JFrog AI Catalog becomes a control plane to secure AI agents that write code

JFrog has published an update on its corporate blog about the evolution of its AI Catalog product, originally presented at its swampUP 2025 event as a secure registry of AI models and now repositioned as what the company calls a "control plane" for what it terms the Agentic Development Lifecycle (ADLC). It is worth reading the article with a critical eye: it is marketing content signed by one of the company's own product management leads, published to promote its platform, so claims about capabilities and advantages over the competition should be taken as the sales pitch they are, although the specific data it cites on security incidents does provide genuine informational value.

The text's central thesis is that the leap from the classic SDLC (software development lifecycle, where a human writes code that becomes a binary) to the ADLC (where a specification is handed directly to an AI agent that generates the code) has broken traditional security models. According to JFrog, a coding agent is not a single component audited once, but a dynamic assembly of pieces coming from different external sources, each dragging along its own unverified supply chain: language models (local, fine-tuned or accessed via external APIs), MCP servers (Model Context Protocol, which allow the agent to execute actions), "skills" and plugins (bundles of instructions, scripts and resources), explicit behavior rules, "hooks" (scripts that fire automatically at specific points in the agent's execution) and packages managed through APM (Agent Package Manager, an open-source dependency manager designed specifically for AI agents). JFrog's argument is that none of these elements go through the security reviews normally applied to a conventional software dependency.

The article backs this concern with several concrete examples of attacks already detected, attributed to its own security research team. It cites a malicious MCP server impersonating the Postmark email service, which managed to pass superficial reviews and, once running, secretly copied (BCC) every email sent by the agent to a malicious actor. It also mentions the incident dubbed "omnicogg", in which a seemingly harmless "skill" concealed a 22 MB file designed to execute an encoded payload; that package reportedly evaded all 65 VirusTotal detection engines and racked up more than 5,000 installations in 19 days before being discovered by JFrog researchers. The text adds that supply chain attacks recorded in 2026 against projects such as LiteLLM, TanStack and Mistral AI demonstrate that AI dependencies are just as vulnerable as traditional binaries, with the aggravating factor that autonomous agents widen the blast radius at machine speed. The common pattern JFrog points to is that these attacks bypass signature-based scanning (comparing a file against a list of hashes already known to be malicious), a method that is by definition blind to a new threat not yet on that list.

From these cases, JFrog describes what it says it has heard from security and platform teams: the absence of a single trusted source for vetting and distributing approved AI assets, the total lack of visibility into which skills, plugins and MCP servers agents are actually consuming dynamically, and the fact that traditional security controls and CI/CD gates, designed for static binaries, are not equipped to inspect these new executable assets.

In response, the company details the expansion of AI Catalog beyond the original model registry (which already integrated Hugging Face, NVIDIA NIM, external providers and fine-tuned proprietary models). The product now incorporates an MCP Registry to define which MCP servers are permitted per project and to restrict calls to specific tools; an Agent Skills Registry that requires signing, verification and scanning before an agent can execute a skill; a Plugins Registry with the same treatment; and Agent Packages, which bundle an agent's entire context and dependency tree into a single versioned package compliant with the open APM standard. All of these assets are stored as versioned, traceable artifacts within Artifactory, the binary repository the company already sells.

On that foundation, JFrog adds two detection mechanisms: a "semantic scan" that, as it describes it, analyzes what an asset is actually instructing the agent to do rather than merely comparing hashes against known threat lists; and a "Shadow AI" detection feature that automatically classifies every AI asset present in the environment as managed, unmanaged, partially managed or malicious. The runtime enforcement piece is called Agent Guard, which is installed via JFrog's official plugins for coding agents such as Claude Code, Cursor, VS Code, OpenCode and Codex, and which checks every call to an MCP tool or a skill against the organization's policies at execution time, regardless of the agent environment or "harness" each developer uses.

The article closes with an explicitly competitive positioning: it argues that most AI governance or security solutions on the market operate as systems parallel to the existing software supply chain (separate registry, separate gateway, separate policy engine, separate audit trail), which forces manual reconciliation of several systems every time a compliance team asks a question. Against that, JFrog contends that its approach treats models, MCP servers, skills, plugins and agent packages as first-class artifacts within the same system of record that already houses a company's binaries, with a single role-based access control model and a single audit trail, compatible with any coding agent regardless of origin. The text itself invites readers to request a demo with a JFrog solutions engineer, confirming its nature as a promotional piece within a product content strategy, although the diagnosis it offers of the real security risks in AI agent-assisted development is a point of interest independent of the specific solution the company sells to address it.