Package Traffic Controller (PTC)

JFrog Package Traffic Controller (PTC) intercepts public package traffic at the network layer and routes it through Artifactory, so JFrog Curation policies and audit logging apply to every intercepted install without changing how developers work. PTC integrates with your existing security edge, the same tool already inspecting outbound traffic, to redirect matching package requests to Artifactory's /artifactory/api/package-reroute endpoint.

New to PTC? Start with PTC Quick Start for a concise end-to-end walkthrough, then use the linked topics for detailed configuration and troubleshooting.

Once the security edge client, the trust store, and redirect policies are in place, every process on that workstation is governed the same way, whether the install originates from a human developer or an AI coding agent. The technical entry point is the package-reroute service (Router path /package-reroute, REST API under /artifactory/api/package-reroute/).

Important — PTC requires a remote repository: The Package Reroute repo_key must point to a remote repository. Virtual repositories are not supported as the PTC repo_key. This keeps PTC configuration aligned to the upstream-facing repository used for consumption tracking and Curation behavior.

Supported Security Edges

PTC integrates with your existing security edge (SASE) to intercept package traffic and redirect it to Artifactory. JFrog publishes step-by-step guides for these security edges. You follow the guide for the vendor your organization already uses.

Zscaler Internet Access (ZIA) — see Configure Zscaler ZIA
Netskope — see Configure Netskope
Cloudflare Gateway — see Configure Cloudflare Gateway

For more information about every other security edge, see Other Compatible Security Edges.

For the shared registry hostname reference used by all SASE providers, see Public Registry Hostnames. For deployment order, see Deployment Sequence.

Other Compatible Security Edges

A security edge outside the published guides can send package traffic through PTC when it meets the redirect requirements in this section. Artifactory receives the same /artifactory/api/package-reroute request from each compatible edge. JFrog publishes portal steps for Zscaler, Netskope, and Cloudflare. For every other product, you configure the equivalent settings in that product's administration portal.

The security edge requires:

URL category: A URL category or equivalent destination list that matches the intercepted public registry hostnames. See Public Registry Hostnames.
SSL inspection: HTTPS decryption for those hostnames so the edge can apply the redirect.
HTTP 307 redirect: An HTTP 307 response for GET and HEAD, with the url query parameter set to the percent-encoded original registry URL.

https://<YOUR_ARTIFACTORY_URL>/artifactory/api/package-reroute?url=<percent-encoded-original-url>

The url query parameter is required. For https://registry.npmjs.org/express, use https%3A%2F%2Fregistry.npmjs.org%2Fexpress.

Compatible security edges use the same limits as the published guides:

Request methods: Redirect rules include GET and HEAD but exclude POST. Commands such as npm audit send POST and fail when that method is redirected. For huggingface.co, redirect rules include GET only. See Configuration by Package Type.
Artifactory exclusion: You exclude the Artifactory hostname from the redirect rule so redirected traffic isn't intercepted again.
Certificate trust: You trust the security edge certificate authority (CA) on each workstation before you enable SSL inspection. For more information, see Configure Workstation for PTC.

You validate Artifactory before you enable the redirect. A request to /artifactory/api/package-reroute?url=... returns HTTP 302 or 307 with a Location header that points at your Artifactory remote repository. For more information, see Step 4: Verify the Redirect Endpoint.

Supported Package Types (GA)

The following ecosystems are supported for PTC. For detailed client guidance, see Configuration by Package Type.

npm — supported clients: npm, pnpm, and yarn
Python (PyPI) — supported clients: pip, pipenv, Poetry (version 1.7.0 or later), and uv. See Configuring Artifactory to Support Poetry for PTC for the Poetry version constraint.
Docker — Container images and trust configuration. JFrog-validated engines, CLIs, and tools are listed under Docker, Hugging Face, and Other Types.
Hugging Face — see Docker, Hugging Face, and Other Types
RubyGems — supported clients: gem, Bundler. See RubyGems Configuration.
Cargo (Rust) — supported clients: cargo. See Cargo (Rust) Configuration.
Java (Maven) — supported client: mvn (and Maven Wrapper) against Maven Central (repo1.maven.org, repo.maven.apache.org). See Maven Configuration.
Go — supported client: the go command. See Go Configuration.

Supported Workstation Operating Systems

Windows
macOS
Linux

Install scripts, certificate placement, and environment variables are maintained in the scripts/ README.

How It Works

sequenceDiagram
    participant Dev as DeveloperMachine
    participant SASE as SASE
    participant AF as JFrog_Artifactory
    participant Repo as NPM_Repository
    participant Cur as CurationEngine
    participant Pub as PublicRegistry

    Dev->>SASE: npm install GET registry.npmjs.org/package
    SASE->>SASE: SSL Inspection and URL Match
    SASE-->>Dev: HTTP 307 Redirect to Artifactory
    Dev->>AF: Follow redirect to /artifactory/api/package-reroute
    AF-->>Dev: Redirect to NPM Repository
    Dev->>Repo: Request package
    Repo->>Cur: Check curation policies
    alt Package Approved
        Cur-->>Repo: Approved
        Repo->>Pub: Fetch package
        Pub-->>Repo: Return package
        Repo-->>Dev: Package delivered
    else Package Blocked
        Cur-->>Dev: Policy violation error
    end

The sequence diagram shows the path when JFrog Curation is enabled on the remote that resolves the package. If Curation is not enabled, the curation policy check and approve/block branch do not occur.

A typical redirect format:

<YOUR_ARTIFACTORY_URL>/artifactory/api/package-reroute?url=https%3A%2F%2Fregistry.npmjs.org%2Fexpress

The url value is percent-encoded in real redirects and in curl tests. See Step 4: Verify the Redirect Endpoint.

For end-to-end setup, see Configure Artifactory for PTC and your SASE provider's guide (see Supported Security Edges). For deployment-scope choices (organization-wide vs scoped to specific groups), see Scoped Versus Unscoped Deployment.

Document Map

Topic	Page
PTC Quick Start (end-to-end walkthrough)	PTC Quick Start
Deployment Sequence and Gradual Rollout	Deployment and Rollout
Prerequisites	Review PTC Prerequisites
Workstation Configuration	Configure Workstation for PTC
JFrog Artifactory Configuration	Configure Artifactory for PTC
Zscaler ZIA Configuration Guide	Configure Zscaler ZIA
Netskope Configuration Guide	Configure Netskope
Other Compatible Security Edges	Other Compatible Security Edges
Configuration API	Package Reroute Config API
Configuration by Package Type	Configuration by Package Type
Package Reroute Logs	Package Reroute Logs for PTC
Known Limitations and Troubleshooting	Limitations and Troubleshooting

Frequently Asked Questions

This section provides answers to frequently asked questions about Package Traffic Controller (PTC).

plusFAQs

Q: What is JFrog Package Traffic Controller (PTC)?

A: PTC integrates your existing SASE provider with JFrog Artifactory to intercept outbound public registry traffic and route it through Artifactory before packages reach developers. JFrog Curation policies and audit logging can apply to that traffic without changing package manager commands. For more information, see Supported Security Edges for the published vendor guides. See Other Compatible Security Edges for every other product.

Q: Can I use a security edge that is not listed?

A: Yes, when that security edge meets the redirect requirements in Other Compatible Security Edges. JFrog publishes portal steps for Zscaler, Netskope, and Cloudflare. You configure the equivalent settings in your product's administration portal.

Q: What do I need before deploying PTC?

A: You need JFrog Artifactory with Package Reroute configured, a SASE client on workstations, trust for the SASE CA per package client, and SASE redirect rules in the order described in Deployment and Rollout. See Prerequisites for the full checklist.

Q: Does PTC work with private or scoped npm packages?

A: PTC does not forward developer registry credentials. For private or scoped packages that require client credentials, point the package manager at your Artifactory remote repository URL with tokens instead of relying on redirect alone. See Private and Scoped Packages for the full constraint and workarounds.

Q: Why must redirect rules exclude POST requests?

A: Commands such as npm audit send POST to registry hosts. Redirecting POST causes those commands to fail. Configure your SASE provider's redirect rules to allow only GET and HEAD for registry traffic. For more information, see your SASE provider's guide in Supported Security Edges. See Other Compatible Security Edges for every other product.

Q: Can I roll out PTC to a pilot group first?

A: Yes. Use your SASE group controls on the inspection and redirect rules, and phase package ecosystems one at a time. JFrog recommends this approach. See Gradual Rollout Recommendation.