mcp-jfrog

MCP.Pizza Chef: jfrog

Marked deprecated by JFrog themselves, this experiment gets no further fixes or security patches and has been replaced by the company's own hosted server, now the only supported route. Thirty-one working tools cover repositories, builds, running containers, projects, package details, known vulnerabilities and artifact searches. The release-bundle and linked-instance features named in its own description were written but never connected, so calling them simply fails. Access rules can be created, changed and deleted with no confirmation.

Coding

Data

Use This MCP server To

Find which build produced a particular package List the repositories in our package store Check a package version for known security problems See which container images are running right now Look up who has access to a given repository

README

⛔ DEPRECATED — JFrog MCP Server (Experimental)

Caution

🚨 THIS PROJECT IS DEPRECATED AND NO LONGER MAINTAINED 🚨

Do not use this repository for new or existing integrations.

This experimental MCP server has been superseded by the official JFrog MCP Server, which is built, maintained, and supported by JFrog. The official server is secure, remotely hosted, production-ready, and receives ongoing updates, bug fixes, and security patches.

👉 Use the official JFrog MCP Server instead:

https://jfrog.com/help/r/jfrog-integrations-documentation/jfrog-mcp-server

No further features, fixes, or security updates will be delivered to this repository. Any content below is preserved for historical reference only.

Model Context Protocol (MCP) Server for the JFrog Platform API, enabling repository management, build tracking, release lifecycle management, and more.

mcp-jfrog FAQ

Is this still maintained?

No. JFrog marked it deprecated and stopped work on it, including security fixes. They point everyone at their own official JFrog MCP Server, which is hosted, supported and the only route they back.

Do I need an account key?

Yes — a JFrog access token plus your company's JFrog address. That means you need an existing JFrog platform account, which is a paid product for most teams, so this is not something you can try on your own.

Can it change things, or only look?

It can change plenty. It creates repositories and projects, sets folder properties, and creates, edits and deletes the rules that decide who may access what — all without a confirmation step, and with no read-only mode to fall back on.

Do all the advertised features actually work?

No. Release bundles and listing linked platform instances are both described on the project page and both written in the code, but neither was ever hooked up, so those requests come back as unknown. Thirty-one of the tools do work.

Can I use this to check whether something we ship has a known vulnerability?

Yes. You can ask for a package version's known vulnerabilities, look up details of a specific one, and pull a security summary for a stored file.

Which apps does it work in?

Claude Desktop and Cursor are the documented ones, set up by pasting a settings block that supplies your address and token. A container image is offered too if you prefer that.

What happens if I get the token wrong?

It does not tell you. With no token the requests still go out, unsigned, so you see confusing permission errors rather than a clear message about the missing token.