Configure AI Scanner with Your Own LLM Credentials

AI Scanner uses a JFrog-managed model provided by Azure OpenAI. You can view your current AI Scanner usage in your MyJFrog Dashboard. This usage reflects scans performed with the JFrog-managed model. You can instead use a supported LLM provider with your own credentials. AI Scanner then sends model requests using your provider account, while JFrog continues to manage the scanning logic, analysis, verdict, and governance flow. Provider usage and charges are managed through your provider account.

Using your own credentials is supported in both SaaS and Self-Managed environments. It is optional in SaaS and required in Self-Managed. See What Applies to Your Environment.

In this topic:

• What Applies to Your Environment
• Before You Begin
• Configure AI Scanner
  • Provider Content Filters and Guardrails
  • Supported Providers and Models
  • Set Up Google Vertex AI
• Manage Your Configuration
  • Edit the Configuration
  • Remove the Configuration
• Scan Results

What Applies to Your Environment

Your own credentials work differently in SaaS and Self-Managed environments.

Before You Begin

Make sure that:

• JFrog AI Catalog is enabled for your environment.
• The AI Scanner Bring Your Own LLM Key Preview is enabled for the subscription.
• The JFrog AI Addendum is accepted.
• You are a Platform Administrator.
• Xray version:
  • For SaaS: 3.157.2 or higher.
  • Self-Managed: Not yet supported.
• You have valid credentials for a supported provider and access to the selected model.
• Your AI provider's content filters and guardrails don't block requests from AI Scanner. See Provider Content Filters and Guardrails.

Configure AI Scanner

Set AI Scanner to use a supported model and your provider credentials.

To configure AI Scanner with your own provider credentials:

1. In the JFrog Platform, go to Administration.
2. Select AI/ML > AI configuration.
3. Under AI asset scanner, select a supported model.
4. Enter the required credentials and provider-specific configuration.
5. Click Save changes.

When you save, AI Scanner sends one minimal request to the selected model with your credentials. It confirms that the credentials are valid and that your account can access the model. If validation fails, the configuration isn’t saved and the error explains why.

The selected configuration is used for new scans. Existing scan results are not affected. Credentials are stored encrypted and are never shown again after you save.

Provider Content Filters and Guardrails

AI Scanner analyzes assets for malicious and suspicious content, so its requests can include material that provider content filters and guardrails flag. When a filter blocks a request, the asset isn't scanned, its scan shows as failed, and the reason is recorded in the Xray logs.

If your provider account or project applies content filters or guardrails, configure them to allow requests from AI Scanner before you save your configuration. If you can, use a dedicated project or API key for AI Scanner so that filtering stays in place for your other applications.

Supported Providers and Models

During the Preview, AI Scanner supports a predefined list of JFrog-qualified provider and model combinations.

JFrog manages the model list and runtime configuration to ensure each supported configuration has been validated for AI Scanner.

Set Up Google Vertex AI

1. Enable the Vertex AI API on your Google Cloud project.
2. Grant the service account the Vertex AI User role.
3. Create a service account key by following Create and delete service account keys.
4. In AI/ML > AI configuration > AI asset scanner, paste the entire contents of the JSON key file. The project is taken from the key, so you don’t enter it separately.

Gemini 3.1 Pro preview is available only in the global location, so requests aren’t pinned to a specific region.

Manage Your Configuration

Edit the Configuration

Update the selected model or the provider credentials for the active AI Scanner configuration.

To update the active AI Scanner configuration:

1. Go to Administration > AI/ML > AI configuration.
2. Under AI asset scanner, click Edit.
3. You can:

   1. Select a different model/update the provider credentials.

      OR

   2. Click Reset to return to the saved values.

4. Click Save changes.

The existing configuration remains active until the updated configuration passes validation and is saved.

Changes apply only to new scans.

Remove the Configuration

Remove the customer-managed provider configuration from AI Scanner.

To remove a customer-managed AI Scanner configuration:

1. Go to Administration > AI/ML > AI configuration.
2. Under AI asset scanner, click Delete.
3. Confirm the action.

What happens next depends on your environment:

• SaaS accounts with 200+ seats : AI Scanner returns to the JFrog-managed model.
• All other accounts: AI Scanner cannot run new scans until another valid provider configuration is added.

Existing scan results are not affected.

Scan Results

AI Scanner analyzes AI assets and produces security findings and a verdict.

AI Scanner results integrate with JFrog Xray and can be used in customer-defined governance and policy flows.

Depending on the configured policy, AI Scanner results can lead to enforcement actions, including blocking. For more information, see Govern the Skills Registry.

Frequently Asked Questions

These questions cover when your own credentials are required, what is checked when you save, and what happens when you change the configuration.

Related Topics

• JFrog AI Catalog Overview