The Evolution of JFrog AI Catalog: Your AI Control Plane for Agentic Development

In a single morning, a coding agent can pull an open-source model, connect to an unvetted MCP server, and execute a code-optimizing skill from the web. In the rush toward agentic automation, these AI assets quietly bypass traditional security reviews, creating new attack vectors across the software supply chain.

Closing this blind spot has been the driving force behind the JFrog AI Catalog since its launch at swampUP 2025. The goal is agent immunization: your agents consume only the AI assets you’ve approved.

What began as a secure model registry has matured into an AI control plane: the single layer where you decide which AI assets your agents can use, and enforce that decision everywhere. Today, JFrog secures, governs, and enforces policies across every AI asset your agents consume. It manages models, skills, plugins, and MCP servers as native artifacts, all within the same trusted system of record that powers your enterprise software supply chain.

The SDLC Became the ADLC. Now What?

In September 2025, the primary question for platform teams was where their models should live. Models were the AI supply chain: you picked one, scanned it, versioned it, served it, and recorded which builds it was used in and with which weights. We built exactly that: a centralized hub for secure and governed models from Hugging Face, NVIDIA NIM, external providers, and your own fine-tuned models.

The software development lifecycle has just undergone a significant change. Yesterday’s SDLC turned human-written code into a binary release. Today, enterprises operate in the Agentic Development Lifecycle (ADLC): a spec goes straight to an agent, and the agent generates the code that becomes the binary. That shift breaks the old security model. The controls you built for human-written code never accounted for an agent pulling its own parts at machine speed. So how do you keep the same governance over a lifecycle you no longer write by hand?

One agent, multiple supply chains you never vetted

You have to start by understanding the agent’s anatomy. An agent isn’t one thing you vet once. It’s assembled on the fly from components pulled from different open sources, and each drags its own supply chain into your environment:

• Models: Local, fine-tuned, or accessed via external APIs.
• MCP servers: Allowing agents to execute actions, either via APIs or as local packages.
• Skills and plugins: Packaged behaviors distributed as bundles of instructions, scripts, and supporting assets.
• Rules: The explicit guardrails defining what the agent is permitted to do.
• Hooks: Scripts that are automatically invoked at specific points in the agent’s execution flow to trigger external actions or validations.
• APM: Agent Package Manager, an open-source dependency manager designed specifically for AI agents, used as a fully configured setup.

Each part is a front door into your environment, and every one is pulled from an outside, often unvetted source at the agent’s discretion. That is the anatomy. The problem is that nothing on this list went through the review a normal software dependency would.

The Control Gap is Real, and Attackers Found it First

That lack of control over what AI assets an agent consumes is not a theoretical worry. Attackers are already walking through the gap, and the security teams meant to stop them are telling us they can’t see it.

The attacks are already here

These aren’t theoretical risks. Our security research team is pulling compromised AI assets out of the wild right now, and the same tricks keep working.

• Malicious MCP servers: A malicious package impersonating the Postmark email MCP bypassed casual review, executing quietly in the background to BCC every email the agent sent directly to a threat actor.
• Malicious Skills: In the omnicogg incident, a harmless skill masked a 22MB file designed to execute an encoded payload. It bypassed all 65 VirusTotal engines, racking up 5,000+ installs in 19 days before our researchers exposed it.
• Blast Radius: The broader AI ecosystem is being breached through these same doors. Recent 2026 supply chain attacks on LiteLLM, TanStack, and Mistral AI prove that AI dependencies are just as exposed as traditional binaries, only now autonomous agents widen the blast radius at machine speed.

Notice the pattern. Every one of these bypassed a scan. Signature-based scanning checks a file against a list of known-bad hashes, so a brand-new malicious skill, with no hash on that list yet, walks straight through. Catching these assets means reading what they tell an agent to do, not just matching them against threats we have already seen.

Security teams can’t see them coming

Across our conversations with security and platform leaders, the rapid shift to ADLC has exposed a real control gap:

1. A Missing Single Source of Truth: Security teams lack a centralized, trusted control plane to curate, vet, and safely distribute approved AI assets for developers and agents.
2. Zero Visibility: Platform engineers have zero visibility into the specific skills, plugins, and MCP servers that agents are dynamically consuming.
3. Obsolete Security Gates: Traditional signature-based security and static CI/CD pipeline controls were built for static binaries. They are fundamentally blind to these new executable assets.

Every AI Asset in a Single Source of Truth

To secure the ADLC, we had to build far beyond a model registry. Every executable AI asset needs a trusted source, for your agents and your developers alike. So we expanded the JFrog AI Catalog to govern and secure all of them. What you get is agent immunization: your agents consume only the AI assets you’ve approved.

It starts with a home. Each type of AI asset gets its own governed registry, stored in Artifactory as versioned, traceable artifacts, alongside the binaries you already trust:

• MCP Registry: Define exactly which MCP servers are allowed per project, restrict specific tool calls, and scan local MCP packages before an agent can use them.
• Agent Skills Registry: Curate the packaged behaviors agents run. Every skill must be signed, verified, and scanned before an agent is permitted to execute it.
• Agent Plugins Registry: Control the plugin bundles agents install. Each one is signed, verified, and scanned, so an agent only loads plugins that passed your checks.
• Agent Packages: Ship an agent’s entire context and dependency tree as a single, resolvable, and versioned package that complies fully with the open-source APM standard.

However, a registry is only as good as what you let into it, and what you can spot outside it:

• Semantic Scans: Our new semantic scan gate reads what an asset instructs an agent to do, not just whether its hash is on a known-bad list.
• Shadow AI Detection: Automatically detect and categorize every AI asset sprawling across your environment as managed, unmanaged, partially managed, or malicious.

Now every asset is vetted before it enters and visible once it’s there. But approving an asset isn’t the same as controlling what the agent does with it.

Agent guard enforces your policy at runtime, in any agent

The official JFrog agent plugins, built for coding agents such as Claude Code, Cursor, VS Code, OpenCode, and Codex, bring organizational policy control directly into the agent environment. Whenever an agent tries to install a skill, plugin, or MCP server, the plugin enforces your policy, so the agent only runs assets that have passed your security checks.

That’s where Agent Guard comes in. Installed through the same agent plugin, Agent Guard checks every MCP tool and skill call at runtime against your organization’s policies, no matter the agent harness or coding environment your developers adopt. The control you set at the source travels all the way to the point of use. Registry, scan gate, and runtime enforcement working as one layer: that is your AI control plane, the single place you set AI policy and enforce it everywhere.

No Parallel Supply Chain for AI. Govern It Where Your Artifacts Already Live.

Plenty of vendors now sell AI governance or AI security. Almost all of these point solutions run parallel to your software supply chain: separate registry, separate gateway, separate policy engine, separate audit trail. Two or more systems to operate, reconciled manually every time compliance asks a question.

The JFrog AI Catalog governs models, MCP servers, skills, plugins, and agent packages as first-class artifacts, right alongside your binaries. One RBAC model. One audit trail. Any source in, any coding agent out: Cursor, Claude Code, GitHub Copilot, OpenAI Codex, or something your team built.

That is what an AI control plane delivers, and what agent immunization looks like in practice: every asset vetted at the entry point, so your agents consume only what you’ve approved. Only a system of record that already holds every artifact can be that control plane, governing every AI asset without a parallel supply chain beside the one you trust.

See it in your own environment. Book a demo with a JFrog solution engineer or explore the JFrog principles for building a trusted agentic workforce.