severity": "high"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"severity": "medium"
}
],
"status": "WARNING",
"scannedAt": "2026-05-30T16:29:58.967Z",
"npmAuditRan": true,
"pipAuditRan": true
}mcp-jfrog is an open-source mcp servers skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by jfrog. Model Context Protocol (MCP) Server for the JFrog Platform API, enabling repository management, build tracking, release lifecycle management, and more. It has 119 GitHub stars.
mcp-jfrog returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/jfrog/mcp-jfrog" and add it to your Claude Code skills directory (see the Installation section above).
mcp-jfrog is primarily written in TypeScript. It is open-source under jfrog on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other MCP Servers skills you can browse and compare side by side. Open the MCP Servers category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh mcp-jfrog against similar tools.
No comments yet. Be the first to share your thoughts!
Top skills in this category by stars
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
[!CAUTION]
🚨 THIS PROJECT IS DEPRECATED AND NO LONGER MAINTAINED 🚨
Do not use this repository for new or existing integrations.
This experimental MCP server has been superseded by the official JFrog MCP Server, which is built, maintained, and supported by JFrog. The official server is secure, remotely hosted, production-ready, and receives ongoing updates, bug fixes, and security patches.
👉 Use the official JFrog MCP Server instead:
https://jfrog.com/help/r/jfrog-integrations-documentation/jfrog-mcp-server
No further features, fixes, or security updates will be delivered to this repository. Any content below is preserved for historical reference only.
Model Context Protocol (MCP) Server for the JFrog Platform API, enabling repository management, build tracking, release lifecycle management, and more.
https://github.com/user-attachments/assets/aca3af2b-f294-41c8-8727-799a019a55b5
This project is deprecated and is no longer maintained by JFrog.
It was originally created as an experimental project to demonstrate JFrog's capabilities with MCP and was never officially supported or verified by JFrog. It will not receive further updates, bug fixes, or security patches.
JFrog now provides an official, secure, and remotely hosted MCP server for seamless integration with the JFrog Platform. The managed MCP server is maintained by JFrog and is the recommended and only supported option going forward, offering enhanced security, reliability, and support.
Please migrate to the official server:
👉 JFrog MCP Server — Official Documentation
check_jfrog_availability
create_local_repository
key (string): Repository keyrclass (string): Repository class (must be "local")packageType (string): Package type of the repositorydescription (optional string): Repository descriptionprojectKey (optional string): Project key to assign the repository toenvironments (optional string[]): Environments to assign the repository tocreate_remote_repository
key (string): Repository keyrclass (string): Repository class (must be "remote")packageType (string): Package type of the repositoryurl (string): URL to the remote repositoryusername (optional string): Remote repository usernamepassword (optional string): Remote repository passworddescription (optional string): Repository descriptionprojectKey (optional string): Project key to assign the repository toenvironments (optional string[]): Environments to assign the repository tocreate_virtual_repository
key (string): Repository keyrclass (string): Repository class (must be "virtual")packageType (string): Package type of the repositoryrepositories (string[]): List of repository keys to include in the virtual repositorydescription (optional string): Repository descriptionprojectKey (optional string): Project key to assign the repository toenvironments (optional string[]): Environments to assign the repository tolist_repositories
type (optional string): Filter repositories by type (local, remote, virtual, federated, distribution)packageType (optional string): Filter repositories by package typeproject (optional string): Filter repositories by project keyset_folder_property
folderPath (string): Path to the folder where properties should be setproperties (object): Key-value pairs of properties to setrecursive (optional boolean): Whether to apply properties recursively to sub-foldersexecute_aql_query
query (string): The AQL query to execute. Must follow AQL syntax (e.g., items.find({"repo":"my-repo"}).include("name","path"))domain (optional string): The primary domain to search in (items, builds, archive.entries, build.promotions, releases)transitive (optional boolean): Whether to search in remote repositorieslimit (optional number): Maximum number of results to returnoffset (optional number): Number of results to skipinclude_fields (optional string[]): Fields to include in the resultssort_by (optional string): Field to sort results bysort_order (optional string): Sort order (asc or desc)list_jfrog_builds
get_specific_build
buildName (string): Name of the build to retrieveproject (optional string): Project key to scope the build searchlist_jfrog_runtime_clusters
limit (optional integer): The maximum number of clusters to returnnext_key (optional string): The next key to use for paginationget_jfrog_runtime_specific_cluster
clusterId (integer): The ID of the cluster to retrievelist_jfrog_running_images
filters (optional string): Filters to applynum_of_rows (optional integer): Number of rows to returnpage_num (optional integer): Page numberstatistics (optional boolean): Whether to include statisticstimePeriod (optional string): Time period to querylist_jfrog_environments
list_jfrog_projects
get_specific_project
project_key (string): The unique key of the project to retrievecreate_project
project_key (string): Unique identifier for the projectdisplay_name (string): Display name of the projectdescription (string): Description of the projectadmin_privileges (object): Administrative privileges for the projectstorage_quota_bytes (number): Storage quota in bytes (-1 for unlimited)jfrog_get_package_info
type (string): The type of package (pypi, npm, maven, golang, nuget, huggingface, rubygems)name (string): The name of the package, as it appears in the package repositoryversion (optional string): The version of the package (default: "latest")jfrog_get_package_versions
type (string): The type of package (pypi, npm, maven, golang, nuget, huggingface, rubygems)name (string): The name of the package, as it appears in the package repository