Overview

The JFrog MCP Server implements the Model Context Protocol (MCP) adapter for the JFrog Platform API. It exposes a set of RPC-style tools that let development and CI/CD systems query and manipulate Artifactory repositories, inspect builds, and gather runtime and security metadata. The MCP server is intended to provide a unified, API-driven way for AI agents, automation runners, and platform integrations to obtain repository and build context across the software delivery lifecycle.

This project is experimental and useful as a reference implementation for integrating MCP-capable clients with JFrog services. It demonstrates repository creation and management, Artifactory AQL queries, build lookup, runtime inventory, and basic Xray scan summaries. For production usage, JFrog also provides a managed MCP service that offers hardened hosting and support—consider that for mission-critical deployments.

Features

Repository lifecycle operations: create local, remote, and virtual repositories
AQL execution: run Artifactory Query Language queries to find artifacts and builds
Build tracking: list builds and fetch build details by name
Runtime inventory: enumerate clusters and running container images
Package cataloging: retrieve package metadata, versions, and curation status
Vulnerability summary: access Xray scan summaries and group severities per artifact
Platform discovery: list JFrog Platform instances and basic health checks

Installation / Configuration

Prerequisites: Node.js (>=16) and npm/yarn.

Quick start (clone, configure, run):

git clone https://github.com/jfrog/mcp-jfrog.git
cd mcp-jfrog
# install dependencies
npm install

# Create environment file .env
cat > .env <<EOL
MCP_PORT=3000
JFROG_BASE_URL=https://your-jfrog.example.com
JFROG_API_KEY=your_api_key_here
# or use JFROG_USERNAME/JFROG_PASSWORD if preferred
# JFROG_USERNAME=admin
# JFROG_PASSWORD=secret
EOL

# start server
npm start

Configuration options (examples):

MCP_PORT — TCP port the MCP server listens on (default: 3000)
JFROG_BASE_URL — base URL of your JFrog Platform (Artifactory/Mission Control/Xray)
JFROG_API_KEY — API key or access token for authenticating API calls
JFROG_USERNAME / JFROG_PASSWORD — fallback basic auth credentials

When running in CI or containers, set environment variables via your orchestrator/secret store.

Available Tools / Resources

The server exposes multiple MCP tools. Below is a condensed reference.

Tool	Purpose	Key inputs	Returns
check_jfrog_availability	Simple health/readiness check	none	platform readiness status
create_local_repository	Create a local Artifactory repo	key, packageType, description, projectKey	created repo details
create_remote_repository	Create a remote proxy repo	key, packageType, url, credentials, many options	created repo details
create_virtual_repository	Create a virtual aggregated repo	key, packageType, repositories[]	created repo details
list_repositories	List repositories with filters	type, packageType, project	list of repo metadata
set_folder_property	Apply properties to a folder (optional recursive)	folderPath, properties, recursive	operation result
execute_aql_query	Run AQL queries against Artifactory	query (AQL string), domain, limit, offset	query results
list_jfrog_builds	List all builds	none	builds list
get_specific_build	Fetch build details by name	buildName, project?	build details

Example: create_local_repository payload (JSON):

{
  "tool": "create_local_repository",
  "inputs": {
    "key": "my-local-npm",
    "rclass": "local",
    "packageType": "npm",
    "description": "NPM packages for project X",
    "projectKey": "PROJX"
  }
}

Example: execute AQL query call (JSON):

{
  "tool": "execute_aql_query",
  "inputs": {
    "query": "items.find({\"repo\":\"my-repo\",\"name\":{\"$match\":\"*.jar\"}}).include(\"repo\",\"path\",\"name\",\"size\")",
    "limit": 100
  }
}

Depending on your MCP client, these tool calls will be issued over the MCP wire protocol (typically JSON-RPC style). The repository contains the server-side handlers that map tool inputs to JFrog Platform REST calls.

Use Cases

CI/CD promotion workflows: After a successful pipeline, an automation agent calls create_virtual_repository to compose release views and uses execute_aql_query to validate artifacts included in the release.
Build provenance and auditing: Use list_jfrog_builds and get_specific_build to link deployed artifacts to build metadata for traceability and compliance.
Automated curation and vulnerability triage: Run execute_aql_query to find artifacts, then query Xray summaries to prioritize remediation based on severity groupings.
Multi-repo aggregation: Create virtual repositories that combine internal and proxied remote registries to present a unified package source to developers and builds.
Agent-based context for LLMs: Provide concise repository and build context to model-driven tools that automate release notes, change impact analysis, or remediation suggestions.

Notes & Next Steps

This project is experimental; review security and hardening before exposing it to production networks.
For production needs, evaluate JFrog’s managed MCP server offering for a supported, hosted option.
Consult the repository for code examples and the server’s tool implementations to extend or adapt handlers for additional JFrog APIs.

JFrog MCP Server for Repository & Build Tracking