JFrog

Record description

JFrog is a software supply-chain vendor. Its October 2026 AI Security expansion separates local workstation inventory of skills, plugins and MCP servers from semantic scanning through a customer-selected language-model endpoint. These are prevention and visibility features; their existence is not evidence that specific malicious skills are detected.

JFrog's October 21 product documentation distinguishes endpoint discovery from semantic content inspection. The workstation agent plugin inventories skills, MCP servers, plugins, hooks, commands and monitoring objects, performs deterministic checks locally, then reports asset identity and findings to the central platform. BYOK semantic scanning sends instructions directly from the JFrog Platform to a customer-selected model endpoint, without using JFrog's inference gateway. A cloud provider selected by the customer still receives the relevant data under that provider's terms. JFrog's published materials do not include an independently replicated sensitivity, specificity or real-world prevention denominator.

The vendor also describes agent-time policy enforcement under Agent Guard. Inventory, interpretation and enforcement are distinct security boundaries, so a report of a discovered artifact should not be confused with proof that malicious code or instructions were prevented from executing.

Explicitly related research (3)

Declared connections