Features and Capabilities

JFrog Catalog provides security, compliance, and operational risk analysis through the following features:

Search Capabilities

• Package Search: Find any supported package or Common Vulnerabilities and Exposures (CVEs).
• CVE Search: Identify and analyze vulnerabilities augmented by JFrog Security Research.

Package Detail View

• Vulnerabilities:
  • Non-transitive CVEs: Risks related to the specific package.
  • Transitive CVEs: Risks inherited from dependencies.
  • JFrog Enriched Data: Additional insights on mitigating CVEs.
• Dependencies Analysis:
  • Table View: Lists direct and indirect dependencies.
  • Graph View: A visual dependency tree showing risk propagation.
• Licensing Information:
  • Displays open-source software (OSS) license requirements for compliance.
  • Helps legal teams assess software usage risks.
  • Submit a review request for missing or incorrect package licenses directly from the Catalog UI. The JFrog Security Research team validates the license, updates the Catalog, and notifies you once the review is complete.
  • Create and assign custom licenses to packages or versions, with optional expiration dates. JFrog Curation evaluates those custom licenses in license-based policy conditions. For more information, see Create and Assign Custom Licenses.
• OpenSSF Score:
  • Evaluates open-source project security risks.
  • Enables informed decisions on accepting dependencies.
• Public Labels:
  • JFrog Catalog now includes Public Labels, predefined labels created by the JFrog Security Research team to classify and highlight important package groups. Public labels are read-only, applied automatically, and help teams filter and evaluate packages across ecosystems.
  • MCP Servers: A new public label identifies packages originating from MCP (Model Context Protocol) servers. Identifier: mcp

Comparison and Automation

• Package Comparison: Compare vulnerabilities, dependencies, and licenses across multiple packages or versions.
• GraphQL API: Retrieve bulk package information, automate workflows, and integrate external tools using Catalog GraphQL on OneModel.
• Catalog Labels: Categorize and manage packages for Curation policies.

Related Topics

• Catalog
• Configure Catalog
• Products and Concepts