On-Demand Curation

The On-Demand Curation feature extends JFrog Curation to secure packages retrieved from remote repositories that are not covered by the JFrog Public Catalog. When developers request packages from such repositories, Curation applies your organization's existing security policies — evaluating vulnerabilities, licenses, immaturity, and malicious code — for immediate enforcement.

This ensures consistent governance across a broader range of components, including internal, private, or ecosystem-specific repositories that are not yet cataloged. Supported package types

How It Works

The on-demand process begins when a developer requests a package from a remote repository proxied through Artifactory:

1. The developer's build tool requests a package from a remote repository.
2. JFrog Curation intercepts the request.
3. If the package is not in the Public Catalog, it is processed through On-Demand Curation.
4. Curation evaluates vulnerabilities, licenses, malicious indicators, and immaturity before releasing the package.
5. The results are stored in the On-Demand Catalog for future requests.

First Request Behavior

When a package is requested for the first time, Curation runs a security scan. It stores the results in the catalog for later requests for a quicker response. During this period, a developer may see a Pending On demand data status or a temporary block.

Whether the request is blocked while the scan is pending depends on each policy. A policy blocks the request only when you select Block for on demand pending packages in Step 5 of the policy wizard. For more information, see Pending Catalog Update Behavior.

You can't waive a package that's blocked while its on-demand scan is pending.

On-Demand Curation returns a policy decision only after Xray has scanned the artifact. For a package that already exists in an indexed repository but has no Xray scan record yet (for example, an artifact cached before On-Demand Curation was enabled), Xray starts scanning when On-Demand Curation first requests the package. Retry the download after that Xray scan completes.

Most packages succeed on the first request after the Xray scan finishes. When Catalog has the result, that request allows or blocks the download based on your policies. Later requests use the stored On-Demand Catalog data.

Retry a timed-out request

A large artifact, such as a large Docker image, can still time out on the first request after the Xray scan finishes, while Catalog processes the scan results. Catalog keeps that result for one hour. Retry a few minutes later. Most large artifacts are ready within two to three minutes. There is no status that shows when the cached result is ready.

After one hour, Catalog drops the cached result, and the next request processes the artifact again. If a large artifact times out, retry within that hour. An attempt more than one hour later can time out again. A pipeline that waits longer than one hour between attempts can keep receiving the same timeout.

Audit Results

When a user tries to download a package, three results are possible:

Prerequisites

Saas

Self-Hosted

Valkey installation

Contact JFrog Support for self-hosted version requirements.

Configuration Requirements

• Enable Xray indexing and configure the repository for indexing before enabling Curation On-Demand. On-demand scans run only on indexed repositories.
  When On-Demand Curation requests a legacy package in an indexed repository that has no scan record yet, Xray triggers scanning automatically instead of leaving the package in Pending Catalog Update indefinitely.
  To index a repository, go to Xray Settings > Indexed Resources, and from the menu of the repository you wish to index, select Index Now.
• In Administration > Repositories, ensure the repository has Curation enabled.
• Curation for Cached Packages must be enabled first — the On-Demand feature relies on the Block-from-Cache mechanism. See Block Downloads from Cached Remote Repositories.

Enabling On-Demand Curation

Step 1: Enable Curation for Cached Packages

On-Demand Curation requires the Block-from-Cache feature to be active.

1. Navigate to Administration > Curation > General.
2. Under Advanced Coverage, enable Curation for Cached Packages.

Step 2: Enable On-Demand Curation

1. In the same Advanced Coverage section, enable Enable Curation On-Demand for On-Demand Packages in the JFrog Catalog.

This toggle enables visibility for on-demand repositories — all repositories that belong to a supported ecosystem (e.g., Maven) but are not yet supported in the Public Catalog. To enforce policies, you must also enable Curation for specific package types or repositories. Disabling this toggle disconnects all on-demand repositories.

Step 3: Enable Per Package Type or Per Repository

After enabling the global On-Demand toggle, you need to activate it for specific package types or individual repositories:

• By package type: Connecting a package type enables curation for all current and future on-demand repositories of that ecosystem.
• By individual repository: You can connect or disconnect specific repositories from the inner settings page. Future repositories for the package type remain auto-connectable.

Policy Enforcement

The following JFrog Curation policies apply to on-demand packages:

Labels and Waivers

• Labels: On-demand packages can be tagged with labels and used in governance policies, just like Public Catalog packages.
• Waivers: After an on-demand scan completes, you can request an exception for a policy violation. You can't request a waiver while the scan data is pending.

On-Demand Catalog

The On-Demand Catalog is your organization's private catalog, storing results for repositories hosted in your Artifactory instance that are internal, sensitive, or private.

Capabilities

• Vulnerability, license, and maliciousness results are stored in a dedicated On-Demand Catalog, accessible via UI and API.
• Supports non-public repositories within supported ecosystems.
• Integrated with Docker — on-demand scanning is available for Docker containers and images, with vulnerability and license insights visible in the Docker UI.

UI Behavior

• Search allows discovery of on-demand packages, clearly marked with an "On-Demand" tag.
• Repository lists and policy results show which entities are handled via On-Demand Curation.
• The "See All" page displays results from both the Public Catalog and the On-Demand Catalog in separate tabs.
• If a package appears in both the Public and On-Demand Catalogs, users see a notification with a link to the alternate record.

Indexing

• On-demand scans can only be performed on repositories that have been indexed.
• New packages downloaded using Curation On-Demand are automatically indexed.
• Legacy packages already cached in an indexed repository before On-Demand Curation was enabled are scanned on first On-Demand Curation request.

Using the JFrog CLI

For the best developer experience with On-Demand Curation, use the JFrog CLI with the jf ca (curation-audit) command.

For Docker, use the --include-cached-packages flag to audit cached packages. This is required when using Curation On-Demand, as packages are cached:

jf ca --image <image_name> --include-cached-packages=true

On-Demand GraphQL API

On-demand packages can also be queried via the GraphQL API at a different endpoint than the Public Catalog:

Endpoint: POST /onemodel/api/v1/graphql

Example Request

curl -X POST \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer {ADMIN_TOKEN}' \
  -d '{"query":"{ customPackages { getPackageLocation(url: \"docker-remote-cache/library/redis/sha256__<digest>/manifest.json\") { artifacts(first:1) { edges { node { version { version customPackage { name type ecosystem } legalInfo { licenseInfo { expression } } customSecurityInfo { maliciousnessInfo { knownToBeMalicious } vulnerabilitiesConnection(first: 10) { totalCount edges { node { name severity cvss { preferredBaseScore } } } } } } } } } } } }","variables":{}}' \
  'https://<JFROG_URL>/onemodel/api/v1/graphql/'

An admin token is required for all On-Demand Catalog GraphQL requests.

Audit and Compliance

All on-demand curation activity is logged for tracking and compliance. The audit log captures:

• Package requests and their origin (external source, cache, or CLI simulation)
• Policy decisions (blocked, approved, or pending)
• Enforcement outcomes with policy and condition details

Audit events for on-demand packages appear alongside standard curation audit events in the Curated Packages Audit page.

Important Caveats and Limitations

• First-time scan delay: The first scan of a package that is not in the catalog can take longer than a later request. After the Xray scan finishes, most requests return a policy decision immediately.
• Timeout behavior: The retry mechanism is automatically enabled, saving up to 90% of the packages. If the inspection times out, the package can be blocked (based on policy configuration).
  Catalog stores the result. A retry within an hour of the scan will be resolved like a regular Curation operation. A retry more than one hour later fetches the latest data from Xray and can time out again on a large artifact.See Retry a timed-out request.
• Vulnerability identifiers: On-Demand Curation includes vulnerabilities that have a CVE identifier. Vulnerabilities reported only with an Xray identifier are omitted, so the On-Demand Catalog count can be lower than the Xray count for the same artifact.
• OpenSSF score: Not supported for on-demand packages.
• Docker repositories: When On-Demand is activated, existing Docker repositories that were already curated automatically receive the On-Demand tag. Existing Docker policies apply immediately.
• New ecosystems: Ecosystems not currently supported in the Public Catalog can be supported upon request and prioritization. Contact JFrog Support for details.