Agent Plugins Repositories

📘

Note

Agent Plugins repositories are a beta feature.

Agent Plugins repositories allow you to index, search, and securely store and distribute your organization's plugins. With plugins as a package type in Artifactory, versioning is enforced at the binary level and immutability and provenance are guaranteed. Agent Plugins repositories integrate with Claude for seamless, native plugin installation. Other clients, including Cursor and Codex, are supported by JFrog CLI commands for plugin distribution and management. Agent Plugins in Artifactory also include a combined index file to serve every supported coding agent from the same location.

Agent Plugins repositories in Artifactory provide the following capabilities:

• Secure plugin ZIP storage: Use local Agent Plugins repositories in Artifactory to securely store plugin ZIP files, index metadata, and serve both marketplace.json and agent-specific marketplace files.
• Multi-harness plugins: Package a single plugin for one agent only, or for multiple agents in one plugin ZIP file using the JFrog CLI.
• Native Claude marketplace integration: Register Artifactory as a plugin marketplace in Claude Code through claude-marketplace.json to download plugins natibely.
• Broad client support with JFrog CLI: Use the JFrog CLI to deploy multi-harness plugin directories and install plugins for Claude, Cursor, and Codex.

Get Started with Agent Plugins

To get started working with Agent Plugins, complete the following main steps:

1. Create Agent Plugins Repository
2. Connect Your Agent to Artifactory
3. Publish Agent Plugins and Install Agent Plugins

Create Agent Plugins Repository

This topic describes how to create an Agent Plugins repository. This is required before publishing plugin ZIP files and serving marketplace indexes.

Agent Plugins local repositories allow you to store and share first- and second-party plugin ZIP files with your organization.

For more information on JFrog repositories, see Repository Management.

Prerequisite: You need Admin or Project Admin permissions in Artifactory to create a repository. If you don't have Admin permissions, the option will not be available.

To create an Agent Plugins repository:

1. In the Administration tab, click Repositories > Create a Repository.

   

2. For repository type, select Local.

3. Select the Agent Plugins package type.

4. In the Repository Key field, type a meaningful name for the repository. For example, agent-plugins-local. For more information on local repositories and their settings, see Local Repositories.

5. Click Create Repository. The repository is created and the Repositories page is displayed.

Connect Your Agent to Artifactory

This topic provides details on configuring your agent to treat Artifactory as its plugin marketplace. To get started, see Get Started with Agent Plugins.

Prerequisites:

• Before connecting clients to Artifactory, you must have an existing Agent Plugins repository. For more information, see Create Agent Plugins Repository.

To connect your agent to Artifactory:

1. Configure the JFrog CLI to reference your Artifactory server.
2. If using Claude, Connect Claude Code to Artifactory for native plugin installation.

Configure the JFrog CLI

To use Agent Plugins repositories in Artifactory, configure your Artifactory server in the JFrog CLI.

The JFrog CLI is required to publish plugins to Artifactory and to install plugins for agents that do not support native marketplace integration.

Prerequisite: Make sure you have the latest version of the JFrog CLI installed. For more information, see Install JFrog CLI.

To configure the JFrog CLI:

1. Add your Artifactory server. This stores credentials locally so you do not need to pass --url and --access-token on every command:

   Shell

   jf config add <SERVER_NAME> \
     --url https://<HOST> \
     --access-token <TOKEN> \
     --interactive=false

   Where:

   • <SERVER_NAME>: A name for the server configuration
   • <HOST>: Your JFrog Platform hostname, without a trailing slash
   • <TOKEN>: Your Artifactory identity token

   For example:

   
   
   Shell

   jf config add agent-plugins \
     --url https://company.jfrog.io \
     --access-token <TOKEN> \
     --interactive=false

2. Set the server as your default and verify the configuration:

   Shell

   jf config use <SERVER_NAME>
   jf config show

   For example:

   Shell

   jf config use agent-plugins
   jf config show

3. Set the default Agent Plugins repository for your CLI session:

   Shell

   export JFROG_AGENT_PLUGINS_REPO=<REPO_NAME>

   Where <REPO_NAME> is the repository key of your Agent Plugins repository.

   
   

   For example:

   Shell

   export JFROG_AGENT_PLUGINS_REPO=agent-plugins-local

   
   

Connect Claude Code to Artifactory

Claude Code supports native installation by connecting to your Artifactory repository as a marketplace. Add your Artifactory host to your .netrc file so the Claude Code CLI can authenticate automatically and support native plugin downloads.

To connect Claude Code to Artifactory:

1. Open your .netrc file in a text editor. The file location varies by operating system, for example:

   • Linux and Unix (macOS): ~/.netrc
   • Windows: %USERPROFILE%\_netrc

2. Add the following snippet to the .netrc file:

   Text

   machine <HOST>
   login <USER>
   password <TOKEN>

   Where:

   • <HOST>: Your JFrog Platform hostname
   • <USER>: Your Artifactory username
   • <TOKEN>: Your Artifactory identity token

   For example:

   Text

   machine company.jfrog.io
   login jeffry
   password <TOKEN>

3. Save the changes to your .netrc file and set the minimum required permissions on the file:

   Shell

   chmod 600 ~/.netrc

   The file permissions are restricted to your user only.

4. To register add Artifactory as your Claude Code CLI plugins marketplace, do one of the following:

   • Run the following command in the terminal:

     Shell

     claude plugin marketplace add https://<USER>:<PASSWORD>@<HOST>/artifactory/api/agentplugins/<REPO_NAME>/claude-marketplace.json

     Where:

     • <USER>: Your Artifactory username
     • <PASSWORD>: Your Artifactory identity token
     • <HOST>: Your JFrog Platform hostname
     • <REPO_NAME>: The repository key of your Agent Plugins repository

     For example:

     Shell

     claude plugin marketplace add https://jeffry:<TOKEN>@company.jfrog.io/artifactory/api/agentplugins/agent-plugins-local/claude-marketplace.json

   • In Claude Code CLI, navigate to Plugins > Marketplaces > Add marketplace and paste the same URL:

     https://<USER>:<PASSWORD>@<HOST>/artifactory/api/agentplugins/<REPO_NAME>/claude-marketplace.json

Publish Agent Plugins

Publish a plugin ZIP file into the canonical storage layout so Artifactory can index it. The JFrog CLI is the recommended publish path because it validates multi-harness manifests and builds the ZIP for you.

Plugin ZIP files must follow <name>/<version>/<name>-<version>.zip in the repository, for example, test-plugin/1.1.0/test-plugin-1.1.0.zip. For more information about plugin structure, see Plugin Structure and Layout.

Prerequisite: Configure the JFrog CLI to connect to Artifactory.

To publish a plugin:

• From the directory that contains your harness folder or folders, run the Agent Plugins publish command:

  Shell

  jf agent plugins publish <PATH_TO_PLUGIN_FOLDER> --repo <REPO_NAME>

  Where:

  • <PATH_TO_PLUGIN_FOLDER>: Path to the local directory that contains your plugin harness folder or folders
  • <REPO_NAME>: The name of your Agent Plugins repository

  For example:

  Shell

  jf agent plugins publish ~/plugins/my_plugin.zip --repo agent-plugins-local

  The plugin ZIP file is uploaded to your Agent Plugins repository.

After a successful upload, Artifactory indexes the plugin ZIP file into every marketplace file that matches the manifests found inside it.

📘

Tip

You can optionally specify a specific version by appending --version to the publish command and specifying a SemVer number.

Publish Plugins with Evidence Signing

Evidence signing attaches a cryptographic attestation to the published plugin.

To publish a plugin with evidence signing:

• Run the following command:

  Shell

  jf agent plugins publish <PATH_TO_PLUGIN_FOLDER> \
  --repo <REPO_NAME> \
  --version <PLUGIN_VERSION> \
  --signing-key <PATH_TO_EVIDENCE_KEY> \
  --key-alias <KEY_ALIAS> \
  --build-name <BUILD_NAME> \
  --build-number <BUILD_NUMBER>

  Where:

  • <PATH_TO_PLUGIN_FOLDER>: Path to the local directory that contains your plugin harness folder or folders
  • <REPO_NAME>: The name of your Agent Plugins repository
  • <PLUGIN_VERSION>: The SemVer plugin version to publish
  • <PATH_TO_EVIDENCE_KEY>: The path to the PGP private key file used to sign the evidence attestation
  • <KEY_ALIAS>: The alias of the signing key
  • <BUILD_NAME>: The build name recorded in Build Info for this publish. Must be passed together with <BUILD_NUMBER>.
  • <BUILD_NUMBER>: The build number recorded in Build Info for this publish. Must be passed together with <BUILD_NAME>.

Considerations for Publishing Plugins

The following requirements and usage notes apply when you deploy Agent Plugins:

• Storage path layout: Plugin ZIP files must follow <name>/<version>/<name>-<version>.zip in the repository, for example, test-plugin/1.1.0/test-plugin-1.1.0.zip.
  • Path-driven indexing: Artifactory uses the folder path (<name>/<version>/) as the plugin name and version, not the values in plugin.json. If the manifest lists different values, the upload may still succeed, but Artifactory uses the folder path for search and marketplace entries.
  • Upload conflicts: If Artifactory already stores a plugin with the same name and version, the upload succeeds only when you have permission to overwrite existing artifacts. Without overwrite permission, the upload fails.
• Source directory layouts: The JFrog CLI accepts a single-harness directory that contains one agent folder (.claude-plugin/, .cursor-plugin/, or .codex-plugin/) with a plugin.json manifest inside it, or a multi-harness directory that contains two or more agent folders, for example, both .cursor-plugin/ and .codex-plugin/. You choose which harnesses to include. Unrelated combinations such as .cursor-plugin/ and .codex-plugin/ without Claude are valid.
• Multi-harness validation: When you publish a multi-harness plugin with the JFrog CLI, every harness subdirectory must declare the same name and version in its plugin.json. If any manifest disagrees on name or version, the CLI rejects the upload.

Install Agent Plugins

After you deploy a plugin, Artifactory indexes it into the marketplace JSON files for each harness manifest found in the plugin ZIP file. Install is the step where your agent consumes those indexed plugins. The install flow differs by agent.

• Install plugins in Claude Code
• Install plugins with JFrog CLI

Install Plugins in Claude Code

After you register the Artifactory marketplace in Claude, you can install plugins natively in Claude Code. Marketplace entries in claude-marketplace.json use a source type of url that points to the plugin ZIP file, and Claude downloads the plugin ZIP file from that URL.

To install a plugin in Claude Code:

1. In Claude Code, run the following command to get the latest plugins from your marketplace:
   Shell

   /reload-plugins

2. Do one of the following:
   • Navigate to /plugins and use Discover plugins to search, navigate, and browse for plugins.
   • Install a specific plugin directly by running the following command:
     Shell

     claude plugin install <PLUGIN_NAME>

     Where <PLUGIN_NAME> is the name of the plugin.

Install Plugins with JFrog CLI

You can install plugins with the JFrog CLI from the agent-specific marketplace index. If you have not configured the JFrog CLI, complete Configure the JFrog CLI first.

To install plugins with JFrog CLI:

1. Run the install command:

   Shell

   jf agent plugins install <PLUGIN_NAME> --repo <REPO_NAME> --harness <HARNESS>

   Where:

   • <PLUGIN_NAME>: The plugin name from the manifest.
   • <REPO_NAME>: The repository key of your Agent Plugins repository.
   • <HARNESS>: The name of your harness. Possible values are cursor, codex, or claude.

   For example:

   Shell

   jf agent plugins install my.plugin --repo agent-plugins-local --harness cursor

2. Optionally, use the following flags to control the version and install location:

   Flag	Purpose	Example
   --version	Install a specific version, or latest for the newest version.	jf agent plugins install my.plugin --repo agent-plugins-local --harness cursor --version 1.0.0
   --global	Install for the current user instead of the current project. Cannot be used with --project-dir.	jf agent plugins install my.plugin --repo agent-plugins-local --harness cursor --global
   --project-dir	Install into a different project directory. Default is the current directory. Cannot be used with --global.	jf agent plugins install my.plugin --repo agent-plugins-local --harness cursor --project-dir ./my-app
   --path	Install to a custom directory. Use instead of --harness. Cannot be used with --global or --project-dir.	jf agent plugins install my.plugin --repo agent-plugins-local --path ./plugins --version 1.0.0

Additional Agent Plugins Information

The following additional information is available for Agent Plugins repositories:

• Plugin Structure and Layout
• Marketplace Files and Indexing

Plugin Structure and Layout

Plugin ZIP files must follow the path <name>/<version>/<artifact>.zip. After upload, Artifactory extracts manifest files, sets agentplugins.* properties, including multi-valued agentplugins.type with ids such as claude, cursor, and codex, and rebuilds marketplace JSON at the repository root.

The following chart illustrates the common layout for plugins across harnesses.

my-plugin/
├── <manifest-dir>/           # format .<harness>-plugin/
│   └── plugin.json           # only file allowed inside
├── skills/
│   └── <skill-name>/
│       └── SKILL.md          # YAML frontmatter (name, description) + body
├── commands/                 # markdown command files
├── agents/                   # markdown subagent files
├── hooks/
│   └── hooks.json
├── .mcp.json                 # MCP server config
├── assets/                   # icons, logos, screenshots
└── README.md

For more information, see the following:

• Cursor Docs - Plugins
• Claude Code Docs - Create Plugins
• OpenAI Developers documentation - Plugins

Marketplace Files and Indexing

Artifactory maintains the following marketplace index files at the repository root. The marketplace file references the latest version of the plugin only. Older versions are stored in the repository but are not included in the index.

Every plugin.json manifest must live inside a harness-specific folder: .claude-plugin/, .cursor-plugin/, or .codex-plugin/. Artifactory indexes a plugin into the marketplace file that matches each manifest found in the plugin ZIP file.

When a plugin ZIP file contains multiple harness manifests, Artifactory indexes the plugin into every matching marketplace file. For example, a plugin uploaded with only a .claude-plugin/plugin.json appears in both claude-marketplace.json and the unified marketplace.json.

The unified marketplace.json contains one entry per plugin name, using the latest semver version published in the repository regardless of which harness manifest that version carries. For example, if claude-marketplace.json lists plugin at 1.0.0 and a later upload adds plugin at 2.0.0 with only a .cursor-plugin/plugin.json manifest, then cursor-marketplace.json and the unified marketplace.json both list plugin at 2.0.0.

Agent Plugins Limitations in Artifactory

The following are the limitations of Agent Plugins in Artifactory:

• Local repositories only: Agent Plugins repositories support local repositories only. Remote repository proxying of plugin ZIP files is not supported.
• Native marketplace registration: Claude Code supports native marketplace registration through claude-marketplace.json. Cursor and Codex do not yet support an equivalent native marketplace connection. A feature request for adding from HTTP URLs has been logged on the Cursor forum.
• Multi-harness manifest alignment: When you publish a multi-harness plugin with the JFrog CLI, every harness subdirectory must declare the same name and version in its plugin.json. The CLI rejects the upload if they differ.
• Path-driven indexing: Artifactory uses the folder path (<name>/<version>/) as the plugin name and version, not the values in plugin.json. If the manifest lists different values, the upload may still succeed, but Artifactory uses the folder path for search and marketplace entries.
• Duplicate plugin versions: Uploading another plugin ZIP file with the same name and version succeeds only when you have permission to overwrite the existing artifact.
• No package version index file: Agent Plugins repositories do not currently expose a package version index file that lists every published version of a plugin. Marketplace index files list only the latest version per plugin name. To discover or query all versions of a plugin, use OneModel.

Related Topics

• Local Repositories
• AI Editor Extension Repositories
• Skills Repositories