Accelerate Vulnerability Fixes With Agentic Remediation

Agentic Remediation is a key pillar of JFrog’s Self-Healing Software Supply Chain, covering two capabilities: Smart Remediation with AutoPR and Copilot-assisted Code Fixes. What sets its fixes apart is the context behind them. Because JFrog is already the system of record for the artifacts your organization builds and ships through JFrog, the fixes it proposes are designed to account for the realities of your specific codebase (transitive dependencies, version constraints, how a package is actually used).

The Smart Remediation Engine is JFrog’s intelligence layer that analyzes vulnerability findings, identifies a recommended fix, and checks it before it reaches a developer. Its recommendations draw on artifact context: because JFrog already governs the artifact being fixed, the engine is designed to check compatibility and downstream impact before it suggests a change.

AutoPR is a JFrog capability that automatically pushes a verified code fix directly into a pull request, so a developer only needs to review and approve the change rather than triage and patch it manually. It can trigger two ways — automatically when a policy is violated, or on demand with a single click — so security teams can enforce it as a standing policy while individual developers can still invoke it ad hoc on a finding they’re already looking at. AutoPR is designed to propose the smallest  change needed to resolve the issue, which is a deliberate choice: smaller diffs are generally faster to review andless likely to introduce a regression than a broad, speculative rewrite.

Copilot-assisted Code Fixes brings JFrog SAST, AI Security, and Curation findings directly into GitHub Copilot through JFrog’s MCP servers — which use the Model Context Protocol to let an AI assistant like Copilot call out to external tools and data sources mid-conversation, rather than relying only on what it can infer from the code it can see. In practice, that means a developer can ask Copilot to fix a vulnerability and get a context-aware fix suggestion. Unlike AutoPR, there’s no pull request involved: the fix is proposed inline, for the developer to review before applying it.

No, and that’s by design rather than a limitation. First-party code changes can touch business logic in ways a third-party package upgrade doesn’t, so JFrog keeps a developer in the loop specifically for this path. AutoPR and Copilot-assisted Code Fixes are designed so a developer reviews and approves each fix before it is applied. Teams that want  third-party packages replaced with no human step can pair Agentic Remediation with Zero-Touch Remediation, which is built for that: automatic replacement of vulnerable third-party packages, governed by policy.

Agentic Remediation is for when the fix touches first-party source code and deserves a judgment call. Zero-Touch Remediation is for replacing vulnerable third-party packages and need to move at the pace of frontier AI–driven threats, where waiting on a review cycle is the bigger risk. Agentic Remediation keeps a developer in the loop to review and approve fixes, while Zero-Touch Remediation is fully automatic and requires no developer action. Both run on the same Smart Remediation Engine and fall under a single, unified pricing plan — you don’t pay separately to get access to each one.

Yes, Agentic Remediation works with GitHub Copilot. It connects to GitHub Copilot through JFrog’s MCP servers so a developer can ask Copilot to fix a JFrog-detected vulnerability without switching tools. AutoPR, the other capability of Agentic Remediation, doesn’t require Copilot at all; it operates at the pull-request level in supported SCM, so it keeps working regardless of which IDE or AI assistant any given developer prefers. Between the two, many teams end up using whichever one matches where the finding was noticed: Copilot if a developer is already in their editor, AutoPR if the policy engine catches it first.

A self-healing software supply chain automatically helps prevent, detect, prioritize, and remediate vulnerabilities on one continuously running platform. It governs all four of those steps so that actions are designed to be auditable and policy-driven rather than ad hoc. Agentic Remediation is a remediation layer within that system: the part that takes a finding JFrog has already detected and already prioritized, and turns it into a fix a developer can act on, instead of yet another ticket sitting in a growing backlog.

Copilot-assisted Code Fixes sends JFrog SAST, AI Security, and Curation findings into GitHub Copilot through JFrog MCP servers, where the Smart Remediation Engine validates the fix first. GitHub Copilot Autofix writes suggestions based on CodeQL alerts. Both can appear in the same IDE, but they use different security findings and validation checks.