Get Started with the Plugins Registry

The JFrog Plugins Registry is a centralized hub in the AI Catalog where your organization scans, publishes, discovers, and installs plugin bundles — versioned ZIPs that package skills, MCP servers, hooks, sub-agents, and commands together. This is separate from installing the official JFrog Plugin that connects your harness to the JFrog Platform; you need that installed first before using this registry. Agent Plugins are stored in Artifactory Agent Plugins repositories (SaaS 7.156+) and surfaced through the AI Catalog and a project-scoped JFrog marketplace.

Each project gets its own named marketplace — JFrog-<project-name> — so governance is applied at the project boundary. Developers register the marketplace for the project they are working in, and discover only the plugins their project allows, natively, inside their coding agent.

The Plugins Registry gives your team:

• A single place to discover plugins your organization has published
• Governed, versioned plugin files in Artifactory with Xray scanning applied
• Project-scoped publish and discovery through your coding agent (no repository path to manage)
• For Claude Code and Codex, a native project marketplace (JFrog-<project-name>) that shows only the plugins your project allows

All of this can be handled using the ai-catalog skill in your harness. The skill wraps jf agent plugins CLI, which validates structure, packages the ZIP, resolves your project and repository, publishes it, and reports back the plugin name, version, and repository. See JFrog CLI for Agent Plugins.

How does it work? Publish your plugin → the AI Catalog auto-registers it and scans it → your team discovers and installs it through the agent skill or native marketplace.

AI Addendum

AI-based plugin scanning requires your organization's AI Addendum to be signed. If it is not signed, plugins are registered in the Registry but Xray scanning does not run, and scan status shows as Unscanned.

To sign the AI Addendum:

1. Navigate to My JFrog → Settings → AI.
2. Select Enable AI.

An alert appears at the top of the AI Catalog Coding Assistants page if the Addendum is not yet signed for your organization.

Prerequisites

• A coding agent configured for your project (Claude Code, Cursor, Codex, or VS Code).
• The JFrog plugin installed so your agent can use AI Catalog skills. See JFrog Plugins.
• JFrog CLI v2.121.0 or later, configured for your JFrog Platform. See Configure the JFrog CLI.
• Artifactory SaaS 7.156 or later with the Agent Plugins package type available.
• Xray 3.152 or later, with the Agent Plugins repository indexed.

This topic covers the following tasks:

First Time Using the Plugins Registry?

Confirm connectivity and publish your first plugin using these steps:

1. Check your AI Addendum status: Confirm the AI Addendum is signed for your organization (see AI Addendum). Scanning does not run until it is signed.

2. Verify connectivity: Ask your agent, "What project are you configured for?" to ensure you are connected.

3. Set up the project marketplace (Claude Code only):

   • Option 1 — Use /jfrog-init (recommended): Run /jfrog-init in your agent. The skill connects Claude Code to Artifactory, registers the JFrog-<project-name> marketplace, and configures authentication — all in one step. See JFrog Init Skill.

   • Option 2 — Manual setup:

     1. Add Artifactory credentials to ~/.netrc:

        Text

        machine <HOST>
        login <USER>
        password <TOKEN>

     2. Register your project marketplace. From your terminal:

        Shell

        claude plugin marketplace add https://ai-catalog:<password>@<HOST>/ml/core/api/v1/ai-registry/agent-plugins/projects/<project-name>/marketplace/claude-marketplace.json

        Or in Claude Code: select /Plugins → Marketplaces → Add marketplace and paste the URL above.

        The marketplace is named JFrog-<project-name> and contains only the plugins allowed for that project. To work across multiple projects, register one marketplace per project.

     For the Artifactory-native path, see Connect Claude Code to Artifactory.

4. Publish your plugin: Follow the Publish a Plugin instructions.

5. Install the plugin: Follow the Install a Plugin path for your harness.

That's the entire workflow. Everything past this point is a reference for each step, including what to do when your agent can't confirm project access (see Plugins Registry Troubleshooting).

Publish a Plugin

Once your plugin is ready, ask your agent to publish it. The ai-catalog skill automatically resolves your active project and target Agent Plugins repository, with Xray scanning applied on upload.

To publish a plugin:

1. Prepare a plugin bundle with a harness manifest directory (.claude-plugin/, .cursor-plugin/, .codex-plugin/, or .vscode-plugin/) containing a valid plugin.json:

   JSON

   {
     "name": "my-plugin",
     "version": "1.0.0",
     "description": "Brief summary of what the plugin does"
   }

   For the full folder layout, see Plugin Structure and Layout.

2. Ask your agent to publish it: "Publish the plugin in /path/to/my-plugin."

   Your agent confirms the plugin has been published and reports the plugin name, version, and repository.

To publish using the JFrog CLI: See Publish Agent Plugins and JFrog CLI for Agent Plugins.

Once published, the plugin registers in the Plugins Registry immediately. Xray scans it automatically; scan status appears in the Registry within a few minutes.

Publish with Evidence Signing

With Enterprise+, you can attach a cryptographic attestation when you publish a plugin. See Publish Plugins with Evidence Signing.

Discover Plugins

Discovery shows plugins published for your active project. Developers working across multiple projects register one JFrog-<project-name> marketplace per project and switch between them as needed.

To discover plugins using your agent:

Ask your agent: "What plugins are available in our project?" The ai-catalog skill returns name, version, description, and status for each Allowed plugin.

To discover plugins using the JFrog Platform:

Navigate to AI/ML > AI Catalog > Registry > Plugins. The Registry view shows plugin cards with name, version, security status, description, and files.

To discover plugins in Claude Code:

After the JFrog-<project-name> marketplace is registered, type /plugins in Claude Code to open the Discover tab. It shows only the plugins allowed for your project.

To discover plugins using the JFrog CLI:

jf agent plugins list

See JFrog CLI for Agent Plugins.

Inspect a Plugin

To inspect a plugin in the JFrog AI Catalog:

Select a plugin card in AI/ML > AI Catalog > Registry > Plugins to open the plugin details pane. It shows name, version, dates, scan status, description, README, and harness support indicators (Claude Code, Cursor, Codex, VS Code).

Install a Plugin

Install a plugin after you've confirmed it is Allowed. The install path depends on your coding agent.

Install a Plugin from the JFrog Platform

To install a plugin from the JFrog Platform:

1. Navigate to AI/ML > Registry > Plugins.
2. Select the plugin you want to install and the project for which you are installing it.
3. In the plugin details pane, click Install. The Install JFrog plugin panel appears.
4. Select your coding assistant, then follow the instructions:
   • For first-time setup, use the First-time setup tab.
   • If already set up, use the Add plugin tab.

Install a Plugin Using Your Agent

Ask your agent: "Install the my-plugin plugin" or "Install version 2.1.0 of security-scanner." The ai-catalog skill verifies the plugin is Allowed, routes to the correct harness install path, and confirms.

If you use Claude Code and the JFrog-<project-name> marketplace is not registered yet, the skill prompts you to run /jfrog-init to complete setup first.

Install a Plugin in Claude Code

To install in Claude Code (native marketplace):

1. Confirm the JFrog-<project-name> marketplace is registered (run /jfrog-init or follow Connect Claude Code to Artifactory).

2. Browse /plugins → Discover, or install directly:

   Shell

   claude plugin install <plugin-name>--<repo-name>@JFrog-<project-name>

   For example:

   Shell

   claude plugin install security-scanner--aidemo-plugins-local@JFrog-aidemo

   Use the Discover tab or ask your agent to list plugins for the exact install name.

To install using the JFrog CLI:

jf agent plugins install <PLUGIN_NAME> --harness <HARNESS_NAME> [--repo <REPOSITORY_NAME>] [--version <PLUGIN_VERSION>]

For example:

jf agent plugins install my-plugin --harness cursor

See Install Agent Plugins and JFrog CLI for Agent Plugins.

Install a Plugin in Cursor

To install a plugin in Cursor:

Ask your agent: "Install the my-plugin plugin." Or use the JFrog CLI:

jf agent plugins install <PLUGIN_NAME> --harness cursor [--repo <REPOSITORY_NAME>] [--version <PLUGIN_VERSION>]

For example:

jf agent plugins install my-plugin --harness cursor

See Install Agent Plugins and JFrog CLI for Agent Plugins.

Install a Plugin in VS Code

To install a plugin in VS Code:

Ask your agent: "Install the my-plugin plugin." Or use the JFrog CLI:

jf agent plugins install <PLUGIN_NAME> --harness vscode [--repo <REPOSITORY_NAME>] [--version <PLUGIN_VERSION>]

For example:

jf agent plugins install my-plugin --harness vscode

See Install Agent Plugins and JFrog CLI for Agent Plugins.

Once installed, your harness loads the plugin's bundled skills, MCP configuration, hooks, agents, and commands according to that harness's plugin model.

Enforce JFrog Plugin Marketplaces

This section is for JFrog administrators. It covers locking down marketplace sources so developers can only install plugins from approved JFrog project marketplaces.

Lock Down Marketplace Sources

To prevent developers from registering unauthorized plugin marketplaces, push a managed configuration for each supported harness. This restricts the coding agent to JFrog project marketplaces only.

Claude Code — managed-settings.json

Deploy via MDM or Claude Code's managed settings mechanism. Requires Claude Code v2.1.193 or later.

{
  "allowedMcpServers": [
    {
      "serverCommand": [
        "npx",
        "--yes",
        "--registry",
        "https://releases.jfrog.io/artifactory/api/npm/coding-agents-npm/",
        "@jfrog/agent-guard"
      ]
    },
    {
      "serverCommand": [
        "npx",
        "--yes",
        "--registry",
        "https://releases.jfrog.io/artifactory/api/npm/coding-agents-npm/",
        "@jfrog/agent-guard",
        "--source",
        "plugin"
      ]
    }
  ],
  "strictKnownMarketplaces": [
    { "source": "hostPattern", "hostPattern": "^<JPD HOSTNAME REGEX HERE>$" },
    {
      "source": "settings",
      "name": "jfrog-plugin",
      "plugins": [
        {
          "name": "jfrog",
          "source": { "source": "github", "repo": "jfrog/claude-plugin" }
        }
      ]
    }
  ],
  "extraKnownMarketplaces": {
    "jfrog-plugin": {
      "source": {
        "source": "settings",
        "name": "jfrog-plugin",
        "plugins": [
          {
            "name": "jfrog",
            "source": { "source": "github", "repo": "jfrog/claude-plugin" }
          }
        ]
      }
    }
  },
  "enabledPlugins": { "jfrog@jfrog-plugin": true },
  "disableSideloadFlags": true
}

Key notes:

• strictKnownMarketplaces restricts Claude Code to the listed marketplace sources. Developers cannot register additional marketplace sources.
• extraKnownMarketplaces registers the JFrog plugin marketplace so the JFrog plugin is trusted.
• enabledPlugins approves the JFrog plugin by name. It does not replace disableSideloadFlags.
• disableSideloadFlags blocks the --plugin-dir, --plugin-url, --agents, and --mcp-config sideload flags. It does not approve the JFrog plugin; enabledPlugins does that.

Frequently Asked Questions

Related Topics

• Plugins Registry Troubleshooting
• JFrog Init Skill
• JFrog AI Catalog Overview
• Agent Plugins Repositories
• JFrog CLI for Agent Plugins
• Get Started with the Skills Registry
• JFrog Plugins
• Use the MCP Registry with Agent Guard