📘

JFrog Security Feature

AI Editor Extension repositories are available as part of the Unified Security and Ultimate Security bundles. For more information, see Security Bundles.

AI Editor Extension repositories in Artifactory are a secure caching proxy for Integrated Development Environment (IDE) extensions like Cursor, Kiro, Windsurf, and VSCode. By proxying public marketplaces like Visual Studio Marketplace, Artifactory gives you control over the IDE plugins used by your developers. This level of control helps secure your development environments by caching and scanning extensions for vulnerabilities and applying Curation policies to prevent the use of unapproved plugins.

Artifactory supports the following capabilities for AI Editor Extension repositories:

• Remote Repository Proxy: Proxy and cache extensions from the public marketplaces that support .visx.
• Secure Your Software Supply Chain: Provide a secure, centralized location to vet and store IDE plugins, minimizing the risk of introducing malicious code into your development environments.
• JFrog Curation Integration: Apply Curation policies to block or approve extensions, preventing risky or unwanted plugins from being downloaded by developers.
• VSCode-based IDE Support: Designed for Cursor, Kiro, Winsdurf, and Visual Studio Code.
• Native Extension Installation: Browse and install extensions natively in your IDE, selecting from the approved and secured extensions in your Artifactory marketplace proxy.

Get Started with AI Editor Extensions

To get started working with AI Editor Extension repositories in Artifactory, complete the following main steps:

1. Create an AI Editor Extension Repository
2. Connect your IDE to Artifactory
3. Install Extensions

Create an AI Editor Extension Repository

This topic describes how to create an AI Editor Extension repository. This is required before installing extensions. Artifactory supports remote AI Editor Extension repositories, allowing you to proxy extension marketplaces and install extensions from your secure cache.

For more information on JFrog repositories, see Repository Management.

Prerequisite: You need Admin or Project Admin permissions in Artifactory to create a repository.

To create an AI Editor Extension repository:

1. In the Administration tab, click Repositories | Create a Repository.

   

2. Select the Remote repository type.

3. Select the AI Editor Extension package type.

4. Configure the required fields for the repository:

   • In the Repository Key field, type a meaningful name for the repository. For example, cursor-remote.

   • Verify the Repository URL and update as needed. The supported URLs include Open VSX based registries:

     • Cursor: https://marketplace.cursorapi.com/_apis/public/gallery
     • Kiro: https://open-vsx.org/vscode/gallery
     • Windsurf: https://marketplace.windsurf.com/vscode/gallery
     • VSCode Public Gallery: https://marketplace.visualstudio.com/_apis/public/gallery

     For more information on remote repositories and their settings, see Remote Repositories.

5. Click Create Repository. The repository is created and the Repositories window is displayed.

Connect your IDE to Artifactory

To use Artifactory as the extension gallery for your IDE, you need to modify the product.json file to point to Artifactory. Supported IDEs are Cursor, Kiro, Windsurf, and VSCode.

Prerequisite: Before connecting your IDE to Artifactory, you must have an existing AI Editor Extensions repository in Artifactory. For more information, see Create an AI Editor Extension Repository.

❗️

Important

This configuration modifies product.json and is a sensitive change. Make a backup of the original file before editing.

Requirements: Write permissions for all parent folders nesting product.json, and privileges to open and edit product.json. The file locations and parent folders vary by OS and IDE. For more information, see product.json File Locations.

There are two ways to connect your IDE to Artifactory:

• JFrog CLI, starting from CLI version 2.85.0
• Manual configuration

Connect your IDE to Artifactory with JFrog CLI

📘

Note

The jfrog ide setup command is available starting from CLI version 2.85.0.

The JFrog CLI simplifies the multi-step configuration process into a single command, allowing you to connect your IDE to Artifactory more easily. The command does three things:

• Disables automatic updates to your IDE. Automatic updates will overwrite your configurations and reset the connection from your Artifactory registry to the default marketplace.
• Provides write access to product.json file and folders.
• Modifies your product.json file to point to Artifactory.

To connect your IDE to Artifactory with JFrog CLI:

• Run this command:

  jf ide setup <IDE> --url "https://<JFrogPlatformURL>/artifactory/api/aieditorextensions/<REPO_NAME>" --update-mode none

  Where:
  • <IDE>: The IDE you want to configure. Possible values are:
    • cursor
    • kiro
    • windsurf
    • vscode
  • <JFrogPlatformURL>: The URL of your JFrog Platform
  • <REPO_NAME>: The name of the target repository
    For example:

  jf ide setup cursor --url "https://company.jfrog.io/artifactory/api/aieditorextensions/cursor-remote" --update-mode none

✅

Tip

• If your JFrog CLI is already set up with a default Artifactory server-id, you can run the script with the --repo-key flag instead of specifying the whole URL.
• If your IDE is installed in a custom path, specify its location using the --prodict-json-path flag.

Connect your IDE to Artifactory Manually

To manually connect your IDE to Artifactory, disable automatic updates and edit the product.json file to point to your Artifactory repository. Automatic IDE updates will cause the marketplace connection to revert from Artifactory to the default.

Requirements: Write permissions for all parent folders nesting product.json, and privileges to open and edit product.json. The file locations and parent folders vary by OS and IDE. For more information, see product.json File Locations.

To connect your IDE to Artifactory:

1. Disable Automatic Updates
2. Set Artifactory as the Marketplace Connection

Disable Automatic Updates

Automatic IDE updates will cause the marketplace connection to revert from Artifactory to the default. Before configuring Artifactory as your marketplace connection, disable automatic updates to prevent overwriting your changes.

To disable automatic updates:

1. Open your settings.json file in a text editor. You can open the file by searching for workbench settings in the Command Palette:

   • Linux and Unix (macOS): Cmd+Shift+P
   • Windows: Ctrl+Shift+P

2. Add the following line to the settings.json file:

   "update.mode":"none"

3. Save your changes and close the file.

Set Artifactory as the Marketplace Connection

To configure your IDE to connect to Artifactory, set the serviceUrl destination to the Artifactory proxy of the extensions marketplace.

To edit the serviceURL to connect to Artifactory:

1. Open the product.json file in a text editor. The file location varies by OS, for example:

   • Linux and Unix (macOS): /Applications/Visual Studio Code.app/Contents/Resources/app
   • Windows: C:\Program Files\Microsoft VS Code\resources\app

2. In the product.json file, edit the extensionsGallery-serviceUrl object as follows:

   "extensionsGallery": {
   	...
   	"serviceUrl":"https://[JFrogPlatformURL]/artifactory/api/aieditorextensions/<REPO_NAME>/_apis/public/gallery",
   	...
   }

   Where:

   • [JFrogPlatformURL]: Your orgainzation's Artifactory URL
   • <REPO_NAME>: The name of the target repository

   For example:

   "extensionsGallery": {
   	...
   	"serviceUrl":"https://company.jfrog.io/artifactory/api/aieditorextensions/vscode-remote/_apis/public/gallery",
   	...
   }

3. Save the changes to your file.

4. Close all instances of your IDE and restart the program.

📘

Note

You can also use JFrog Set me up to copy the snippet populated with your token and environment. For more information, see Use Artifactory Set Me Up for Configuring Package Manager Clients.

Next steps:

• Install Extensions

product.json File Locations

The following table provides the locations of the product.json file for each supported IDE and OS. Use this information to verify the parent folders that you need write access to.

Install Extensions

Once you have configured your IDE to connect to Artifactory, you can browse and install extensions from the secure Artifactory cache of the extensions marketplace natively in your IDE.

You can also install extensions using your IDE's CLI. For more information, see Install Extensions with CLI.

❗️

Important

Extensions that are blocked by your organization's Curation policies will not appear in the Extensions panel. For more information, see Curation.

Install Extensions with CLI

You can install extensions from Artifactory using your IDE's CLI.

To install extensions using the CLI:

Run any of the following commands:

• To install an extension:

  <CLI> --install-extension <PUBLISHER>.<EXTENSION_NAME>

• To install a specific version of an extension:

  <CLI> --install-extension <PUBLISHER>.<EXTENSION_NAME>@<VERSION>

• To force download the latest versions of an extension:

  <CLI> --install-extension <PUBLISHER>.<EXTENSION_NAME> --force

Where:

• <CLI>: The CLI command for your IDE. Possible values are:
  • cursor
  • kiro
  • surf
  • code
• <PUBLISHER>: The publisher of the extension
• <EXTENSION_NAME>: The name of the extension
• <VERSION>: The version number of the extension

For example:

cursor --install-extension [email protected]

❗️

Important

You can't install extensions that are blocked by your organization's Curation policies. For more information, see Curation .

Limitations of AI Editor Extensions in Artifactory

The following are the limitations of AI Editor Extension repositories in Artifactory:

• Anonymous Access and Read-Only Operations: AI Editor Extension repositories in Artifactory do not support authentication due to a client-side limitation in Visual Studio Code. This means that connecting to a private extension marketplace with credentials is not yet supported. All connections to AI Editor Extension repositories are treated as anonymous and all operations for this repository type are read-only.
• Auto-Update Limitations: To preserve the connection to the marketplace proxy in Artifactory, it is recommended to disable auto-update for your IDE. When auto-update is enabled, the IDE configuration settings will revert the connection to the default marketplace.