Extending the Single Source of Truth to the Agentic Software Supply Chain

Every developer on your team now runs multiple agents. None of them are waiting for human sign-off to act.

That’s exactly the gap we discussed and closed at swampUP 2026. JFrog unveiled new capabilities that extend the JFrog Platform as not only the Single Source of Truth for OSS and heritage software, but now the Agentic Software Supply Chain. Here’s everything we announced, and why it matters.

Single Source of Truth: The Foundation for Trust

Trust used to be simple. When only human developers built your software, your supply chain infrastructure gave you a single source of truth. Every build was trusted; you knew who touched it, what was inside it, whether it was secure and compliant. Developers relied on that infrastructure, but also made decisions instinctively on tribal knowledge, filling gaps with a quick call or hallway chat.

Then agents started shipping code too, and agents don’t work that way. They don’t have tribal knowledge (even if they do create their own message boards), gut instinct, or hallway context. They operate ungoverned and unverified, at a speed you can’t track and at a speed that is even harder to audit; trust is not something they intrinsically care about. In fact, Gartner predicts 40% of enterprise apps will feature task-specific AI agents by 2026.

So now, you can’t answer the basics anymore. What’s the SBOM and AIBOM for this release? Are the components secure? Which agents touched it last?

When more than half your workforce and half your supply chain can’t be trusted, none of it can.

JFrog gives you that trust back. As your universal System of Record, JFrog already verifies every asset and artifact in your software supply chain before it builds, ships, or runs. Now, that same verification and trust extends to your agentic supply chain — one authoritative system covering every OSS artifact, legacy asset, and AI asset. This is The Single Source of Truth for the Agentic Software Supply Chain.

The 3 Trust Questions Every Leader Needs Answered

AI and the agentic workforce essentially made everyone ask: “Can we trust what we ship?” and “Can we trust our speed?” In turn, this created three board-level imperatives every CISO, CIO, and CTO is now grappling with. The new capabilities JFrog introduced at swampUP 2026 map directly to these pains and help leaders and developers alike answer these core questions with confidence:

1. Protect — How do I build a trusted agentic workforce? 
2. Remediate — How can I secure and remediate at speed? 
3. Control — How can I govern releases automatically? 

Protect: Trust What Agents Consume and How They Ship

Your agents pull from everywhere: models, MCP servers, skills, plugins, straight off the open internet, and ship just as fast: writing code, resolving dependencies, producing binaries. Often, nobody signs off, and yes, the “system” is watching, but changes are often happening at such a speed and scale that no human could keep up. When something breaks, there’s no name on the commit and agents don’t exactly leave a clean audit trail.

When trying to solve the problem, most people get this wrong: they bolt a guardrail onto an agent’s reasoning, or a security tool is added into the process to provide an extra “gate”. Each covers a slice of the pipeline and problem, but leaves the rest of the pipeline open. What you need is the same System of Record that governs your human developers, extended to your agentic workforce and enforced at two control points: what agents consume, and how they build and ship. Call it AgentSecOps: immunizing and controlling agent actions and behavior, with every step policy-enforced by a single source of truth, from pull to ship.

Immunize what agents consume

Agents consume models, MCP servers, skills, and plugins, each representing a new attack vector. Each pull represents new code, new permissions and a new threat to your environment. With humans, we called it shadow IT, and now it’s happening on an even broader scale with agents as shadow AI. JFrog closes this gap with agent immunization: governed registries, ingestion scanning, and shadow AI detection, blocking risk before it reaches the agent.

• JFrog AI Catalog (existing) — Secures and governs AI asset usage across the organization, now including skills, plugins, and Agent Packages (APM).
• APM Repository (NEW) — Keeps agent package installs limited to a trusted, governed source instead of the open internet (apm install).
• Plugins Registry (NEW) — Provides a scanned, auditable, and governed source for first- and third-party coding agent plugins, replacing default public marketplaces.
• Skills Scanning (NEW) — Detects malicious behavior in skill files using semantic security scanning, and blocks bad skills from ever reaching a developer’s machine.

Control how agents build and deploy

Agents are relentlessly goal-oriented and will route around your system of record to finish the task. This means, policy must be enforced where they actually operate, in a way they can’t bypass. JFrog introduces multiple layers of trust that allows agents to stay inside policy without losing speed in your pipeline and delivery.

• JFrog Agent Plugin (NEW Integrations) — Brings your standards to agent workflows by natively connecting Claude, Cursor, Codex, CoPilot, Kiro, etc. to the JFrog Platform.
• Agent Guard (AI Asset Enforcement) (NEW) — Ensures only AI assets approved in AI Catalog are consumed by agents across coding environments.
• Agent Package Resolution (NEW) — Provides a trusted path for agents to resolve dependencies through the JFrog Platform, where security policy is applied.
• Traffic Controller (NEW Integrations) — Extends enforcement to the network layer via Netskope, Cloudflare, and Zscaler where public-repo requests are redirected to JFrog.
• Agentic Remediation (existing) — Flags insecure code in-IDE and delivers a fix conversationally, inline, through the agent’s MCP connection.

The logic underneath them all: every agent needs a verifiable identity and only the access its task requires, not a standing credential that outlives the job.

Remediate: Ensure a Self-Healing Software Supply Chain

Remediation SLAs are trending toward zero.

Frontier AI models changed the math: attackers now wield the same tools your developers do, chaining together vulnerabilities once too low-severity to bother with, generating exploits at machine speed. Sometimes the exploit lands before the CVE is published. By the time your team finishes triaging, the window has closed.

The only way forward is a supply chain that fixes itself, automatically and continuously. That’s a self-healing software supply chain: it prevents, detects, prioritizes, and remediates risk across the lifecycle without waiting on a human to open a ticket.

However, self-healing only works if the platform can see and control every artifact at the binary level; you can’t fix what you can’t see. JFrog Artifactory sits in the path of every package, build, and promoted binary, so it finds the best fix and applies it automatically, by policy.

Self-healing maps to four pillars: Prevent, Detect, Prioritize, Remediate.

Prevent

Reactive security was never the goal, but it was a tradeoff we could afford when threats moved at human speed. That tradeoff doesn’t hold at agentic speed and complexity. This is why JFrog screens every artifact at the gate, before it reaches a developer or an agent.

Related JFrog Products: 

• Curation with Compliant Version Selection (existing) — Blocks risky packages, AI assets, and IDE extensions, and automatically serves a compliant version instead.
• Traffic Controller (existing) — Applies policy to every package request by rerouting traffic through JFrog using the SASE infrastructure you already run.
• AI Catalog (existing) — Governs the models, MCP servers, and skills your agents pull from, spanning first-party assets and third-party indexes like Hugging Face and NVIDIA NIM.

Detect

Frontier AI models don’t exploit vulnerabilities one at a time, stopping at one CVE; they reason across your entire supply chain at once, often chaining individually low-risk CVEs into a multi-stage attack path the same way advanced threat actors chain TTPs across the kill chain. This means detection in the AI era needs to see the full chain before the attacker does.

Related JFrog Products: 

• JFrog Xray (existing) — Finds the vulnerabilities, malicious packages, and license risks in your open source components through continuous, recursive binary scanning.
• JFrog Advanced Security (existing) — Flags vulnerabilities that are actually exploitable, layering contextual analysis, SAST, and secrets detection on top of Xray.

Prioritize

Detection without context is noise, and in the Frontier AI era, that noise has gotten out of control with CVE counts exploding. JFrog helps security teams cut through the noise, ranking risk by real exploitability so teams fix what matters first.

Related JFrog Products: 

• Contextual Analysis w/ Advanced Security (existing) — Cuts alert noise by up to 90%, evaluating findings for reachability and exploitability so teams act on confirmed exposure, not a CVSS score.
• Business Context with JFrog AppTrust (existing) — Automatically captures every SDLC action as signed, audit-ready evidence tied to the exact artifact.
• Runtime w/ Advanced Security (existing) — Shows which vulnerable components are actually running in production, not just present in the codebase.

Remediate (NEW)

When a critical CVE drops, most organizations can’t close the fix loop in under a week. JFrog closes it automatically, with zero-touch remediation that swaps vulnerable artifacts across the entire estate without breaking dependencies or builds.

Related JFrog Products:

• JFrog Zero-Touch Remediation (NEW) — Evaluates every available fix for a vulnerability already in a customer’s environment and selects the best one based on your policy, environment, and risk tolerance.
• AutoPR with Smart Remediation (NEW) — Automatically pushes verified, context-aware fix guidance directly to the pull request.
• Agentic Remediation (existing) — Fixes first-party code inline at the pull request level using full artifact lineage, reviewed and validated by a human before it merges.

And prove it

At agentic speed, manual audit trails break down. With JFrog, every fix is signed the moment it happens, and every artifact’s history is already there when the auditor or the board asks.

Too Integrated To Fail — How our partner ecosystem supports ‘Remediate’
JFrog draws on a broad ecosystem of patched providers: Echo, Red Hat, TuxCare, Moderne, Broadcom, Chainguard, and Seal Security, so Zero-Touch Remediation can swap in a patched artifact automatically, without slowing development or breaking builds.

 

Control: Governance Engineered In, Audit-Ready by Default

CISOs built governance on one assumption: every decision traces back to a person. Autonomous agents now plan, code, review, and deploy often with no human in the loop. When no person stands behind a decision, who do you hold accountable for it? The agent? Which agent? The Developer? AppSec? The answer is no longer as clear-cut.

Regulators are in the same frame of mind; they don’t care whether a human or agent made the call, they just want and need to know who’s accountable. CRA, NIST SSDF, FedRAMP, ECB, and SEC rules all demand proof you govern your software supply chain continuously. Overall penalties run 2-7% of global revenue, with personal fines of  €1M now falling on senior managers and CISOs directly.

The industry’s answer is DevGovOps: governance built into DevOps, the same way security got built in and became DevSecOps.

JFrog AppTrust is a way for you to implement the DevGovOps practice. It puts governance where artifacts already live, attaching context, lineage, and attestations the moment an artifact enters the pipeline. So you are always compliant and audit-ready by default.

Four stages turn continuous compliance from a goal into a process: Codify, Attest, Enforce, Monitor.

Codify: Turn intent into enforceable policy

Manual review can’t keep pace with agents that commit and deploy in minutes. Policy has to become code: written once, enforced automatically, no human in the critical path.

• AI-Powered Policy as Code Playground (NEW) — Turns plain-language intent into enforceable, tested, Rego-based policy, automatically versioned and enforced.
• Policy-as-Code (existing) — Makes every rule, control, and compliance requirement repeatable and auditable by living as version-controlled policy, not a document.
• Xray Scanning (existing) — Evaluates every artifact against policy at scan time, flagging violations before they can progress downstream.

Attest: Capture evidence automatically

Most organizations scramble to assemble evidence, and with agents acting autonomously, there’s often no record at all. JFrog captures it automatically, signed the moment it ships.

• Prompt to Release Traceability (NEW) — Captures the complete provenance trail for every agent interaction and artifact: sessions, tickets, PRs, approvals, promotions.
• Evidence Collection (existing) — Unifies third-party ecosystem evidence into an immutable system of record, eliminating manual audit assembly.
• Full Business Context (existing) — Gives all evidence a business owner, rolling artifacts up to business-aware application entities, ownership and criticality attached.
• Waiver Management (existing) — Accounts for every control bypass, recording justified exceptions as signed evidence, not an undocumented workaround.

Enforce: Make policy enforce itself

Compliance frameworks take months to configure, or depend on a human catching violations.  JFrog gives you a pre-built governance framework, enforced automatically.

• Out-of-the-Box Compliance Frameworks (NEW) — Makes it easy to enforce major regulatory standards on day one, with a policy-driven foundation, no custom config.
• Repo-Level Policies (NEW) — Enforce evidence-based governance directly on repositories, with no project, application, or lifecycle-stage setup required.
• SDLC Promotion Gates (existing) — Stops a non-compliant release before it can move to the next stage, by evaluating evidence at every gate across the lifecycle.

Monitor: Govern the full lifecycle, including post-production

Governance can’t stop at the release gate when vulnerabilities emerge continuously. JFrog keeps monitoring what’s running in production, so posture stays provable long after release.

• Post-Release Governance (NEW) — Extends compliance visibility beyond the release gate with continuous posture monitoring for every release in its support window.
• Risk & Delivery Insights (existing) — Shows where risk is concentrated and how fast it’s moving, with visibility into blast radius, deployment frequency, and release lead time.

Too Integrated To Fail — How our partner ecosystem supports ‘Control’
Without proven evidence and attestations, audits, evolving regulations, and supply chain risks create havoc. Attach evidence your way, and attest to anything you need. Evidence linkage with the JFrog CLI and REST APIs allows you to build GRC workflows without disrupting developer workflows. JFrog brings governance to where the artifact lives, supported by an evidence partner ecosystem of 13 partners and counting.

 

The Starting Point: A Universal System Of Record

Protection, remediation, and control all depend on one thing: a Single Source of Truth. The JFrog platform is the System of Record that delivers this source of truth. It governs, secures, and tracks every artifact, AI asset, package, container, and source as it moves through your supply chain. Every action, human or agent-driven, is captured the moment it happens as evidence that’s immutable, auditable, and trusted. Get this foundation right, and the rest follows.

But a System of Record must keep up with how fast AI-driven delivery moves. That’s why this swampUP we scaled the platform further with: Projects, the JFrog CLI, transfer performance, and full Platform Federation.

It’s the same bet JFrog made even before DevOps was a practice: universal by design, too integrated to fail, focused on the binary as the one constant across every tool, model, and framework. That bet is why the System of Record can scale with you, no matter how your supply chain changes.

See you at the next swampUP!

If you couldn’t make it to New York, JFrog is bringing the energy to Europe at swampUP Barcelona, October 20-22, 2026.

Ready to put the Single Source of Truth for the Agentic Software Supply Chain to work in your own organization? Schedule a demo for a one-on-one walkthrough, take an online tour of the JFrog Platform, or start a free trial.