Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 11
- 4 5
- 3 1
- 2 0
- 1 0
Trust in production
- Trust it - 76%
- With caveats - 24%
- Wouldn't - 0%
94% would recommend this server
How reviewers scored it
- Setup & docs 4.4
- Auth experience 4.4
- Reliability 4.4
- Maintainer responsiveness 4.5
Why it got an A
This listing grades the current JFrog MCP Server that runs inside your own JFrog Platform and is reached at your platform URL plus /mcp, not the deprecated open-source jfrog/mcp-jfrog. Its code is not public (the linked repo is the official Claude plugin that wires it up), so this is assessed from JFrog's docs. The plugin README describes OAuth sign-in with no API keys, and the docs say tool access follows your JFrog Platform permissions. It covers repositories, builds, access tokens, security data, curation and release bundles, and has write tools such as updating a repository, creating or revoking a token and promoting a release version; the docs list no confirmation step, so rely on your client's approval prompts. No advisories are published. Biggest deduction: the server is closed source and still labelled beta in the docs, so we scored maintenance one band lower.
How to connect
Claude Code: install the jfrog plugin from github.com/jfrog/claude-plugin, run /jfrog-init (OAuth). It attaches ${JFROG_URL}/mcpIs JFrog MCP Server safe?
Is JFrog MCP Server safe to use?
JFrog MCP Server grades A (strong public trust signals). Upkeep is hard to verify (closed source or a single maintainer), so pin the version you tested.
Does JFrog MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does JFrog MCP Server support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Developer Tools
- A Amplitude MCP ServerAmplitude's hosted MCP server for product analytics - search and query events, charts, dashboards, experiments, feature flags, cohorts and session replay, with OAuth sign-in and a separate EU endpoint.
- A Appwrite MCP ServerOfficial Appwrite server that exposes databases, users, functions, teams and storage as tools, hosted with OAuth or run locally with a project API key.
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Better Stack MCP ServerOfficial hosted Better Stack server to read and manage incidents, monitors, status pages and on-call, and run SQL over your logs, spans and metrics, with OAuth or an API token.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
Embed this badge
[](https://trustedmcp.io/servers/jfrog-mcp)<a href="https://trustedmcp.io/servers/jfrog-mcp"><img src="https://trustedmcp.io/badge/jfrog-mcp.svg" alt="TrustedMCP grade A" height="80"></a>Community reviews
Solid and well behaved
Of the JFrog integrations I tried, this one is the most predictable. Nothing to install, I just point the client at the URL. Scoped the token to just what the agent needs and it respected that.
Used for Keeping project tickets in sync with code changes
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 5/5
No complaints after a month
Simple to set up in Cursor, simple to reason about. Releases come often and the changelog is clear. Hosted endpoint means no local process to babysit. Nice to use something maintained by JFrog rather than a random fork.
Used for Letting a coding agent open and triage issues
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Better than the DIY script it replaced
Of the JFrog integrations I tried, this one is the most predictable. Sign-in flow was painless and I never had to paste a key into a config file. Gave it its own API key so I can revoke it without breaking anything else. Easy recommendation.
Used for Generating boilerplate from existing patterns
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Earned a permanent spot in my config
Started with it as an experiment, now it is a fixture. I would prefer to read the code, but the hosted service has been dependable. Auth is handled properly, and revoking access later was one click. Would recommend without hesitation.
Used for Keeping project tickets in sync with code changes
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Easy win for our agent setup
Been running this for about a month now. Updates land regularly, and nothing broke when I upgraded. Sign-in flow was painless and I never had to paste a key into a config file. Token setup is the fiddliest part, after that it is smooth. Good choice if you need JFrog in your agent.
Used for CI failure investigation
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Surprisingly polished
Clear tool names, sensible outputs, very few surprises. Being official from JFrog counts for a lot when I pitch it to security. Good choice if you need JFrog in your agent.
Used for Pairing with Claude Code on a monorepo
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
The JFrog integration I wanted
Simple to set up in Cursor, simple to reason about. The OAuth flow worked first time in Claude Code. I like that access goes through a proper sign-in instead of a long-lived secret on disk.
Used for Letting a coding agent open and triage issues
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Good defaults, good docs
I use this almost daily. Updates land regularly, and nothing broke when I upgraded. Auth is handled properly, and revoking access later was one click. Used a fine-grained token with short expiry and it works fine with that. Happy to run it in production.
Used for Automating release notes
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Trustworthy enough for real work
Installed it on a Friday, it was part of my workflow by Monday. Scoped the token to just what the agent needs and it respected that. The API key sits in the config file, so I made a dedicated key with minimal permissions.
Used for Internal developer assistant
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Does what it says, no drama
Our agents call this dozens of times a day. Scoped the token to just what the agent needs and it respected that.
Used for Scripting routine maintenance tasks
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Exactly what I needed from JFrog
Hooked JFrog MCP Server into Claude Code and it worked on the first try. Filed an issue and got a reply within two days. It is in our production agent and I sleep fine.
Used for CI failure investigation
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Promising, a bit raw
Good for experimenting, still deciding about production. You can tell it is actively maintained, the rough edges keep getting fixed.
Used for Code review summaries for pull requests
- Setup & docs 3/5
- Auth experience 5/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Saves me a context switch every hour
Replaced a homegrown script with JFrog MCP Server and have not looked back. Auth is handled properly, and revoking access later was one click. Releases come often and the changelog is clear. Worth it, just do not skip the hardening steps.
Used for Code review summaries for pull requests
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Set it up once, forgot about it
Tried it on a side project first, then rolled it out at work. Token setup is the fiddliest part, after that it is smooth. Sign-in flow was painless and I never had to paste a key into a config file.
Used for Looking up JFrog data without leaving the editor
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Recommended it to two teams already
Set this up for our team after comparing a few options. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Nice to use something maintained by JFrog rather than a random fork. Nothing to install, I just point the client at the URL. Happy to run it in production.
Used for Scripting routine maintenance tasks
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Clean integration, sensible permissions
Set this up for our team after comparing a few options. Auth is handled properly, and revoking access later was one click. Would recommend without hesitation.
Used for Onboarding new devs with an agent that answers repo questions
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Worth the five minutes to set up
Been running this for about a month now. You can tell it is actively maintained, the rough edges keep getting fixed. Easy recommendation.
Used for Debugging sessions in Cursor
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.