Catalog

Learn how JFrog Catalog reveals open-source security and license risk.

JFrog Catalog is a centralized repository of open-source software (OSS) packages and Common Vulnerabilities and Exposures (CVEs), enriched with security, compliance, and operational risk insights. It serves as a single source of truth for organizations managing their software supply chain, offering deep visibility into package vulnerabilities, dependencies, and licensing requirements.

With data continuously enriched by JFrog Security Research, JFrog Catalog provides actionable intelligence that helps development, security, and compliance teams make informed decisions about the software components they use.

Where Does JFrog Catalog Fit in the Security Timeline?

JFrog Catalog acts as the foundation for JFrog Security products, providing enriched OSS metadata, vulnerabilities, dependencies, and license insights before a development pipeline ingests software. Teams primarily use it before security scanning and enforcement.

JFrog Catalog supports pre-selection and OSS intelligence.

When: Catalog applies before software components are introduced into development.
Purpose: Teams research, compare, and pre-approve open-source packages before they enter the CI/CD pipeline.

For more information, see Install Catalog.

Key Benefits of JFrog Catalog

1. Comprehensive Software Visibility

Enables quick identification of vulnerabilities within open-source components.
Provides a detailed view of package dependencies, including transitive risks.
Centralizes information on OSS licensing, helping legal teams manage compliance.

2. Strengthened Security and Risk Mitigation

Offers enriched CVE data to proactively address security threats.
Integrates with OpenSSF Scorecards to assess the security posture of OSS projects.
Helps developers choose more secure and well-maintained software packages.

3. Seamless Package Management with Labels

Allows organizations to categorize and manage packages through Catalog labels.
Enables fine-grained curation policies, ensuring that only approved software is used.
Supports bulk automation through Catalog GraphQL, streamlining package governance at scale.

4. Efficient Decision-Making

Empowers teams to compare multiple packages based on security, compliance, and dependencies.
Supports customized package selection, enabling organizations to make risk-aware software choices.